Privacy Policy

X-Area ("we", "our", or "us") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) and applicable data protection laws. This Privacy Policy explains how we collect, use, store, and protect your data when you use our platform.

1. Who We Are

X-Area is an attendance and session management platform built for tutoring companies and independent tutors. We are based in Cape Town, South Africa. For any privacy-related queries, contact us at hello@x-area.app.

2. Information We Collect

We collect the following categories of personal information:

• Account holders (tutors & admins): Name, email address, password (hashed), company name, and role.
• Students: Name and email address, used solely for attendance identification.
• Usage data: Session activity, check-in and check-out timestamps, and attendance records.
• Technical data: IP address, browser type, and device information collected automatically for security and performance.

3. How We Use Your Information

We use your personal information to:

• Provide and operate the X-Area platform
• Authenticate users and maintain account security
• Record and display attendance data to authorised tutors and administrators
• Send transactional emails (e.g. password resets, session notifications)
• Improve our product and fix technical issues

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

We process your personal information on the following lawful grounds:

• Contractual necessity: To provide the services you signed up for
• Legitimate interest: To maintain security and improve our platform
• Consent: Where you have explicitly agreed, such as marketing communications

5. Data Storage & Security

Your data is stored on Supabase (PostgreSQL), hosted on secure cloud infrastructure. We implement row-level access controls, encrypted connections (HTTPS/TLS), and hashed passwords. No system is 100% secure, but we take reasonable and industry-standard precautions to protect your information.

6. Data Retention

We retain your data for as long as your account is active or as required to provide our services. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

7. Your Rights Under POPIA

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal obligations)
• Object to or restrict processing of your data
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at hello@x-area.app.

8. Cookies

We use essential cookies only — to maintain your login session and for basic platform functionality. We do not use advertising or tracking cookies.

9. Third-Party Services

We use the following third-party providers who may process data on our behalf:

• Supabase — database and authentication
• Google Fonts — font delivery (no personal data shared)

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or a notice on the platform. Continued use of X-Area after changes constitutes acceptance of the revised policy.

11. Contact

If you have any questions about this Privacy Policy or how your data is handled, please contact us at hello@x-area.app or visit our Contact page.