Privacy Policy

X-Area ("we", "our", or "us") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) and applicable data protection laws. This Privacy Policy explains how we collect, use, store, and protect your data when you use our platform.

1. Who We Are

Toppers Tutoring Pty Ltd, trading as X-Area, is a South African company based in Cape Town. X-Area is a tutoring management platform covering sessions, attendance, assessments and marks, invoicing, and sponsor reporting.

Where we collect information directly from people who use the platform, we act as the Responsible Party (Data Controller). Where an organisation uses X-Area to manage its own students and staff, we act as an Operator (Data Processor) on that organisation's behalf, and the organisation is the Responsible Party for that data.

For any privacy-related queries, contact us at hello@x-area.co.za. Our Information Officer, as required by POPIA Section 55, can be reached at info@topperstutoring.com.

2. Information We Collect

We collect the following categories of personal information:

• Account holders (tutors, managers & admins): Name, email address, phone number (optional), password (hashed), company name, and role.
• Students: Name, email address, phone number (optional), an auto-generated student number, and subject enrolments.
• Academic records: Attendance status and check-in and check-out times, excuse notes, assessment answers and uploaded files (including photographs of handwritten working), marks, and tutor feedback.
• Technical data: IP address, browser type, and device information collected automatically for security and performance.
• Product usage data: Pages opened and actions taken in the platform, associated with your account, so we can understand how X-Area is used and where it fails people.

We do not collect special category information (such as race, health, or biometric data) unless it is provided voluntarily in support of an excused absence.

3. How We Use Your Information

We use your personal information to:

• Provide and operate the X-Area platform
• Authenticate users and maintain account security
• Record and display attendance, assessment and progress data to authorised tutors and administrators
• Produce progress reporting for sponsors and funders, where an organisation has enabled it (see section 4)
• Send transactional emails (e.g. password resets, session and marking notifications)
• Improve our product and fix technical issues

We do not sell or rent your personal data, and we do not share it with third parties for their own marketing purposes.

4. Sponsor & Funder Portals

Organisations using X-Area can give a sponsor, funder or scholarship provider a read-only portal showing progress for the students that sponsor funds. The portal is reached through a private link containing a secret token rather than a username and password, so anyone holding the link can open it.

Through that portal a sponsor can see the student's name, student number, attendance record, flagged risk status, marks, and — where a phone number has been captured for that student — their phone number, presented as a shortcut for contacting the student directly by WhatsApp.

Selecting that shortcut opens WhatsApp, which is operated by Meta. We do not send the message and we are not party to it. Once you leave X-Area, WhatsApp's own terms and privacy policy apply to what happens there.

The organisation decides which sponsors receive a portal link and which students appear in it. Organisations are responsible for having a lawful basis to disclose student contact details to a sponsor, for obtaining any parental or guardian consent required where the student is a minor, and for revoking links that should no longer be live. Portal links can be regenerated or withdrawn at any time from the platform, which immediately invalidates the previous link.

5. Legal Basis for Processing

We process your personal information on the following lawful grounds:

• Contractual necessity: To provide the services you signed up for
• Legitimate interest: To maintain security, report to sponsors on an organisation's behalf, and improve our platform
• Consent: Where you have explicitly agreed, such as marketing communications

6. Data Storage & Security

Your data is stored on Supabase (PostgreSQL), hosted in Ireland within the European Economic Area. We implement row-level access controls, encrypted connections (HTTPS/TLS), and hashed passwords. Uploaded files are reachable only through short-lived signed links generated when an authorised person opens the page, and are not publicly addressable. No system is 100% secure, but we take reasonable and industry-standard precautions to protect your information.

7. Data Retention

We retain your data for as long as your account is active or as required to provide our services. Attendance and assessment records are kept for three years from the session or submission date unless the organisation instructs earlier deletion. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law. The in-platform policy sets out retention periods per record type in full.

8. Your Rights Under POPIA

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal obligations)
• Object to or restrict processing of your data
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at hello@x-area.co.za.

9. Cookies & Analytics

We use essential cookies to maintain your login session and for basic platform functionality. We do not use advertising cookies and we do not sell any information to advertisers.

We do use a product analytics service to understand how the platform is used and where it fails people. Those events are recorded in your browser and on our servers and are associated with your account and organisation. This is described in section 2 and in full in the in-platform policy.

10. Third-Party Services

We use the following third-party providers who may process data on our behalf:

• Supabase — database, authentication and file storage (Ireland, EEA)
• PostHog — product analytics (United States)
• Resend — delivery of transactional email (United States)
• PayFast — subscription payments; we never receive or store card details (South Africa)
• Google Fonts — font delivery (no personal data shared)

PostHog and Resend process information in the United States. WhatsApp is not one of our providers and does not process data on our behalf — it is a separate service you are handed off to if you choose to use a WhatsApp shortcut, as described in section 4.

11. Children's Privacy

Organisations use X-Area to manage students who may be minors. Where that is the case, the organisation is responsible for obtaining any parental or guardian consent required by law, including POPIA Section 35, before entering a student's information — and before making that information, including contact details, visible to a sponsor. Direct accounts on the platform for administrators, managers and tutors are limited to individuals aged 18 or older.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or a notice on the platform, and account holders are asked to confirm they have read a materially changed policy the next time they sign in. Continued use of X-Area after changes constitutes acceptance of the revised policy.

13. Contact

If you have any questions about this Privacy Policy or how your data is handled, please contact us at hello@x-area.co.za or visit our Contact page.