Inscripchat — Privacy Policy

The short version

• We collect the details you give us when you register (name, email, university, course, profile image), plus what you post and basic technical data.
• We use them to run your account, to understand how the Platform is used, and to show advertising on the Platform.
• We suggest other students you may want to add as peers, based on your course, university, Groups, mutual peers, the modules you take and use, and (if you tell us) your year of study and free times. You can switch this off in your settings at any time.
• We do not sell, rent or share your personal information with outside companies for their own marketing. Advertisers only ever see anonymous, combined statistics.
• Consent is our main basis for processing. You can withdraw it at any time, and you can switch off personalised advertising without losing access to Inscripchat.
• You can ask us to access, correct or delete your information, and you can complain to the Information Regulator or another authority.
• Email us at support@inscripchat.com about anything in this policy.

1. Who We Are and What This Policy Covers

1.1 Inscripchat (the "Platform") is operated by [LEGAL ENTITY NAME] ("we", "us", "our"). We decide why and how your personal information is processed. That makes us the "responsible party" under the Protection of Personal Information Act 4 of 2013 ("POPIA"), the "controller" under the EU and UK General Data Protection Regulation ("GDPR"), and a "business" under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") — in each case to the extent those laws apply.

1.2 This policy explains what personal information we collect, why we use it, who can see it, how long we keep it, and what rights you have. It applies to the Platform and to related communications with us. It forms part of our Terms and Conditions.

1.3 "Personal information" means information that identifies you or can reasonably be linked to you, such as your name, email address or profile image.

1.4 [IF APPLICABLE — EU/UK REPRESENTATIVE: Our representative in the European Union (GDPR Article 27) is [NAME AND ADDRESS].]

2. Information We Collect

2.1 What you give us

2.2 What we collect automatically. When you use the Platform we and our systems record: your IP address; your device, browser and operating system details (the "user agent"); dates and times of sign-ins and activity; which materials you view (and the course module each one belongs to); whether you are online and when you were last active; and security events such as failed sign-ins. We also set a session cookie (see section 9).

2.3 What we receive from others. Other Users may give us information about you, for example by mentioning you, inviting you to a Group, adding you as a peer, or reporting your content.

2.4 Staff accounts. Accounts used to administer the Platform also store the details needed for two-factor authentication (an authenticator secret and recovery codes).

2.5 What is required and what is optional. Name, email, password, university and course are required to create an account; without them we cannot provide it. A profile image, biography, year of study, your modules and your free times are optional.

2.6 Special personal information. We do not ask for special personal information (such as health, religious beliefs, race or ethnic origin, sex life, trade-union membership, criminal behaviour or biometric information). Please do not post it unless you want it to be seen by other Users.

3. Purpose of Processing

3.1 No other uses. We will not use your personal information for a purpose that is not compatible with the purposes above without telling you and, where the law requires, getting your consent.

3.2 No marketing emails without your opt-in. We will not send you electronic marketing about the Platform or anyone else unless you have opted in (POPIA section 69).

3.3 No automated decisions. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Peer suggestions (section 3.4) are worked out automatically, but they are only suggestions. They do not decide anything about you: you and other Users choose whether to connect.

3.4 Peer suggestions. On the Peers page we suggest students you may want to add as peers. This is a form of profiling, so here is exactly how it works:

• What we use. Whether someone has added you as a peer; whether you share a course, a university, a level of study or a year of study; how many peers you have in common; how many Groups you are both in; how many modules you are both taking this term; how many course modules you are both active in; how many of your free times overlap; and whether they signed in recently. "Taking a module" counts only when both of you have confirmed your modules since the current term began. "Active in a module" means you posted, viewed, liked or saved a published feed material filed under that module. Private Group posts and private messages are never used.
• What other Users see. If you are suggested to someone, they see your name, username, profile image, course and university, and at most two short reasons, such as "Same course", "Taking 2 of your modules", "Same year", "Free at similar times", "2 mutual peers", "In one of your groups" or "3 modules in common". They never see your list of modules, your free times, which materials you viewed, liked or saved, or which Groups you are in.
• Who is never suggested. People you have blocked or who have blocked you, suspended or deactivated accounts, and anyone who has switched suggestions off.
• Nothing extra is stored. Suggestions are worked out from the information above each time you open the Peers page. We do not keep a separate profile of you for this.
• Switching it off. In Account settings → Peer suggestions you can turn suggestions off at any time. You are then not suggested to anyone, and your activity on materials is no longer used for anyone's suggestions, including your own. Your modules and free times are then used only to find suggestions for you. You can still find and add peers yourself, and you can turn suggestions back on whenever you like.

4. Legal Basis

4.1 Consent is our primary basis. Where we rely on your consent, we ask for it at the point we collect the information. Under POPIA consent must be a voluntary, specific and informed expression of will, and it must be freely given. For that reason:

• we do not bundle consent: you can use the Platform without agreeing to optional processing such as personalised advertising;
• we ask for consent to each distinct purpose separately, not through the single act of accepting the Terms; and
• you can withdraw your consent at any time (see section 6). Withdrawal does not affect processing done before you withdrew, or processing that we may lawfully carry out on another basis.

4.2 Contractual necessity. We process your registration, profile and activity information because it is necessary to provide your account and the Platform under our Terms.

4.3 Legitimate interest. We process some information for our legitimate interests in running, securing and improving the Platform, in helping students find study partners (peer suggestions, section 3.4) and in producing internal statistics. We weigh these interests against your rights and freedoms, and you may object to this processing (see section 6).

4.4 Legal obligation. We process and may disclose some information because the law requires it.

5. Data Sharing and Disclosure

5.1 We do not sell, rent or share your personal information with outside companies for their own marketing. Your personal information is used internally by us to run the Platform. Under CCPA/CPRA, we have not "sold" or "shared" (for cross-context behavioural advertising) personal information in the preceding 12 months.

5.2 Service providers. We use other companies to help us run the Platform, such as hosting, storage, email delivery, backup and security providers [LIST CATEGORIES / NAMES]. They are "operators" under POPIA and "processors" under GDPR. They may only use your information on our instructions to provide services to us, under written contracts that require them to keep it secure and confidential. They may not use it for their own marketing.

5.3 Other Users. Information in your profile (such as your name, username, university, course, biography and profile image) and content you post is visible to other Users as the Platform's settings allow [CONFIRM PROFILE VISIBILITY — e.g. visible to signed-in Users]. Group content is visible to that Group's members. Private messages are visible to the people in the conversation. Unless you switch suggestions off, other Users may see you as a peer suggestion together with the short reasons described in section 3.4.

5.4 Our moderators and administrators. Authorised staff may see reported content and, where necessary to deal with a report, investigate a serious breach of our Terms or comply with the law, may read private messages. We do not routinely read private messages. Staff accounts are protected with two-factor authentication, and staff actions (including access to messages) are recorded in an audit log.

5.5 Advertisers. Advertisers never receive your personal information. We may give advertisers aggregated, anonymised statistics (for example, how many Users saw an advertisement) that cannot be used to identify you.

5.6 Legal and safety disclosures. We may disclose personal information if we believe in good faith that it is required by law, a court order or a regulator's request, or is necessary to protect our rights, property or safety, or the rights, property or safety of Users or others, including reporting offences to the South African Police Service. If someone submits a take-down notification about your content, we may share the notification (including the complainant's contact details) with you, and your counter-notification with the complainant.

5.7 Business changes. If we merge with, or sell all or part of our business to, another organisation, personal information may be transferred to the successor. We would tell you first, and the successor would have to honour this policy.

5.8 Aggregated and anonymised data. We may use and publish statistics that do not identify any person.

6. Your Rights

You may exercise the following rights, to the extent the law of your country gives them to you.

6.1 How to exercise your rights.

• In your account: you can edit your profile, change your email and password, switch peer suggestions off (which is how you object to that processing), and delete your account in your account settings.
• By email: for anything else — including access, correction, deletion, withdrawal of consent or objection — email support@inscripchat.com from the email address on your account, with the subject "Privacy request" and a description of what you want. If you want a copy of your information, say so.
• Verification. We may need to confirm your identity before acting, so that we do not give your information to someone else.
• Timing. We will respond within a reasonable time and in any event within [30] days (or 45 days for California requests, extendable as the law permits).
• Cost. We do not charge, unless a request is manifestly unfounded or excessive, or the law allows a prescribed fee.
• Authorised agents. If someone is asking on your behalf, we may ask for proof of their authority.

6.2 Complaints. You may complain to us first, but you are not required to. You also have the right to complain to a regulator:

• South Africa — Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; complaints.IR@justice.gov.za; https://inforegulator.org.za [VERIFY CURRENT DETAILS BEFORE PUBLICATION].
• European Economic Area: the supervisory authority in the country where you live, work or where you think your rights were infringed (a list is at https://edpb.europa.eu). United Kingdom: the Information Commissioner's Office (https://ico.org.uk).
• California: the California Attorney General (https://oag.ca.gov/privacy) and the California Privacy Protection Agency (https://cppa.ca.gov).

7. Data Retention

We keep personal information only for as long as necessary for the purpose it was collected, or as the law requires. In general, that means until you delete your account, plus a legal-compliance period as set out below.

7.1 Legal-compliance period. After you delete your account, we may keep limited information for [PERIOD] where the law requires it or where it is necessary to establish, exercise or defend legal claims. We will not use it for any other purpose.

7.2 Deletion by us. When retention periods end, we delete or de-identify the information, so that it can no longer be linked to you.

8. Security Measures

We use appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access and unlawful processing (POPIA sections 19 to 21), including:

• Encryption: data in transit between your browser and the Platform is encrypted with TLS (HTTPS). [CONFIRM: databases and backups are encrypted at rest.]
• Passwords: stored only as salted, one-way hashes; we cannot see or retrieve your password. Password rules block weak and common passwords.
• Access controls: access to personal information is limited to people who need it, using least-privilege roles; two-factor authentication is mandatory for all administrators; staff actions, including access to private messages, are recorded in an audit log.
• Application safeguards: session protection, protection against cross-site request forgery, rate-limiting of sign-in attempts, and security headers.
• Regular audits and testing: we review and test our security on a regular basis [AT LEAST ANNUALLY — ADD INDEPENDENT PENETRATION TEST IF PLANNED], and check our software for known vulnerabilities.
• Incident response: we have a procedure to respond to security incidents. If there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected Users as soon as reasonably possible (POPIA section 22), and, where GDPR applies, the supervisory authority within 72 hours where required (GDPR Articles 33 and 34).
• People and providers: our staff are bound by confidentiality, and our service providers must meet equivalent security standards.

No system is completely secure. Please help by choosing a strong, unique password, not sharing it, and signing out on shared devices.

9. Cookies and Tracking

9.1 What they are. Cookies are small text files placed on your device. Similar technologies include pixels (tiny images), local storage and software development kits.

9.2 What we use.

9.3 GDPR / ePrivacy. For visitors in the EEA and UK, we will place non-essential cookies and similar technologies (analytics, advertising) only after you have given prior, informed consent through our cookie banner. Rejecting is as easy as accepting. You can change your choice at any time through the "Cookie settings" link in the Platform's footer [TO BE PROVIDED].

9.4 California — "Do Not Sell or Share". We do not sell or share personal information with third parties, as those terms are defined in the CCPA/CPRA. Because there is no sale or sharing with external companies, no "Do Not Sell or Share My Personal Information" opt-out is needed for external sharing. We do, however, give you an opt-out for internal advertising personalisation: you can turn it off in your account settings [TO BE PROVIDED] or by emailing support@inscripchat.com. We will also treat a browser's Global Privacy Control signal as a request to opt out of personalisation.

9.5 Third-party fonts. [DELETE IF FONTS ARE SELF-HOSTED] Our pages load typefaces from Google Fonts. When your browser requests them, Google receives your IP address and browser details. See section 10.

9.6 Your browser. You can block or delete cookies in your browser settings, but the Platform will not work properly without the strictly necessary session cookie.

10. Cross-Border Data Transfers

10.1 Your information is stored and processed in [HOSTING COUNTRY / REGION]. Some of our service providers (for example, email delivery [PROVIDER], [HOSTING / BACKUP PROVIDER], [GOOGLE FONTS — IF USED]) may process information in other countries, including [LIST, e.g. the United States and the European Union].

10.2 South Africa (POPIA section 72). We transfer personal information outside South Africa only if: the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA's conditions; or you consent; or the transfer is necessary to perform a contract with you or at your request; or another ground in section 72 applies.

10.3 EEA and UK (GDPR Chapter V). If we transfer personal information of EEA or UK residents to a country outside the EEA or UK, we do so using a lawful mechanism, such as an adequacy decision (Article 45), the European Commission's Standard Contractual Clauses or the UK equivalent with supplementary measures where needed (Article 46), or, in limited cases, a derogation under Article 49. You may ask us for a copy of the safeguards by emailing support@inscripchat.com.

11. Children's Privacy

11.1 Inscripchat is intended for adults. Under POPIA a "child" is a person under 18. We do not knowingly collect personal information from children under 18 without the verifiable consent of a parent or legal guardian, consistent with POPIA sections 34 and 35, and we do not allow anyone to use the Platform who is below the minimum age at which they can lawfully consent to online services in their country (which is never below 13, and is 14, 15 or 16 in some countries).

11.2 If you are a parent or guardian and think your child has given us personal information without your consent, contact support@inscripchat.com. If we learn that we have collected a child's information in breach of this policy, we will delete it and close the account.

12. Contact Information

support@inscripchat.com

13. Changes to This Privacy Policy

13.1 We may update this policy from time to time, for example when our practices or the law change. The "Last Updated" date and version number at the top show the current version, and we keep earlier versions available on request.

13.2 For material changes we will notify you by email to your registered address and/or a prominent notice on the Platform at least [30] days before they take effect. If a change requires your consent under the law, we will ask for it again before relying on it.

14. Region-Specific Information

14.1 South Africa

Your rights under POPIA (section 6 above) and the Consumer Protection Act apply and cannot be waived by this policy. If you wish to request access to records of a private body under the Promotion of Access to Information Act 2 of 2000, contact our Information Officer.

14.2 EEA and UK

The legal bases for processing are set out in sections 3 and 4. Our legitimate interests are explained in section 4.3. Our retention periods are in section 7. Transfers are in section 10.

14.3 California (CCPA/CPRA) — information collected in the last 12 months

The CCPA/CPRA applies only to businesses that meet its thresholds; we include this section to the extent it applies to us.

We use sensitive personal information only to authenticate you and keep your account secure, and do not use it to infer characteristics about you. Our retention periods are in section 7.

15. General

15.1 Severability. If any part of this policy is found to be invalid or unenforceable, that part is limited or removed to the minimum extent needed and the rest stays in force.

15.2 Your mandatory rights. Nothing in this policy limits any right that you have under POPIA, the Consumer Protection Act, the GDPR, the CCPA/CPRA or any other law that cannot be waived or limited by agreement.

15.3 Language. This policy is written in English. If it is translated, the English version prevails.