Privacy Notice

The Zazi iZandi mobile app is operated by Masinyusane Development Organisation, a registered South African non-profit organisation (074-244-NPO), for the Zazi iZandi literacy programme.

For personal information processing that Masinyusane determines through the app, Masinyusane is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) and the primary privacy contact.

Zazi iZandi is delivered with programme partners and participating schools. A school or programme partner may be an independent or joint responsible party when it determines why and how information is processed for its own or a shared activity. We will direct a request to the appropriate organisation where necessary.

Zazi iZandi is a professional field tool for authorised adult Education Assistants and programme staff. Children do not create app accounts or use the app independently.

The app processes information about:

• authorised adult users, including Education Assistants and programme staff;
• learners participating in the literacy programme; and
• programme activities such as assessments, teaching sessions, grouping, attendance, communication, and work-site time.

Adult account and device information

We may process:

• name, email address, staff profile, account identifiers, assigned school, class, role, and programme association;
• authentication information managed by our authentication provider;
• app version, device platform, notification permission status, and push token; and
• account support and password-reset activity.

We do not store a readable copy of a user's password.

Learner and teaching information

Authorised users may record or access:

• learner name, age or birth information, gender, grade, class, school, and programme level where used by the programme;
• teacher, Education Assistant, class, school, and teaching-group assignments;
• literacy assessment attempts, responses, scores, accuracy, language, completion time, and progress history;
• letters taught or mastered, grouping recommendations and changes; and
• session dates, duration, attendance, activities, and relevant notes.

Work-site time and foreground location

When an Education Assistant chooses to clock in or clock out, the app requests foreground location permission and attempts to record the time and coordinates for that action. The app does not intentionally track continuous or background location. If a location fix is unavailable, the time record may contain no coordinates.

Programme messages and offline records

If notification permission is granted, the app may process a push token, programme messages assigned to the user, and whether a message has been seen, read, or dismissed. Notification permission is optional.

Programme data is also stored in an on-device SQLite database so authorised users can keep working without reliable connectivity. Pending records are sent to the programme backend when connectivity returns.

Technical support and website usage

The app keeps short-lived technical logs on the device for support. A user may deliberately export logs or a local database through the phone's share sheet. A database export can contain sensitive adult and learner information and must be shared only through an approved secure support channel.

This website uses Vercel Analytics to collect limited technical and usage information about public pages so we can understand site performance and improve the visitor experience.

We process information for defined programme purposes, including:

• providing and securing authorised access to the app;
• delivering literacy support, recording programme activity, and monitoring learner progress;
• supporting teaching decisions, organising groups, and maintaining accurate programme records;
• keeping offline and server records consistent, recording work-site time, and sending programme communications;
• maintaining, updating, troubleshooting, and securing the app; and
• meeting safeguarding, audit, reporting, contractual, and legal obligations.

The applicable POPIA justification depends on the information and programme relationship. It may include performing an agreement, complying with a legal obligation, protecting a learner's legitimate interests, pursuing a legitimate programme interest, or valid authorisation or consent where required.

We do not sell personal information. We do not use app information for third-party advertising, behavioural advertising, or cross-app tracking.

Assessment evidence may help suggest or organise teaching groups. These features support professional judgement and are not intended to make final legal, disciplinary, employment, admission, or other similarly significant decisions without human review.

Information may be stored or processed:

• on the authorised user's device;
• in the Zazi iZandi backend and systems used by authorised programme administrators;
• by Supabase for database, synchronisation, and related backend services;
• by Expo for app updates and push-notification delivery; and
• by Apple, Google, and other approved providers where needed to distribute, operate, secure, or support the app.

Service providers act only for authorised service purposes and are subject to applicable contractual, confidentiality, and security requirements. Some providers may process information outside South Africa. Where that happens, we use the legal and contractual safeguards required for cross-border processing.

We may disclose information where required by law, to protect the safety or rights of learners and users, or to authorised schools, programme partners, and funders where the disclosure is necessary and permitted for programme delivery or reporting. We aim to use aggregated or de-identified reporting where individual information is not needed.

We keep personal information only for as long as it is needed for the purpose for which it was collected or as required by programme, safeguarding, audit, employment, education, funder, contractual, or legal obligations. When retention is no longer justified, information is deleted, destroyed, or de-identified through the applicable process. Backup copies may take additional time to expire.

We use reasonable technical and organisational safeguards designed to protect confidentiality, integrity, and availability. These include authenticated access, permission controls, encrypted network connections, local data isolation, controlled administrative access, and offline synchronisation safeguards.

No system can guarantee absolute security. Users must protect their devices and credentials, avoid sharing accounts, and report suspected loss, unauthorised access, or security incidents promptly.

Subject to POPIA and any lawful limitations, a data subject or authorised representative may ask us to:

• confirm whether we hold personal information;
• provide access to personal information;
• correct or update inaccurate information;
• delete or destroy information that we are no longer authorised to retain;
• object to certain processing; and
• explain relevant processing or a material automated recommendation.

Education Assistants may deny or later disable notification permission. Foreground location permission can be managed in device settings, although work-site clock-in may not function without it.

Accounts are provisioned by programme administrators. The app does not offer self-service account creation. Users may request account closure and a review of associated information, but some programme records may need to be retained for lawful safeguarding, audit, employment, or reporting purposes.

The app is operated by authorised adults for literacy programme delivery. Children do not create app accounts. Learner information is recorded only for authorised programme purposes such as assessment, instruction, attendance, grouping, and progress monitoring.

Staff must record only relevant and authorised information, use synthetic data for demonstrations, and avoid placing unnecessary health, family, disciplinary, or other sensitive details in free-text notes. The programme relies on the applicable school, programme, parent or guardian, contractual, and statutory arrangements for processing children's information.

To request access, correction, deletion, objection, or another privacy review, email zama@masinyusane.org. Do not include a password or unnecessary learner information in the first message. We may need to verify identity and authority before acting.

You may also lodge a POPIA complaint with South Africa's Information Regulator.

We may update this notice when the app, programme, service providers, or legal requirements change. The current version and last-updated date will remain available at this URL.