Privacy policy

01

Who we are

Study Surge and Simple Study are operated by Welcome Mashilo Galane, trading as Study Surge in South Africa. In this policy, “we”, “us” and “our” refer to Welcome Mashilo Galane, the individual responsible for deciding how personal information is processed for the services described below.

Privacy contact

Welcome Mashilo Galane

Email

hello@studysurge.co.za

Website

studysurge.co.za

Use this contact for questions, access requests, corrections, deletion, consent withdrawal or complaints. You do not need an active account to contact us.

02

Products covered

This policy covers the following Study Surge products: Grade 12 All Subjects, Grade 12 Life Sciences A+, Grade 12 Parent, Grade 12 Teacher, Simple Study at studysurge.co.za, and the Study Surge marketing, enquiry and support pages that link here.

Grade 12 Life Sciences A+ is the Life Sciences-only app published on Google Play by Galane under the Study Surge service. The policy applies to the features that app actually offers, including Life Sciences learning material, quizzes, Smart Tutor requests, advertising and related technical records. Not every feature described below exists in every app, version, region or subscription.

The products can use different account and data systems. Using the same email address does not automatically merge every account, credit balance, purchase or study record. Grade 12 Parent and Grade 12 Teacher use approved links to display selected Grade 12 All Subjects information; this relationship does not grant unrestricted access to a learner's account or private conversations. Tell us which product your privacy request concerns, or ask for a request across all relevant Study Surge products.

UniHub: the Study Surge website introduces and links to UniHub, but this policy does not describe UniHub’s separate accommodation, marketplace or application workflows. Check the notice presented by UniHub before submitting information there, or contact us for clarification. The same applies to university portals, bursary providers, independent tutors, social networks and other external services.

This notice explains our handling of personal information. It applies alongside the relevant product offers and terms, including any subscription, payment, creator and acceptable-use terms. It does not transfer ownership of your documents or replace those terms. Nothing in this notice limits rights or responsibilities that cannot lawfully be excluded.

03

Information and its sources

We receive information you enter, files you select, activity created when you use a feature, and technical records generated by the app or website. We may also receive information from sign-in and payment providers, advertising services, other users who mention or message you, and people making support or safety reports.

Information needed to sign in, generate a pack, deliver a requested feature or complete a payment is required for that action. Without it, we may not be able to provide that action. Optional profile details, public posts, attachments and participation in community features are your choice. You can read public website pages without an account.

04

Grade 12 learning and companion apps

Grade 12 All Subjects

The app processes chosen subjects and chapters, quiz answers, attempts, scores, study time, streaks, goals, timetable entries and progress. Exam-readiness features use practice activity to produce topic summaries, estimated readiness and study suggestions. Signed-in readiness records can be saved in Firestore and sent to the AWS exam-readiness service where that service is enabled.

Matric+ and Course Finder: signed-in learners' subject marks are saved in Firestore for use across devices, with local copies for offline use. Career-assessment answers, funding details, saved opportunities and application-planner entries are currently kept on the device. Funding answers may include financial circumstances or disability information; provide only what is needed for the match you want.

Mock-exam answers, paused attempts and attempt history are currently saved locally. Where AI marking is offered, the typed answer and relevant question and marking context are submitted for assessment. Scores used by the readiness feature may also form part of cloud-saved practice records.

Personal notes, downloads and audio

Private highlights, drawings, edits, added notes and edit-history timestamps are stored locally until you publish or share a version. Publishing uploads the selected customisation and its title, description, subject, chapter and author details. The publish-and-share workflow also creates a social post linking to your notes. Review your edits and remove private information before publishing. Pro or rewarded-ad access controls access to the shared version; it does not prevent an authorised reader from copying or sharing what they see.

Downloaded papers and audio lessons, playback positions and visual-audio caches are stored on the device. Playing a pre-generated lesson retrieves an existing recording; it does not record your voice or generate a personal voice model. Online download requests still reach the storage provider.

Community, schools, tutors and study partners

Optional social features process profiles, photos, school and subject details, posts, stories, comments, replies, reactions, poll or quiz responses, follows, bookmarks, mentions, messages, attachments and moderation reports. Tutor and study-partner features may include subjects, prices, availability, approximate area and contact information that you choose to provide. Contact details submitted for a public listing can become public.

Referral and shared-note features use account or installation identifiers, invitation links, access events and reward records to recognise participation, calculate rewards and limit duplicate claims. Guest access can use an installation identifier even where no signed-in account is required.

Grade 12 Life Sciences A+

Grade 12 Life Sciences A+ provides Life Sciences notes and topics, quiz games, Smart Tutor support and advertising. Depending on the app version and feature used, it may process device-local learning progress, quiz activity, questions submitted to Smart Tutor, advertising identifiers, diagnostics and the technical records needed to deliver the feature. A Smart Tutor request can include the learner's question and relevant Life Sciences context and is subject to the AI provisions below. This app does not gain access to Grade 12 All Subjects account records merely because both apps operate under Study Surge.

Grade 12 Parent and Grade 12 Teacher

These companion apps process the adult user's account and profile details, role, school information where relevant, notification preferences, linking code, relationship requests, invitations and accepted or removed learner relationships. Search results are deliberately limited. A person must only request or accept a relationship when they are authorised to act as the learner's parent, guardian or teacher.

After a relationship is accepted, Grade 12 Parent can display selected learner information such as profile details, study time, subject or chapter activity, goals, quiz attempts and results, readiness summaries, recent learning activity, teacher updates and concerns. It can also receive app-open and app-close alerts where that feature and the parent's preference are enabled. Grade 12 Teacher can display class membership, selected learning and quiz information, assignments and results needed to support the class; teachers do not receive learner app-open or app-close alerts.

Teachers can create classes, invite or approve learners, assign quizzes, review attempts, set goals, raise concerns with a reason and severity, and send announcements or other communications to linked learners and parents. Parents can set goals, review relevant teacher communications and manage supported alert preferences. The learner and authorised companion users can remove relationships. Linking, unlinking, invitations, concerns, announcements and other important communications may produce push notifications and email messages.

An email invitation includes the recipient address, inviter identity and role, intended app, invitation token or status and delivery records. Where the feature supports it, registering through a valid invitation can establish the intended relationship automatically. The recipient can remove that relationship afterwards. Invitation delivery or receipt does not prove a claimed family or school relationship, and we may restrict or remove a connection where authority is disputed, safety is at risk or misuse is suspected.

05

Simple Study and your PDFs

1. You choose a PDF and page range. The current workspace reads and previews the selected file in your browser. It does not upload the original PDF to our Firebase Storage as part of the study-pack workflow.
2. You ask for a study pack. Text extracted from the selected pages, page count, module name, study format and optional learning goal are sent to our server and then to OpenAI to generate your pack. Personal information contained in that text is included in the request.
3. The result is saved to your account. Firestore stores the generated notes, recall cards, quiz, takeaways and revision plan, together with your account ID, original filename, selected page range, module, format, goal, title and creation time. Your library references and remaining credits are also updated.
4. You study or export it. Saved packs can be reopened from your account. An exported PDF is stored wherever you choose to save it. Sharing that file gives its recipients a copy outside our control.

The pack-generation request does not deliberately include your email address as a prompt field, but names, student numbers or other identifiers inside your source text, module name or goal will be included if you supply them. Remove unnecessary personal information first.

Material you submit: only provide documents and information you are entitled to use and send for the processing described here. Remove unnecessary names, student numbers and third-party details. Do not submit confidential university, employer, patient or research-participant records without the necessary authority and lawful basis. These requirements apply to free and paid use.

Simple Study processes the selected material to produce and save the study pack you request. Uploading it does not give us ownership of the source or permission to publish it as public content. Saved packs are not automatically posted to the Grade 12 social feed.

Simple Study has separate credits and a Yoco checkout. To delete an account or saved pack, use the email privacy request route.

06

AI processing and recommendations

AI features require sending relevant material to a provider. The material depends on what you use:

• Study chat and paper help: your question, selected chapter notes or paper, attachments you submit, and conversation context. Some chat histories and attachments are saved for later use.
• Community AI tutors: a help request or mention, the relevant post and comment thread, subject or chapter context, and information included in that conversation. These tutors are automated accounts, not human teachers. Their responses in a public thread are public.
• Flashcards, explanations and marking: relevant learning material, question and marking guidance, your answer or a topic-performance summary.
• Simple Study: the selected-page text and study-pack inputs described above.

The current services use OpenAI and, for some Grade 12 tools, Google Gemini. Providers receive the submitted content and technical information needed to process a request. Availability and processing can vary by tool. A material provider or purpose change requires an updated notice and any legally required choice before the new use.

OpenAI's API terms provide that submitted data is not used for model training by default unless the API customer opts in. Requests and responses may be retained for abuse monitoring or the operation of the selected API feature. See OpenAI's API data controls for the applicable retention settings and exceptions.

Google's Gemini data-use rules depend on the provider service plan. Its unpaid-service terms permit product improvement and human review of submitted content and responses; its paid-service terms do not use that content for product improvement but allow limited safety-related retention. These refer to our provider arrangement, not whether you have Pro or buy credits. See Gemini's terms. Do not submit sensitive personal information to these tools. Contact us for confirmation about a feature's processing arrangement before submitting private material.

How to use AI results

Generated lessons, explanations, marking feedback and recommendations are educational support. They can contain errors or omissions and do not guarantee an exam result, admission or funding. Readiness and matching features use the answers, marks and available criteria supplied to them; their estimates are not official assessment or admissions decisions.

Check important answers against your course material and confirm entry requirements and closing dates with the relevant university or funder. You can correct your input and contact us about inaccurate personal information or a disputed result. AI responses are not a substitute for professional medical, legal or financial advice.

Avoid sending passwords, identity numbers, bank details, private contact information or sensitive third-party data in a prompt. To stop new submissions, stop using the AI tool; you can separately request removal of saved conversations. Permission to use one AI feature is not permission to publish your content or enrol you in marketing.

07

Public content and private conversations

Display names, handles, profile images, public profile fields, published posts, comments, shared-note descriptions and public achievements may be visible to other learners or anyone able to open the relevant shared content. Leaderboards may display your name or handle, image, score or study-time information. Visibility depends on the feature, not simply on whether you have Pro.

Messages and school chats are intended for their participants and authorised service operation or safety review. They are not end-to-end encrypted. Recipients can copy, forward or screenshot messages. Moderation reports may include the reported content and relevant surrounding context for investigation.

When you post, tag a tutor, upload an attachment or publish notes, consider everyone who could receive it. Do not publish someone else’s personal information without authority. Removing an item from our service cannot erase copies already saved by recipients or search engines; we will still consider requests to remove information we control.

Story expiry controls how long a story appears in the viewer. Related media, reports and recipient copies may remain after it stops appearing; our storage practices and deletion route are explained in retention and your choices.

08

Advertising, analytics and storage

Ads in Grade 12 All Subjects

AdMob supplies ads such as native, banner, rewarded and app-open placements. Google and any enabled mediation providers may process advertising or installation identifiers, IP-derived approximate location, device and app details, ad impressions, interactions and diagnostics to deliver and measure ads, limit repetition and detect fraud. Third-party ad technology may use cookies, local storage, SDK identifiers or similar technologies.

iOS App Tracking Transparency permission and Android advertising settings affect some tracking uses. Declining tracking does not necessarily remove ads or all ad-related processing. Non-personalised ads can still use technical data and storage. Ad-consent controls, where presented, are separate from account sign-in, AI disclosure and device notification permission.

Rewarded ads are optional actions tied to a benefit. Access or credit records are stored to apply the benefit and prevent duplicate rewards. Pro changes the ad and credit experience described in the offer; it does not stop essential account, security or purchase processing. A direct sponsor’s external page has its own privacy practices when you open it.

Learn more about how Google uses information from partner services and AdMob privacy choices.

Optional purchase diagnostics

The app currently offers a separate, default-off “Share purchase diagnostics” choice for measuring Pro offer views, purchase attempts and outcomes with Firebase Analytics. Those custom events use fields such as offer entry point, product, outcome, currency and displayed price, not your notes, marks, receipt or name. Analytics services may still associate events with app-instance and device information. Turning this option off does not switch off essential payment verification, service logs or AdMob’s separate processing.

Website and device storage

Device permissions: camera, photo or file access is used when you choose to capture or attach media, scan a question, or open a document. Microphone permission applies to features that record audio or video with sound, not ordinary playback of an audio lesson. Notification permission supports messages, mentions, school updates, study reminders and account notices. Background-audio and alarm capabilities support playback or scheduled reminders; they are not permission to record you in the background.

You can revoke permissions in your device or browser settings. Doing so can stop the related feature while leaving other features available. Push notifications can show message or learning information on a lock screen, depending on your settings; turn off previews on a shared device. We use a push token to address notifications to an installation. An app permission is not consent to unrelated marketing or advertising tracking.

The current Study Surge marketing pages and this policy page do not include advertising pixels or optional analytics scripts. Hosts still receive ordinary network requests and may keep operational logs. The signed-in Simple Study workspace uses Firebase sign-in persistence and browser storage to keep your session; its PDF preview worker is fetched from the UNPKG content-delivery service, which receives a network request, not your PDF through that download.

The mobile app keeps settings, consent choices, downloads and some learning records locally. Clearing browser or app data can sign you out or permanently remove local-only work. It does not itself delete cloud records. On a shared device, signing out may leave downloaded files and locally personalised notes available to the next person using that device.

09

Purchases, rewards and payouts

Apple and Google handle in-app checkout and send purchase receipts or tokens and status information for entitlement verification. Active and historical subscription records can include the product, store, dates, renewal or cancellation status and reason, and verification outcome. Cancellation normally affects renewal; a paid entitlement may continue until the end of its term.

Yoco handles Simple Study card checkout. Our systems create payment-intent and credit records and receive payment events containing transaction and checkout metadata. Enter card details only on the payment provider's checkout. Full card numbers and card security codes are not required for your learning profile or support requests. Never send a card number, PIN or one-time password through notes, chat or email.

Invite redemptions and creator payouts may require a recipient name, phone number for airtime, or bank name, account-holder name, account number, account type and branch code, depending on the selected payment method. We keep the request, amount, status, relevant access or reward records, dates and payment or rejection notes to process the request, reconcile it and investigate disputes. Authorised staff and the payment or banking service handling the payout may access necessary details. Bank details are not intended to appear in public posts or creator profiles.

For a payout, provide accurate details for an account you are authorised to use. We may review relevant transaction, access and reward records before resolving a claim or dispute. Payout eligibility, rates, minimum amounts and subscription prices are set out in the applicable product offer or terms. Young learners should involve a parent or lawful guardian before providing payment information.

10

Why we process information

We process information for the purposes below, on the applicable legal basis for the particular activity.

Deliver what you request

Accounts, study packs, learning history, messages, uploads, downloads, subscriptions and support need the information that makes those actions work. Applicable grounds may include taking steps at your request or performing the service agreement.

Operate and protect the service

Security logs, abuse investigations, access checks, payment reconciliation and troubleshooting support reliable operation and the prevention of misuse. Where permitted, we rely on our legitimate interests in protecting users, administering purchases and maintaining the service, balanced against your privacy rights.

Respect a specific choice

Consent applies where required, including relevant optional analytics, tracking or marketing uses. You may withdraw consent for future processing without making earlier lawful processing unlawful. Withdrawal can affect the feature that depends on it.

Meet legal duties

Some accounting records, lawful requests, privacy-request records and security-incident notifications may need to be processed to meet an obligation or establish, exercise or defend a legal claim.

Additional legal requirements apply to children's information and special personal information. See children and young learners.

Support enquiries are not permission for unrelated promotional messages. Where we send electronic direct marketing, we must have the required consent or applicable existing-customer basis and provide a way to object. You can email us to stop marketing. Necessary account, purchase or safety messages are separate from promotions.

11

Who receives information

Information is shared to perform the relevant service, carry out your sharing instruction, handle safety or legal duties, or complete a transaction. We do not sell your name or email address as a marketing list. Advertising-related device and interaction data is described in advertising and analytics.

A listing does not automatically send your learner profile to the listed university, funder, tutor or advertiser. When you open an external link or contact one of these services, its provider handles the request and any information you submit under its own privacy notice. Review that notice before applying or sharing sensitive information. Third-party content and links do not mean that Study Surge controls the recipient's independent services or privacy practices.

Relevant records may be disclosed to advisers or a successor if Study Surge is sold, reorganised or transferred, where legally permitted and with appropriate safeguards. We will communicate a material change in the party responsible for your information and any legally required choices.

12

Processing outside South Africa

Our cloud, AI, payment and advertising providers operate internationally. Depending on the feature, service region and provider's support systems, information may be processed outside South Africa, including in the United States and other countries where those providers operate.

International transfers are subject to applicable data-protection requirements, including the conditions in POPIA. An appropriate transfer basis may include protection under a law or binding agreement, or another basis permitted by law. Additional requirements can apply to children's and special personal information. Contact us for information about processing locations and safeguards relevant to a particular service.

13

How long information is kept

Retention varies by record type and purpose. We consider the account or feature being provided, outstanding transactions or disputes, security needs, and applicable record-keeping duties. The following criteria apply rather than a single deletion period for every record.

Accounts, relationships and cloud learning records

Kept to operate your account and saved features, subject to a valid deletion request and any specific lawful retention need. This includes saved Simple Study packs, signed-in readiness or marks records, accepted companion relationships, classes, assignments, goals, alerts and communications.

Public content, chats and uploaded media

Kept for the relevant sharing or conversation service and, where necessary, a report or dispute. Profile deletion and story expiry do not automatically delete all associated content. The email deletion route below covers associated records as well as the account.

Local notes, mock exams and downloads

Remain on the device until removed through the relevant controls, cleared with app or browser data, or deleted from the download location. Uninstalling may not remove files exported elsewhere or copies in your device backup.

Payments, rewards and banking details

Retained for completing and reconciling a transaction and the applicable accounting, dispute or fraud-prevention period. You can request correction or deletion, subject to a specific lawful need to retain the record.

Logs, backups and service-provider records

Subject to the relevant operational and provider retention settings. Backups may outlast deletion from an active system. Provider-held AI records can have their own retention or legal-preservation periods, as described above.

For a deletion request, we will explain any records that must be retained, why, and the expected handling period. Retention for a legal claim or record-keeping duty does not permit unrelated marketing use. Uninstalling, signing out, cancelling a subscription and deleting an account are different actions.

14

Your choices and deletion requests

You can ask whether we hold your personal information, request access, correct inaccuracies, request deletion or restriction where applicable, object to a use on applicable grounds, withdraw relevant consent, or complain about our handling. Rights and lawful exceptions depend on the law that applies to your situation. If another jurisdiction gives you additional rights, this policy does not take them away.

How to make a request

1. Email hello@studysurge.co.za with the subject “Privacy request”. Name the app or website concerned, or ask for all relevant Study Surge products.
2. Explain whether you want access, a correction, account deletion, removal of a study pack or post, or another action. Include your account email or handle and relevant item links if you have them.
3. We may need proportionate verification before disclosing or changing data. If you cannot access your old email, explain that and we will discuss another route. Do not send your password, an ID document or banking details with an initial request.

We will respond within the period required by applicable law, explain any necessary verification, and tell you if a lawful exception affects the request. Where a law permits a fee for a particular request, we will explain it before proceeding. A support request is not an automated deletion confirmation.

You can also change your profile where editing is available, decline optional fields, manage device permissions, turn off optional purchase diagnostics, remove local downloads, and avoid publishing personal material. Contact us when a control you need is missing or does not work.

This opens your email app. Nothing is submitted from this page until you send the email.

15

Children and young learners

Grade 12 All Subjects and Grade 12 Life Sciences A+ support secondary-school learners, including learners under 18. Grade 12 Parent and Grade 12 Teacher support authorised adults around those learners. Simple Study is aimed at tertiary students. The products are not intended for children under 13.

Where consent is required, it must be provided before the relevant processing by a person who is legally able to provide it, unless another lawful ground applies. Parents, guardians and teachers must not use linking or invitation tools to access a learner's information without appropriate authority. Learner approval is an important access control but does not remove an adult's responsibility to act lawfully and only for a legitimate educational or caregiving purpose.

For parents and guardians: contact hello@studysurge.co.za to discuss consent, review a child's information, request a correction or deletion, dispute a link, or raise a concern. We may verify your identity and authority to protect the child's information before responding. Where a concern involves processing without required permission, we will investigate and take appropriate action, including restriction or deletion where necessary.

16

Security and incident handling

Our services use authentication, database and storage access rules, and role-based administrative controls. No online service, device or transmission can be guaranteed completely secure. This limitation does not remove our responsibility to provide the safeguards required by applicable law.

Use a unique password, keep your device secure and avoid sharing accounts. Contact us promptly if you suspect account misuse, a leaked document or an unauthorised payment. Do not send additional sensitive data to demonstrate a problem unless we arrange a suitable channel.

We will investigate suspected personal-information security compromises, take appropriate containment steps, and notify the Information Regulator and affected people where required by law. Notification timing and any lawful delay depend on the incident and the applicable requirements. See the Regulator’s security-compromise guidance.

For immediate danger, contact emergency services rather than waiting for a support response. Our inbox is not an emergency or round-the-clock safeguarding service.

17

Complaints and policy changes

Raise a concern

Contact hello@studysurge.co.za with your concern so we can investigate and respond. You also have the right to complain directly to South Africa's Information Regulator through its official complaints page, or to another competent authority where applicable.

Changes to this notice

We may update this policy to reflect changes to our features, providers or legal requirements. The date at the top identifies the current notice. Material changes will be communicated as appropriate, with consent or another lawful basis obtained where required before a new use of personal information.

Version: 11 October 2026, revision 3. This notice explicitly covers Grade 12 All Subjects, Grade 12 Life Sciences A+, Grade 12 Parent, Grade 12 Teacher and Simple Study, including AI, learning records, companion relationships, communications, shared content, payments and privacy requests.