Privacy & learner data

What we collect

For a learner: a name, a grade, a school, a sign-in email, and the practice work they do on Khulab (which questions they answered, when, and whether they were correct). That practice record is the product — it is what builds the mastery picture their teacher and parent see.

For written answers (essays) we store the text the learner typed. For speaking practice we store the written transcript of what the learner said and a few timing numbers (how long they spoke, how many pauses) — never the sound recording itself. See the speaking-practice section below.

For a parent or educator: a name, an email address, and the links that connect them to their own children or classes. Nothing else.

We do not collect location data, contact lists, photos, or anything from the device beyond what the browser needs to show the app.

Parental consent comes first

A child's account does no processing until a parent or guardian's consent has been captured and stored, with a timestamp. Consent is a recorded fact in our database, not a checkbox we forget.

How it is protected

Every school's data is walled off from every other school's at the database layer itself (row-level security). This is enforced by the database engine on every single query — it is not an application promise.

A teacher can only ever see learners in their own classes. A parent can only ever see their own children.

In our internal logs, learners are identified by random IDs — never by name.

There are no third-party analytics trackers on learner activity. None.

Where it lives

Learner data is stored in a managed PostgreSQL database (Supabase) with encryption in transit and at rest. Access to production data is restricted to the Khulab team, on a need-to-operate basis.

Deletion is real

If a parent or school asks us to delete a learner's data, we delete it. Deletion is an implemented capability of the platform, not a support ticket that goes nowhere. Write to hello@khulab.co.za and we will confirm when it is done.

The AI tutor and AI marking

The AI tutor sees the question the learner is working on and the learner's own messages in that chat — that is what it needs to help. The same applies to AI marking of essays and speeches: the marker sees the question, the marking rubric, and the learner's answer. This processing runs on Anthropic's Claude AI service; we send it the work, never the learner's identity — inside Khulab's systems learners are identified to the AI only by the content of the work itself.

Tutor conversations and marked answers are used to provide the tutoring and marking themselves; they are not sold, and they are not used to advertise anything to anyone.

Speaking practice (your child's voice)

Some language questions ask the learner to record a short speech. Khulab never receives, stores, or uploads that sound recording — it exists on the learner's device only, so they can replay their own take.

To turn the speech into text, Khulab uses the speech-to-text service built into the learner's browser (for example Chrome). Depending on the browser, that conversion may happen on the browser provider's servers — which means the audio is processed by that provider (such as Google for Chrome) under their terms, not by Khulab. We say this plainly in the app, on the recording screen, before the learner presses Start.

What Khulab receives and stores is only the written transcript and the timing numbers (duration and pauses) used for marking delivery. If you would rather your child not use speaking practice at all, they can simply skip those questions — nothing else on Khulab depends on the microphone.

An honest note on where we are

Khulab is in its pilot phase. This page is a plain-language, accurate description of how the platform handles data today. A formal, attorney-reviewed POPIA policy is in progress and will replace this page's legal standing when complete — the protections described above are already built and active either way.