How StudyMax collects, uses, and protects your personal and academic information
Last Updated: May 2026 | Version 1.0 | Governed by POPIA Act 4 of 2013 | StudyMax
Name: Thabang Maokeng
Role: Director & Information Officer
Email: support@studymax.co.za
Organisation: StudyMax
StudyMax is an academic productivity platform ("we", "us", "our"). StudyMax is the responsible party in terms of POPIA — meaning we determine the purpose and means of processing your personal information.
StudyMax is built specifically for South African university students to help them track assessments, manage study sessions, monitor grades, and improve academic performance.
We collect only the personal information necessary to provide the StudyMax service (the POPIA principle of purpose limitation and minimality). The table below sets out all categories of data we process:
| Category | Specific Data Points | Purpose |
|---|---|---|
| Account Information | First name, last name, email address, bcrypt-hashed password | Account creation, authentication, communication |
| Academic Profile | Institution/university, programme/degree, year of study, phone number | Personalising study tools, module matching, notifications |
| Study & Assessment Data | Modules enrolled, assessment titles, due dates, weights, grades, marks obtained, study session durations, focus ratings, study streaks | Core platform functionality — tracking academic progress |
| Subscription & Billing | Subscription plan, subscription status, expiry date, PayFast transaction references and payment dates | Managing your premium subscription, billing records |
| Technical & Security Data | IP address, last login timestamp, login attempts, session tokens, password change timestamps | Security monitoring, fraud prevention, account protection |
| Activity Logs | Actions performed (login, password reset, assessment updates) with timestamps | Audit trail, account security, support investigations |
| Notification Preferences | Email/push notification settings, reminder preferences | Delivering the notification experience you configured |
| Parent Account Information StudyMax Junior | Parent's first name, surname, email address, bcrypt-hashed password, Family Plan billing references | Parent Dashboard access, parental consent management, billing, account-level communication for linked learners |
| Learner (Child) Information StudyMax Junior | Name, grade, school (optional), subjects, homework, assessments, marks, study sessions, username, bcrypt-hashed password — no email or phone number required | Core Junior functionality; collected only after parental consent (see Section 13) |
| Processing Activity | Lawful Basis (POPIA s.11) |
|---|---|
| Creating and managing your student account | Performance of a contract with you (s.11(1)(b)) |
| Providing study tracking, assessment management, grade monitoring | Performance of a contract (s.11(1)(b)) |
| Processing Premium subscription payments via PayFast | Performance of a contract (s.11(1)(b)) |
| Sending assessment deadline reminders and notifications | Performance of a contract & your consent (s.11(1)(a)(b)) |
| Sending marketing emails about StudyMax features | Your consent (s.11(1)(a)) — with opt-out right |
| Security monitoring, login logging, fraud prevention | Legitimate interest (s.11(1)(f)) |
| Maintaining financial/transaction records | Legal obligation — tax and accounting law (s.11(1)(c)) |
| Improving the platform using anonymised analytics | Legitimate interest (s.11(1)(f)) |
| Generating AI study insights, quizzes and personalised content via our AI service provider | Performance of a contract & your consent (s.11(1)(a)(b)) |
| Processing a learner's (child's) personal information on StudyMax Junior | Prior consent of a competent person — parent or legal guardian (s.35(1)(a)) |
Running the core StudyMax features: storing your modules, assessments, study sessions, grades and streaks; calculating analytics; generating smart notifications; and managing your subscription plan.
Sending transactional emails via our SMTP server (support@studymax.co.za) including: account welcome emails, password reset links, assessment deadline reminders (7 days, 3 days, 1 day before due), trial expiry warnings, subscription confirmations, and weekly study progress digests.
Logging IP addresses and login timestamps to detect suspicious activity, enforce rate-limiting on failed login attempts (5 attempts triggers a 5-minute lockout), and enabling you to identify unauthorised access.
Using anonymised, aggregated data to understand usage patterns, identify most-used features, improve performance, and develop new functionality. This data does not identify you individually.
Maintaining financial records as required by South African tax law; complying with valid court orders, subpoenas or regulatory requests from the Information Regulator of South Africa.
StudyMax uses an external AI service provider (DeepSeek) to generate study insights, quizzes, notes summaries, smart financial insights and personalised email content. We consolidate this into a single daily AI request per user wherever possible. See Section 6 (Data Sharing) for exactly what is shared and Section 14 (Cross-Border Transfers) for where it is processed.
| Third Party | Purpose | Data Shared |
|---|---|---|
| PayFast (Pty) Ltd PCI-DSS Level 1 | Premium subscription payment processing | Name, email address, subscription amount, order reference — no card data stored by us |
| Our South African hosting provider | Hosting StudyMax on servers located in South Africa | All stored data (encrypted at rest) |
| StudyMax SMTP (mail.studymax.co.za) | Sending transactional and notification emails | Your email address, your first name, notification content |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) AI service provider | Powering AI features: study insights, quiz and notes generation, smart financial insights, personalised reminder content | Study material you submit for AI processing (e.g. text from uploaded slides or documents), study and assessment patterns, budgeting figures used for insights, and your first name for personalisation — never your email address, password or payment details |
| Information Regulator of South Africa | Legal regulatory reporting obligation | Only as legally required (e.g. serious data breaches) |
| Law enforcement / courts | Compliance with valid legal process | Only when required by valid court order or warrant |
| Data Category | Retention Period | Reason |
|---|---|---|
| Account & profile data | Duration of account + 30 days after deletion request | Service provision; 30-day grace period for recovery |
| Academic data (modules, assessments, grades) | Duration of account | Core platform service |
| Study session logs | Duration of account | Analytics and progress tracking |
| Payment transaction records | 5 years from transaction date | South African tax and accounting law (SARS) |
| Security and activity logs | 90 days | Security monitoring and incident investigation |
| Password reset tokens | 1 hour (or immediate use) | Security — tokens expire automatically |
| Email logs | 30 days | Delivery troubleshooting |
| Anonymised analytics | Indefinitely | Platform improvement — no personal identifiers |
| Parental consent records (StudyMax Junior) | Duration of learner account + 3 years | Proof of lawful processing of children's data (POPIA s.34–35) |
| Learner data after consent withdrawal | Deleted within 30 days of withdrawal | POPIA children's data protections |
Request a copy of all personal information we hold about you (POPIA s.23)
Request correction of inaccurate, incomplete or misleading information (POPIA s.24)
Request deletion of your account and personal data, subject to retention obligations (POPIA s.24)
Object to the processing of your personal information on grounds of legitimate interest (POPIA s.11(3))
Withdraw consent to marketing and promotional emails at any time (POPIA s.69)
Lodge a complaint with the Information Regulator of South Africa (POPIA s.73)
| Cookie Name | Type | Purpose | Duration |
|---|---|---|---|
PHPSESSID | Essential | Maintains your login session and authentication state | Browser session (1 hour idle timeout) |
| Session CSRF token | Essential | Protects all forms against cross-site request forgery attacks | Per session |
You can disable cookies in your browser settings, but this will prevent you from logging in to StudyMax as sessions are required for authentication.
Emails about new features, updates, or StudyMax promotions are only sent with your consent. You may withdraw consent at any time by emailing support@studymax.co.za or updating your notification preferences. We will process opt-out requests within 5 business days.
We never send marketing or promotional emails to Learner Accounts on StudyMax Junior. Product communications relating to a learner's account are sent to the linked parent or guardian only.
StudyMax serves two audiences: the core platform for university, TVET and college students (primarily persons aged 18 years or older), and StudyMax Junior, designed for high school learners in Grades 8–12. Because most Junior learners are children as defined by POPIA (persons under 18), we apply the special protections of POPIA Sections 34–35 to every Learner Account.
POPIA Section 34 prohibits processing a child's personal information unless an exception in Section 35 applies. StudyMax relies on the prior consent of a competent person (a parent or legal guardian) under Section 35(1)(a). In practice this means a learner under 18 cannot register independently: a Learner Account can only be created by a parent or legal guardian from within their own Parent Account, after that parent has accepted our Terms and given explicit consent to the processing of the child's personal information.
We keep a record of every consent given — which parent consented, for which learner, the policy version consented to, and the date and time — so that we can demonstrate lawful processing to the Information Regulator on request.
We collect only what the service needs: the learner's name, grade, the subjects, homework, assessments, marks and study sessions they record, and a username with a bcrypt-hashed password. Learner Accounts do not require an email address or phone number; account-level communication (including password resets) is routed through the linked parent's email address. AI-generated study insights for learners are produced from study content and patterns only and never include the learner's surname or any contact details.
Parents can view their linked learners' academic activity (study time, homework completion, marks and upcoming assessments) through the Parent Dashboard. Learners are informed of this visibility when they activate their account.
We do not send marketing or promotional communications to Learner Accounts, and we do not use learners' personal information for advertising or profiling of any kind.
A parent may withdraw consent at any time from their Parent Account or by emailing privacy@studymax.co.za. On withdrawal, the learner's account is deactivated immediately and the learner's personal information is permanently deleted from our active systems within 30 days.
We encourage you to first contact us directly at support@studymax.co.za. We will do our best to resolve your concern within 30 days. The Information Regulator is the appropriate escalation path if we are unable to resolve it to your satisfaction.
We may update this Privacy Policy from time to time. When we make material changes, we will: update the "Last Updated" date, send a notification email to all registered users, and display an in-app notification. Continued use of StudyMax after changes are published constitutes acceptance.
| Version | Date | Summary of Changes |
|---|---|---|
| 1.0 | May 2026 | Initial privacy policy for StudyMax platform launch. Covers account data, academic data, PayFast payments, POPIA rights, SMTP email, session security, and data retention schedules. |
Thabang Maokeng — Director & Information Officer
Bloemfontein, Free State, 9301
studymax.co.za
Last Updated: May 2026 · Version 1.0 · StudyMax — Bloemfontein, Free State, South Africa · Terms & Conditions