Thuto Privacy Policy v3.0

Version 3.0 | Effective Date: 6 October 2026 | Replaces version 2.0 (effective 8 April 2026).

Thuto Education Online (Pty) Ltd | Reg: 2017/650754/07

Information Officer: Katleho Sebiloane | compliance@thuto.io

7 Carnoustie, Jackal Creek Golf Estate, Northriding, Johannesburg, Gauteng, 2169

Important Notice

This Privacy Policy explains what personal information Thuto collects, why, who can see it, and your rights. It is issued under the Protection of Personal Information Act 4 of 2013 (POPIA) and should be read with our Terms and Conditions of Use. Most of our learners are under 18. We process their information only with the consent of a parent or legal guardian, and we apply a heightened standard of care to it.

For students: This explains what Thuto knows about you, why, and who can see it. A plain-language summary is in Appendix A.

1. Who We Are

Thuto Education Online (Pty) Ltd ("Thuto", "we", "us") is the responsible party for personal information processed through the Thuto platform, including the website at https://thuto.io/, the learner and parent app at app.thuto.io, the Thuto for Teachers portal at teacher.thuto.io, and any Thuto mobile app (the "Platform").

Where a school, tutoring centre or funder provides us with information about its learners or staff under a separate agreement, we may act as that organisation's operator for that information. The agreement will say so.

2. Personal Information We Collect

What we collect depends on your role.

Learner identity numbers are collected through the parent's KYC process, as required by our Risk Management and Compliance Programme (RMCP) under FICA.

We do not collect learners' official school reports, benchmark results or school records. We do not collect special personal information (such as health, religion or biometric information) and ask users not to share it in Ask Thutor or other free-text fields.

3. How We Collect It

• Directly from you when you sign up, link accounts, complete KYC, enter marks, set controls, or use any feature.

• Automatically as learners use Thutor and as all users use the Platform.

• From other users : teachers capture or verify marks; parents accept marks, recognise tasks and send rewards; learners request goals or plans.

• From schools and tutoring centres , which provide their ATPs, assessment plans and setup information.

• From service providers : Paystack confirms payments; our sponsor bank and cash-out providers confirm transactions; verification providers return KYC results.

4. How and Why We Use It

We process personal information only for a specific purpose and on a lawful basis under section 11 of POPIA.

We will not use personal information for a new purpose that is incompatible with the purpose it was collected for without telling you and, where required, asking for consent.

5. Automated Profiling, Learner Metrics and FQ Score

The Platform builds a profile of each learner's learning activity and coin behaviour. This includes:

• six learning metrics: active, engagement, effort, consistency, progress and task completion;

• flags such as "needs support" and "doing well", and placement on an effort-versus-accuracy chart; and

• the FQ Score, a score out of 500 reflecting how the learner earns, saves and spends Thuto Coins.

These profiles are used to decide which topics Thutor releases and in what order, to help teachers and parents support the learner, and on Thuto Core to unlock FQ-based discounts and rewards.

No decision with legal or similarly significant effects on a learner is made solely by automated means. Metrics and flags are indicators for people to act on, not judgements of ability. The FQ Score is not a credit score and is never shared with a credit bureau or lender. Parents may ask how a metric, flag or score was calculated and may contest it by contacting the Information Officer.

A learner is flagged as "needs support" when at least two of these apply: low engagement, low effort, or falling progress. A learner is shown as "doing well" when effort is strong and progress is steady or improving.

6. AI and Thutor

Thutor's main engine is Thuto's own machine-learning system. Large language models from Google (Gemini) and DeepSeek are used to generate hints and to answer in Ask Thutor.

• We send these providers only the content needed to answer, such as the question, the topic and the learner's message. We do not send names, contact details, identity numbers, financial information or anything else that identifies the learner.

• Learners are asked not to include personal information in Ask Thutor messages.

• Ask Thutor conversations are stored and analysed by Thuto to understand each learner's needs and to improve the personalisation of Thutor. Only authorised Thuto staff can access them. Parents and teachers cannot read them.

7. Who Can See What

Internal account numbers and personal details are never placed in web addresses (URLs).

Parents can give or withdraw consent for teachers to see Parent view at any time.

8. Sharing with Third Parties

We do not sell personal information. We share it only as follows:

Every operator processes information only on our instructions, under a written agreement that meets section 21 of POPIA.

9. Children's Information

POPIA treats information about children (anyone under 18) as needing special protection. We process a learner's information with the prior consent of their parent or legal guardian, given when the parent links to the learner and accepts our Terms and this Policy. The acceptance box is never pre-ticked.

• Coins, payments and financial features are only available to a learner once a consenting parent has linked.

• We collect only what we need for the learner to use Thuto, and we do not use children's information for advertising.

• A parent can withdraw consent by unlinking or closing the learner's account, or by contacting the Information Officer. This stops further processing, subject to our legal retention obligations.

• The linked parent is told when an under-18 learner's password is changed.

Before a parent or guardian links, a learner may use Thutor. During this period we collect only what is needed to run Thutor for the learner and to invite their parent or guardian to link. Coins and financial features stay unavailable until a parent or guardian links and gives consent.

10. Direct Marketing

We do not send direct marketing to learners.

We send direct marketing to parents, teachers and schools only with their consent, or, for existing customers, about similar Thuto services with a clear opt-out in every message, as section 69 of POPIA allows. Consent is never a condition of using the Platform. We do not share your information with others for their own marketing.

You can opt out at any time through the unsubscribe link in any message, in your notification settings, or by emailing info@thuto.io. Service messages (such as verification codes, payment confirmations and notices about your account) are not marketing and will still be sent.

11. Cookies and Device Storage

The Platform uses cookies and similar browser and device storage to keep you signed in, remember your settings, and understand how the Platform is used. Because app.thuto.io is an installable web app, some information is stored on your device so the app works smoothly.

We use only the cookies and device storage the Platform needs to work, plus Amplitude analytics to understand how the Platform is used so we can improve it. We do not use advertising cookies or share cookie data with advertisers.

12. Cross-Border Transfers

Our Platform is hosted on Google Cloud Platform in the United States. Some service providers, including our messaging, push notification, analytics and AI providers, also process information outside South Africa. AI requests contain no personal information.

We transfer personal information outside South Africa only where section 72 of POPIA allows, which includes where the recipient is bound by law, binding corporate rules or a written agreement that gives protection substantially similar to POPIA, or where the transfer is necessary to perform our contract with you. Contact the Information Officer for details of the safeguards in place.

13. FICA and Financial Information

Parents must complete KYC once before coin features are unlocked. We use KYC information to verify identity, screen for politically exposed persons and sanctions, monitor transactions, and report to the Financial Intelligence Centre where the law requires. We may not be allowed to tell you about a report. KYC and transaction records are kept for at least 5 years after the transaction or the end of the business relationship.

14. Security and Breaches

We protect personal information with technical and organisational measures, including encryption in transit and at rest, encrypted password storage, role-based access controls, logging and monitoring, secure hosting on Google Cloud Platform, and card handling by Paystack under PCI DSS. Our controls are aligned to ISO 27001:2022.

If a breach is likely to affect you, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires, and tell you what you can do to protect yourself.

Keep your password private, and tell us at once at info@thuto.io if you think your account has been accessed without permission.

15. Retention

When information is no longer needed, we delete it or de-identify it so it can no longer identify anyone. De-identified data may be kept for research and to improve Thutor.

16. Your Rights

Under POPIA you may:

• ask whether we hold your information and request a copy;

• ask us to correct or delete information that is inaccurate, out of date, or that we are no longer allowed to keep;

• object to processing based on legitimate interest, and to direct marketing at any time;

• withdraw consent, without affecting processing that happened before;

• ask how an automated metric, flag or score about a learner was calculated, and contest it; and

• complain to the Information Regulator.

Parents exercise these rights for their children; we may ask for proof of guardianship. Email the Information Officer at compliance@thuto.io. We will respond within 30 days.

Information Regulator: https://inforegulator.org.za/ | complaints.IR@inforegulator.org.za

17. Changes to This Policy

We will notify you in the app or by email at least 30 days before a material change takes effect. Where a change requires new consent, we will ask for it. Previous versions are available on request.

18. Contact Us

• Information Officer: Katleho Sebiloane

• Email: compliance@thuto.io

• Address: 7 Carnoustie, Jackal Creek Golf Estate, Northriding, Johannesburg, Gauteng, 2169

• Website: https://thuto.io/

Appendix A: Plain-Language Summary for Students

This summary helps you understand the main points. The full Policy above is what counts.

What Thuto knows about you

• The details you gave when you signed up, like your name, school, grade and subjects.

• How you use Thutor: what you revise, your answers, and your Ask Thutor chats.

• Your marks, tasks and class.

• Your coins: what you earn, save, spend and cash out.

Why we need it

• To give you the right revision at the right time.

• To pay you coins for your effort.

• To show your teachers and parent how you are doing, so they can help and reward you.

Who can see what

• Your parent can see your coins, goals, marks and progress, but not your Thutor or Ask Thutor chats.

• Your teachers can see how you are doing with your learning, but not your coins, who pays for Thuto, or your contact details.

• AI helps Thutor give you hints. We do not send it your name or contact details.

• We never sell your information, and we never send you adverts.

Your choices

• Your parent or guardian can ask us to show, fix or delete your information. Ask them to email compliance@thuto.io.

• Keep your password private. If you think someone else got into your account, tell your parent and email us.