Legal

Privacy Policy

Last updated: 6 May 2026

Study Past Papers ("we", "us", "our") runs the website studypastpapers.com and the Past Exam Papers Grade 12 SA mobile app. This policy explains what information we collect, why we collect it, and the choices you have. We comply with the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

1. Information we collect

1.1 Information you give us

  • Profile details — first name, surname, mobile number, grade (9–12), home language, and selected subjects. All fields are optional except where needed for a specific feature (e.g. mobile number is required to receive an OTP).
  • Verification data — one-time passcodes (OTP) we send to your mobile by SMS to confirm you own the number.
  • Content you create — quiz answers, chat messages with the AI tutor, feedback and bug reports.

1.2 Information collected automatically

  • Device & usage data — device model, operating system, app version, language, IP address, pages or screens viewed, and interactions (e.g. which papers you download).
  • Cookies and similar technologies on the website for essential functionality and analytics. You can clear or block these in your browser at any time.

1.3 Information we do not collect

We do not ask for ID numbers, addresses, payment card details, or sensitive personal information (religion, health, political views, etc.). If a future feature requires any of these, we will update this policy and ask for clear consent.

2. How we use your information

  • To give you access to past papers, memos and study tools.
  • To personalise your experience (e.g. show papers for your grade and subjects).
  • To send you OTPs so you can verify your mobile number and log in.
  • To keep the service working — diagnostics, crash reports, fraud and abuse prevention.
  • To measure how the service is used so we can improve it (aggregated analytics).
  • To show advertising that helps keep the service free, where applicable.

3. Legal basis (POPIA)

Under POPIA we process your personal information on the grounds of: (a) your consent, which you can withdraw at any time; (b) performance of a contract with you (providing the app and website); (c) our legitimate interests in operating and improving the service; and (d) legal obligations where they apply.

4. Who we share information with

We do not sell your personal information. We share limited information with trusted service providers that help us run the service:

  • Amazon Web Services (AWS) — hosting, storage, database and serverless compute. Our production infrastructure runs in the Africa (Cape Town) region (af-south-1) and the content-delivery layer runs globally on Amazon CloudFront.
  • AWS Simple Notification Service (SNS) — sends OTP SMS messages to your mobile.
  • Google Analytics — aggregated usage analytics. IP anonymisation is enabled where supported.
  • Google AdMob — serves ads in the mobile app. AdMob may use an advertising identifier to show relevant ads.
  • Apple App Store / Google Play — distribute the mobile app and collect crash reports.
  • OpenAI — if you use the AI tutor or quiz generator, your prompt is sent to OpenAI to produce a response. We do not send your name, mobile, or account identifiers with the prompt.

We may also disclose information if required by law, to enforce our terms, or to protect rights, safety and property.

5. Cross-border transfers

Some of our providers (e.g. Google, OpenAI) process data outside South Africa. When this happens we rely on provider safeguards (such as standard contractual clauses) to ensure your information receives equivalent protection as required by POPIA.

6. How we protect information

We use industry-standard measures: encryption in transit (HTTPS / TLS), encryption at rest for our databases and object storage, least-privilege IAM access, short-lived credentials, and server-side logging of sensitive actions. No system is perfectly secure; if we ever suffer a breach involving your personal information we will notify the Information Regulator and affected users as POPIA requires.

7. How long we keep information

  • Active profile — kept while your account is active.
  • OTP codes — valid for 10 minutes then discarded.
  • Usage logs — retained for up to 90 days for operations and security.
  • Backups — kept for up to 35 days on a rolling window.

If you delete your account, we remove your profile from the active database. Backup snapshots that may still contain your data are overwritten within the backup retention window.

8. Your rights

POPIA gives you the right to:

  • access the personal information we hold about you;
  • correct or update information that is wrong or outdated;
  • request deletion of your account and associated data (see how to delete your account);
  • object to processing for direct marketing or for purposes based on our legitimate interest;
  • withdraw consent you previously gave, at any time, without affecting processing that happened before you withdrew it;
  • lodge a complaint with the Information Regulator (South Africa).

Deleting your account

The fastest way to remove your account and associated data is the dedicated form on our account-deletion page. We confirm receipt by email within 7 days and complete the deletion within 30 days. The page lists exactly what gets removed and what is retained.

For the other rights above, email us at support@studypastpapers.com. You can also clear your local profile at any time from Profile → Clear all data in the app — note this only wipes the copy on your device and does not delete your account from our servers.

9. Children

Many of our users are school learners under 18. We only collect information reasonably necessary to provide the service. If you are under 18 you should have a parent or guardian's permission to use the app. If you believe a child has given us information without permission, contact us and we will delete it.

10. Third-party links

The service may link to third-party sites (for example app store listings, news articles, or education resources). Their privacy practices are their own; we encourage you to read their policies.

11. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where reasonable, notify you in the app.

12. Contact

Questions, requests or complaints: support@studypastpapers.com

Information Regulator (South Africa): inforegulator.org.za