Privacy & data residency

Who we are

ClassPulse is the responsible party (data controller) for the personal information collected through the marketing site at classpulse.co.za. When your school uses ClassPulse to manage attendance and student records, ClassPulse acts as an operator (data processor) on the school's instructions — the school itself is the responsible party for that data.

What we collect

From your school's ClassPulse tenant we process:

• Teacher and admin names, email addresses, and sign-in events.
• Student names, student codes, dates of birth, grade, house membership, and guardian email addresses.
• Attendance marks (present / absent / late) and structured absence reasons.
• Audit log entries — who did what, when, and the before/after diff for every mutation.

We do not collect biometric data, payment information from students, or device location.

Where your data lives

Application data is currently hosted in the United States (Oregon) on Render's managed infrastructure. Daily database backups are kept in the same region. We are planning to migrate the production deployment to the European Union (Frankfurt, Germany) region to shorten round-trip latency for South African users and to put the deployment under EU data-protection law. We will update this section, notify customers, and update our sub-processor disclosures when that migration completes.

POPIA & cross-border transfer

For South African customers, the transfer of personal information from South Africa to the United States for processing is covered by section 72(1)(c) of POPIA: the transfer is necessary for the performance of the contract between the school (responsible party) and ClassPulse (operator) under which we process the school's data on its documented instructions.

Additionally, under section 72(2)(b) of POPIA, we bind ourselves contractually to provide a level of protection for transferred personal information that is substantially similar to POPIA. The Data Processing Agreement with each customer school records these commitments. Our hosting sub-processor (Render Services Inc.) is SOC 2 Type II audited and offers GDPR-compliant terms.

Where the school's privacy notice to parents requires explicit consent (for example for processing the personal information of a child under section 35 of POPIA, or for cross-border transfer under section 72(1)(b) where the school prefers a consent-based basis), that consent is collected by the school as the responsible party. ClassPulse only processes data on the school's documented instructions.

Sub-processors

We use the following sub-processors to deliver the Service. We will update this list and notify customers at least 30 days before adding or replacing a sub-processor that processes personal information.

• Render Services, Inc. (United States) — hosting and managed Postgres. Currently Oregon region; planned migration to Frankfurt (Germany) noted above. SOC 2 Type II audited.
• Microsoft Corporation (Microsoft Graph API) — outbound transactional email (magic-link sign-in, absence notifications, evacuation blasts). Schools that configure a custom email sender route via that school's own Microsoft 365 tenant instead.
• Functional Software, Inc. d/b/a Sentry (United States) — error reporting. We do not log personal information into error events.

Children's data (POPIA s.35)

Personal information of children is treated as a special category. ClassPulse:

• Limits access to authenticated, role-permitted users of the relevant school tenant.
• Does not use children's personal information for marketing.
• Does not share or sell children's personal information.
• Records every read and mutation in the audit log so abuse is discoverable after the fact.

How long we keep it

Active tenant data is retained for the duration of the school's subscription plus 12 months. If a school cancels, we retain the data in cold storage for 12 months to allow recovery, then delete it permanently. Audit logs follow the same lifecycle.

For prospective customers contacting us through the marketing site, we retain the conversation for up to 24 months unless you ask us to delete it sooner.

Your rights under POPIA

You have the right to:

• Be notified that we are collecting your personal information.
• Access the personal information we hold about you.
• Request correction or deletion of inaccurate or incomplete information.
• Object, on reasonable grounds, to the processing of your personal information.
• Lodge a complaint with the Information Regulator (South Africa).

To exercise any of these rights, email hello@classpulse.co.za with "POPIA request" in the subject line. We respond within 30 calendar days.

Security

Authentication is passwordless — email magic links and WebAuthn passkeys only. Tenants are isolated at the database layer. Email credentials, when stored per-school, are encrypted at rest using Fernet symmetric encryption.

Emergency & safety-adjacent features

ClassPulse includes features that touch on emergency processes — most notably the evacuation roll-call, the gate-in / gate-out flow, and visitor logging. These exist to make your school's existing emergency procedures faster and auditable; they are not a disaster-management system, a life-safety system, or any kind of substitute for your emergency plan, drills, paper backup, statutory inspections, or trained staff.

Your school remains solely responsible for life-safety outcomes and statutory compliance. Data processed by these features (attendance marks during an evacuation, gate logs, visitor records) is governed by the same retention, access, and audit rules as the rest of your tenant's data. See our terms of service §8 for the liability framing.

Information Regulator (South Africa)

If you believe we have not adequately addressed a privacy concern, you may lodge a complaint with the Information Regulator:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg
inforegulator.org.za

Changes to this policy

We will post material changes here and email registered customers at least 30 days before the change takes effect.