Effective date: [21 October 2026]
This is the Privacy Policy of CambriLearn (“we”, “us” or “our”). It tells you what personal information we collect about you and, where applicable, your child; why we collect it; who we share it with; how long we keep it; how we keep it safe; and the rights you have in relation to it.
It is written in plain language so that parents, guardians and learners can understand it. If there is anything you do not understand, please contact our Information Officer using the details in Section 18 below.
This policy applies to:
This policy covers the entirety of CambriLearn’s activities. It is the only privacy policy you need to consult to understand how we handle your personal information. Where we introduce a new tool or feature, we describe it in this policy rather than maintaining a separate notice for each.
CambriLearn is operated, for the purposes of the processing of personal information in South Africa, by Top Dog Internet Sales (Pty) Ltd t/a CambriLearn (registration number 2010/013984/07), a company incorporated in the Republic of South Africa with its registered office at 155 West Street, Sandton, 2031, South Africa.
Our affiliated United States entity is CambriLearn USA, Inc. The South African and United States entities operate under a shared brand and shared platform. For personal information collected in connection with services provided in or from South Africa (which includes all of the learning platform and assessment processing described in this policy), the South African entity is the “responsible party” for the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), and the “controller” for the purposes of the European Union General Data Protection Regulation (“GDPR”), to the extent the GDPR applies.
We collect the following categories of personal information, depending on your interaction with us:
We collect personal information for the following purposes:
We process personal information on the following lawful bases under POPIA:
Where you or your child uses any feature on our platform through which communications take place (including the online chat, live group sessions and lessons, forums, CambriCommunity, comments, and any other channel we provide), the communications take place on systems we operate and may be monitored, moderated, recorded or reviewed by CambriLearn for the following purposes:
This monitoring is limited to communications that take place through CambriLearn channels. It does not extend to communications between you and any third party outside of the platform. Where lessons are recorded, this is disclosed at the time of the lesson and the recordings are retained in accordance with Section 13 below.
To the extent that this monitoring is governed by the Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 (“RICA”), you consent to it for the purposes set out above. You should not transmit, through any CambriLearn channel, any communication that you wish to remain private from CambriLearn.
CambriLearn uses an AI-assisted marking tool called CambriGrader to support our teachers in marking learner assessments. This is one of the tools we use to deliver our service and we describe it here for transparency.
How CambriGrader works:
Important points to note:
You have the right to object to the use of CambriGrader in respect of your or your child’s assessments. If you do, please contact our Information Officer (Section 18) and we will arrange for the affected assessments to be marked manually by a teacher. Objection does not affect any other aspect of the enrolment.
Parents and guardians can choose to connect an AI assistant, such as Claude (provided by Anthropic), to their CambriLearn parent account through the CambriLearn MCP Connector for Parents (the “AI assistant connection”). Once connected, the assistant can read information about the learners linked to your account, so that you can ask about their schoolwork in your own words. Using the AI assistant connection is optional, and nothing is shared with an AI assistant unless you connect one.
Who can connect an assistant:
How you give consent:
Each time you connect an assistant, you consent, as the learner’s parent or guardian, to CambriLearn making the information you approve available to that assistant.
What the assistant can read:
For each learner linked to your account, the assistant can read:
If you leave fee information ticked, the assistant can also read fee information for the subjects you pay for: your next payment date, failed payments, instalment plans, recent payments and invoices. It cannot see card numbers, or fees paid by anyone else, such as another parent or a school.
What the assistant cannot do:
The AI assistant connection is read-only. The assistant cannot change anything in your account or your child’s account. It cannot submit work, make or change payments, book or cancel anything, message teachers or CambriLearn staff, or download report cards or other files. It cannot see learners who are not linked to your account.
AI assistants can make mistakes when they summarise information. If something looks wrong, check it on CambriLearn, where the original records are kept.
Where the information goes:
Information the assistant reads becomes part of your conversation with that assistant. From that point it is held and processed by the assistant’s provider (for example, Anthropic for Claude) under your own agreement with that provider and its privacy policy. The provider is not CambriLearn’s operator and does not act on our instructions.
We do not control how the provider handles the information, including how long it keeps your conversations and whether it uses them to improve its models. The provider may process the information outside South Africa (see Section 12). Please connect only an assistant you trust with your child’s school information, and check its privacy settings.
What CambriLearn keeps:
To keep the AI assistant connection secure and to investigate problems, we record when your assistant used the connection and what type of information it read (for example, “attendance”). We do not store your questions or the assistant’s answers. We delete these records after twelve (12) months.
Disconnecting:
You can disconnect an assistant at any time. Log in to CambriLearn, go to Profile > Connected apps and click Disconnect next to the assistant. It loses access immediately. You can also remove CambriLearn from your assistant’s own settings.
Disconnecting stops any further sharing. It does not remove information the assistant has already read. To delete that, use your provider’s own tools, for example by deleting the conversation.
Lawful basis and transfers:
We rely on the consent you give, as the learner’s parent or guardian, each time you connect an assistant (section 11(1)(a) of POPIA). Where the provider processes the information outside South Africa, we rely on the same consent for that transfer (section 72(1)(b) of POPIA). You can withdraw consent at any time by disconnecting, and withdrawal does not affect information shared before you disconnected.
If you have questions about the AI assistant connection, please contact our Information Officer (Section 18).
We share personal information only with the following categories of recipient and only to the extent necessary:
Operators process personal information on our behalf, in accordance with our instructions, and are bound by written contracts requiring them to maintain appropriate security and confidentiality. Our principal operators are:
A full list of operators is maintained in our internal Record of Processing Activities and is available on request to the Information Officer.
Where a learner is registered for formal assessment, we share the necessary registration details with the relevant examination body (such as Pearson Edexcel, Cambridge Assessment International Education, the IEB, SACAI or Cognia). These bodies act as independent responsible parties in respect of the personal information they receive.
Where a learner attends a CambriLearn-affiliated tutor centre, we share the necessary information with that centre to coordinate the learner’s support.
Where a subscription is purchased through one of our affiliates, we may share with that affiliate such information as is necessary to administer the affiliate relationship and the subscription. We do not share personal information with affiliates for their own marketing purposes.
If you connect an AI assistant to your parent account (see Section 8), we make information about the learners linked to your account available to that assistant at your request. The assistant’s provider, such as Anthropic for Claude, is not our operator. It receives the information under your own agreement with it and is responsible for how it handles it.
We will disclose personal information where the law requires us to do so, or where disclosure is necessary to protect our rights or the safety of any person, including in response to subpoenas, court orders or other legal process.
We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes. We do not transfer personal information to any operator that does not undertake to maintain appropriate security and confidentiality.
Payments are processed by an external payment gateway. CambriLearn does not store full payment card numbers on its own systems. The payment gateway is responsible for compliance with the Payment Card Industry Data Security Standard (PCI DSS) in respect of card data.
Our website uses cookies and similar technologies, including Google Tag Manager and analytics cookies, to operate the site and to understand how it is used. Cookies fall into the following categories:
You can manage your cookie preferences through your browser settings and through the cookie banner on our website. Withdrawing consent to analytics and marketing cookies will not affect your access to the learning platform.
Because we use international providers (in particular Google LLC for the Gemini AI marking service, and various cloud infrastructure providers), some of your personal information may be transferred to, and stored or processed in, countries outside South Africa, including the United States, the European Union and the United Kingdom.
We rely on the following safeguards under section 72 of POPIA to ensure that your information remains adequately protected:
If you connect an AI assistant (see Section 8), its provider may process the information the assistant reads outside South Africa. For that transfer we rely on the consent you give when you connect the assistant. We have no data processing contract with your provider, so its own terms apply.
If you have questions about the safeguards in place for any particular transfer, please contact our Information Officer.
We keep personal information only for as long as is necessary for the purpose for which it was collected, or as required by law. Our default retention periods are:
Google’s logs of prompts and responses on the paid Gemini API are retained by Google for a limited period for the sole purpose of detecting and preventing abuse, as described in Google’s terms.
At the end of the applicable retention period, we delete or de-identify the personal information.
We take the security of your personal information seriously. We have implemented appropriate technical and organisational measures, including:
No system is completely secure. If you suspect that the security of your account has been compromised, please contact our Information Officer immediately.
Many of our learners are children under the age of 18; many others, particularly at A-Level and equivalent post-matric levels, are adults of 18 or older. The position differs between the two groups.
For learners who are children, we process personal information only with the prior consent of a parent or legal guardian (a “competent person” as defined in POPIA), given at enrolment through our Terms and Conditions. The consent extends to all the processing described in this policy, including the use of CambriGrader and the cross-border transfers described in Section 12. The competent person may withdraw consent at any time by contacting our Information Officer. Withdrawal will not affect the lawfulness of any processing carried out before the withdrawal but may affect our ability to continue providing services.
Connecting an AI assistant needs its own consent, given by the parent or guardian each time an assistant is connected (see Section 8), and the consent given at enrolment does not cover it. Learner accounts cannot connect an assistant.
For learners who are 18 years of age or older (or who have reached the age of adulthood in their country of residence), the learner gives consent in their own capacity at enrolment. References elsewhere in this policy to consent given by a parent or legal guardian apply, in the case of adult learners, to consent given by the learner directly.
We do not market to children. Marketing communications are sent only to (a) parents and guardians who have opted in, or (b) adult learners who have opted in.
We will only send you marketing communications by electronic means (such as email or SMS) if you have separately opted in to receiving them, or if you are an existing customer and the marketing relates to similar products or services to those you have already purchased.
Every marketing communication includes an unsubscribe link or instructions for opting out. You can also opt out at any time by emailing hello@cambrilearn.com or by contacting our Information Officer.
You have the following rights in relation to the personal information we hold about you and your child:
To exercise any of these rights, please contact our Information Officer (Section 18). We will respond within 30 days of receiving a complete request. There is no charge for exercising these rights, although we may charge a reasonable fee for the production of copies of voluminous records, in accordance with the prescribed fees under POPIA.
Our Information Officer is the person responsible for compliance with POPIA in our organisation. The Information Officer is registered with the Information Regulator of South Africa.
You can contact the Information Officer at:
Top Dog Internet Sales (Pty) Ltd t/a CambriLearn
Attention: The Information Officer
155 West Street, Sandton, 2031
Email: hello@cambrilearn.com
Telephone: +27 10 020 8570
If you believe that we have processed your personal information unlawfully, or that we have not properly responded to a request you have made, you have the right to complain.
We would prefer the opportunity to address your concern. Please contact our Information Officer at the details in Section 18. We will acknowledge your complaint within seven (7) days and provide a substantive response within thirty (30) days.
If you are not satisfied with our response, or if you would prefer to complain directly, you may lodge a complaint with the Information Regulator of South Africa:
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Telephone: +27 (0)10 023 5200
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: https://inforegulator.org.za
The Regulator publishes a complaint form on its website. You may use that form or write to the Regulator setting out the substance of your complaint.
If your personal information is involved in a security compromise that is likely to cause you harm, we will notify you and the Information Regulator as soon as reasonably possible after we become aware of the compromise and have established its scope. Our notification will include the nature of the compromise, the steps we have taken to address it, and any steps we recommend you take to protect yourself.
We may update this policy from time to time. Minor changes, such as updates to contact details or clarifications of existing provisions, will take effect immediately on publication of the updated policy.
Material changes that introduce new processing purposes, new categories of recipient, or new categories of personal information will not apply to your personal information unless we have given you specific notice of the change and, where required, obtained fresh consent. Continued use of our services after a material change will not by itself be treated as consent to that change.
The effective date of this policy is set out at the top of this document.
If you would like a copy of this policy in an alternative accessible format, please contact our Information Officer.
