Privacy Policy

1. Who we are

Thiza is operated by Boipuso Investments (Pty) Ltd ("Boipuso Investments", "we", "us", "our"), trading as Thiza. Boipuso Investments (Pty) Ltd is the data controller responsible for personal data processed through the Thiza service. You can contact us at nhlanhlamsima@gmail.com.

2. Information we collect

We collect: (a) account data you provide directly, such as your email address, name, school name, and display name; (b) content data, including the marksheet images, PDFs, and extracted student marks you upload; (c) usage and device data, such as sign-in events, uploads, exports, IP address, browser, and device identifiers, collected automatically; and (d) support communications you send us.

3. How we use your information and legal basis

We process personal data on the following legal bases:

• Performance of a contract — to create your account, convert marksheets to spreadsheets, store your subjects and marksheets, generate downloadable Excel files, and provide customer support.
• Legitimate interests — to secure the service, prevent fraud and abuse, log activity events (sign-ins, uploads, exports), and improve product features.
• Legal obligation — to comply with tax, accounting, and other laws, and to respond to lawful requests from authorities.
• Consent — where we ask for it, for example for optional marketing communications. You can withdraw consent at any time.

4. Data sharing

We do not sell your personal data. We share limited personal data only with the following categories of recipients:

• Paddle.com Market Limited ("Paddle") — our Merchant of Record and payment processor. When you purchase a subscription, Paddle receives your name, email, billing address, and payment details to process the order, manage your subscription, handle invoicing, tax compliance, refunds, and chargebacks. Paddle acts as an independent controller for payment data. See Paddle's privacy policy at paddle.com/legal/privacy.
• Service providers and sub-processors — cloud hosting, database, storage, email delivery, and analytics providers that process data on our behalf under written agreements.
• Professional advisers — accountants and legal advisers, where necessary.
• Authorities — where required by law, court order, or to protect our rights, users, or the public.

Your marksheet content is not shared with any third party other than the sub-processors strictly needed to operate the service.

5. Data retention

We keep your data for as long as your account is active. You can delete subjects and marksheets at any time. If you delete your account, we will remove or anonymise your personal data within 30 days, except where we are required to keep it by law (for example, billing records retained by Paddle for tax compliance).

6. Security

We use appropriate technical and organisational measures including encryption in transit (TLS), row-level security on the database, access controls, and authentication-protected API access. No system is perfectly secure, but we work to protect your data against unauthorised access, loss, or disclosure.

7. Your rights

Depending on your country, you have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You may exercise these rights through your profile page or by contacting us at nhlanhlamsima@gmail.com. You also have the right to lodge a complaint with your local data protection authority (in South Africa, the Information Regulator).

8. Cookies

We use cookies and similar technologies that are strictly necessary to keep you signed in and to operate the service securely. We do not use advertising cookies.

9. Contact

Boipuso Investments (Pty) Ltd, trading as Thiza — nhlanhlamsima@gmail.com.