Privacy Policy

This policy explains what Ellermon Holdings (Pty) Ltd does with personal information in the GradeLens app and on this website. It is written to be read, not to be survived. Where a section carries a specific legal meaning we say so plainly.

1. Who we are

Ellermon Holdings (Pty) Ltd is the responsible party for the personal information described here — the term POPIA uses for what the GDPR calls a data controller. We decide why and how it is processed, and we are accountable for it.

Registered name

Ellermon Holdings (Pty) Ltd

Registration number

2026/561599/07

Registered office

4A Westminster Avenue
Bryanston
Johannesburg
Gauteng, 2191
South Africa

Information Officer

Michael Ian Rolle, Director

Privacy contact

admin@ellermon.com

2. What we collect

We collect only what GradeLens needs to do its job. Nothing below is optional instrumentation added "in case it is useful later".

Your account

• Email address — used to identify your account and to sign you in.
• A unique account identifier issued by Amazon Cognito, our identity provider. This identifier, not your email, is what links your data together in our database.
• A display name, if you choose to set one.
• Your notification preferences — which of the four reminder types you want.
• The achievement scale — the country's seven-level scale, which the app applies to a learner's marks. It is the same for every learner and cannot be changed.
• Your acceptance of our terms — which version of the Terms of Use and this policy you accepted, when, and that you confirmed you are 18 or older.
• When your account was last used — the time of your most recent sign-in, so we can apply the inactivity rule.

We never receive or store your password. Authentication is handled by Amazon Cognito and your password never reaches our systems.

If you choose Sign in with Google, Google confirms who you are and tells us your name and email address. We do not receive your Google password or anything else from your Google account.

A learner's own account

• Their email address and a sign-in identifier from Amazon Cognito; their password never reaches us. If they use Sign in with Google, Google tells us their name and email address
• Their name, date of birth and grade
• Under 18: their parent or guardian's email address, and the guardian's consent decision with its date and policy version
• Any guardian who links to manage them
• If they ask to delete their account while under 18, the request and the guardian's decision

Each learner you add

• First name and last name
• Date of birth
• School grade, from 1 to 12
• School name, which is optional
• A display colour
• Your confirmation that you may consent for them, and when you gave it — see information about children

Schoolwork

• Subjects and terms you set up for each learner
• Assessment categories and their weightings
• Assessments — a name, a date, a subject, a category, and a mark out of 100 where one has been recorded
• Calendar events — a title, a date, an optional time, an optional note of up to 500 characters, and the kind of event it is

Technical information

• Website server logs — when you visit this website, our web host records the request, including the IP address it came from, as a normal part of serving and protecting the site. We do not use those logs to profile you or to follow you across other sites, and we keep them for up to 90 days.
• Server logs generated when the app talks to our API, recording what kind of request was made, when, and whether it succeeded. These exist so we can find and fix faults and detect abuse. They do not contain your name, your email address, or your children's information.
• Single-use links and codes — when a guardian invites a learner to their own sign-in, or a learner and guardian link their accounts, we keep the invite, its short code and who it is for until it is used or expires. The same applies to the consent and deletion links we email to a guardian. Each expires 7 days after it is sent.

On your device

• Sign-in tokens are kept in the operating system's secure storage (Keychain on iOS, Keystore on Android).
• Recently viewed information — for example a student's details and marks — is kept on the device so the app opens quickly. It is encrypted with a key held in the device's secure storage that never leaves the device, and it is removed when you sign out. A learner's own device keeps only that learner's information, in the same way. On Android, GradeLens excludes its data from cloud backups.
• Reminders are scheduled by the app on the device that asked for them, whether yours or a learner's own. We collect no push notification token, and reminders do not pass through our servers or Apple's or Google's push services. A reminder can show a student's first name and the name of a test or event on the lock screen; it never shows a mark. Signing out, or deleting the account, removes them from the device.

What we deliberately do not collect

• Location data of any kind
• Contacts, photos, camera, microphone, calendar or health data from your device
• Advertising identifiers, and we run no advertising SDKs
• Third-party analytics or behavioural tracking
• Payment or banking details — GradeLens takes no payments
• Race, religion, health, biometrics, political or trade union affiliation, or criminal history

3. Information about children

This is the part of the policy that matters most, so it is stated in full.

GradeLens exists to hold information about children — their names, dates of birth, schools and marks. Under section 34 of POPIA, personal information about a child is special personal information, and processing it is prohibited unless a specific exemption applies. We rely on section 35(1)(a): processing carried out with the prior consent of a competent person, meaning the child's parent, legal guardian, or someone else legally entitled to consent on the child's behalf.

In practical terms:

• Two ways a child's information can be in GradeLens. A guardian can add a learner to their own account and keep their record; that learner does not sign in. Or a learner can have their own learner account, signing in with their own email address and password or with Google. A learner can sign up for one themselves, or a guardian can invite a learner they have added to sign in with their own account. No one ever signs in on someone else's account, and there are no shared sign-ins or PINs. GradeLens is not distributed as a children's app.
• A learner's own account, and age. We ask for a learner's date of birth when they sign up, because the rules depend on whether they are under 18:
  • Under 18: a parent or guardian must agree first. We email the guardian a consent request with a checkbox and an approve link, and the learner cannot use GradeLens until they approve. We record the guardian's email address, the policy version and when they agreed. The guardian has the final say over the learner's data: if the learner asks to delete their account, we email the guardian and delete it only if they approve. A guardian who manages the learner may also delete it.
  • 18 or over: the learner consents for themselves and no guardian's permission is needed. They may add a guardian to follow along, but that guardian can only stop managing them; only the learner can delete their account, which is removed immediately and erased from our live systems within 30 days.
  When a learner turns 18, the adult rules apply from their birthday.
• Guardians who manage a learner's account. A guardian links to a learner's own account with a single-use invite or code. Once linked, the guardian can see and edit that learner's information, and the learner can see which guardians are linked and their email addresses. Either can end the link. When a guardian of a learner under 18 stops managing them, the learner cannot use GradeLens again until a guardian consents again.
• What a learner can see and change. Only their own information: their subjects, terms, assessment categories and weightings, report marks, assessments, calendar and events, and their own reminder and slip-alert settings. A learner never sees another child's information or any guardian's account. These limits are enforced by our servers on every request, not only by what the app shows.
• You confirm you are entitled to enter the information. When you add a learner the app asks you to confirm, by ticking a box, that you are that child's parent or legal guardian, or that you are otherwise legally permitted to consent on their behalf. A learner cannot be added without it, and we keep a record of that confirmation and when it was given. If that stops being true — for example following a change in custody — please delete that learner from your account.
• A child's information is used for nothing else. It is never used for advertising, profiling, marketing, model training, or any purpose beyond showing you your own child's progress.
• It is never sold or shared. There is no circumstance in which we sell or trade information about a child.
• Children have rights too. A child, or a competent person acting for them, may ask what we hold about that child, ask for it to be corrected, or ask for it to be deleted. See your rights.
• We collect the minimum. Date of birth is used to keep learners distinct and to sanity-check the grade; school is optional and can be left blank.

If you believe a child's information has been entered into GradeLens by someone with no right to do so, contact admin@ellermon.com immediately and we will investigate and, where appropriate, delete it. See our child safety standards.

4. Why we process it

We do not use your information, or your children's, to train machine learning models.

5. Our lawful basis

Under POPIA we rely on:

• Consent (section 11(1)(a), and section 35(1)(a) for children's information) — you choose to create an account, to enter each learner's details, and to invite a learner to their own account. A guardian consents for a learner under 18; a learner who is 18 or over consents for themselves.
• Performance of a contract (section 11(1)(b)) — we cannot provide GradeLens without processing what you enter into it.
• Legitimate interests (section 11(1)(f)) — keeping the service secure, available and free of abuse.
• Legal obligation (section 11(1)(c)) — where a law requires it.

If you are in the European Economic Area or the United Kingdom, the equivalent GDPR bases are Article 6(1)(a) consent, 6(1)(b) contract, 6(1)(f) legitimate interests and 6(1)(c) legal obligation, with Article 8 governing children's data.

You can withdraw consent at any time by deleting a learner or your whole account. Withdrawal does not undo processing that already lawfully happened.

6. Who we share it with

We do not sell personal information, and we never will. We do not share it for anyone else's marketing. We share it only with the service providers who run the infrastructure GradeLens sits on — operators in POPIA's terms, processors in the GDPR's — each bound to process it only on our instructions:

We will also disclose information where we are legally obliged to — for example under a valid court order or a lawful request from a regulator — and where it is necessary to establish, exercise or defend a legal claim. If we are ever compelled to hand over information about you, we will tell you unless we are legally prohibited from doing so.

If Ellermon Holdings is ever sold or merged, personal information may transfer to the acquirer. We would notify you first, and the information would remain subject to a policy no less protective than this one.

7. Where it is stored

GradeLens data is stored in the AWS Africa (Cape Town) region (af-south-1). Your family's information is held in South Africa and is not routinely transferred outside the Republic.

Two limited exceptions involve information leaving the country. If you choose Sign in with Google, Google — which operates internationally — confirms your identity and shares your name and email address with us. And if you email us, that message sits with our email provider. Your children's information is never part of either. Where a transfer does occur we rely on section 72 of POPIA, which permits it with your consent, where it is necessary to perform our contract with you, or where the recipient is subject to comparable protection.

8. How long we keep it

An account, a guardian's or a learner's own, counts as used whenever its holder signs in or opens the app while signed in. Before we delete an account for inactivity, we email the address on the account and give you at least 30 days to keep it — signing in once is enough. We never delete an account for inactivity without that warning, unless its sign-in has already been removed.

9. How we protect it

• All traffic between the app and our servers is encrypted in transit using TLS.
• Data is encrypted at rest in our database and in backups.
• Sign-in uses Amazon Cognito: your password is checked without being sent to us, and Sign in with Google uses the OAuth 2.0 authorisation code flow with PKCE. Tokens are held in the operating system's secure storage — Keychain on iOS, Keystore on Android — not in ordinary app storage.
• Every learner who uses the app signs in to their own account. There are no shared sign-ins or PINs, and invites, link codes and emailed links work once and expire after 7 days.
• Every API request is authorised before it is served, and every request is checked to confirm the account making it owns the data it is asking for.
• Access to production systems is limited to the people who need it, and is logged.
• Dependencies are audited automatically and updated when vulnerabilities are published.

No system is perfectly secure, and we will not claim otherwise. What we commit to is applying appropriate, reasonable technical and organisational measures as section 19 of POPIA requires, and telling you promptly if something goes wrong.

10. Your rights

You have the right to:

• Be told what personal information we hold about you or your children
• Get a copy of it
• Correct anything inaccurate, and complete anything incomplete
• Delete information that is inaccurate, irrelevant, excessive, obtained unlawfully, or that we no longer have grounds to keep
• Object to processing based on legitimate interests, on reasonable grounds
• Withdraw consent at any time
• Not be subject to a decision made solely by automated means that has legal consequences for you — we make no such decisions
• Complain to the Information Regulator (South Africa)

Most of these you can exercise yourself inside the app: edit or delete a learner, or delete your entire account. For anything else, see making a data request. We respond within 30 days and we do not charge for a reasonable request.

If you are unhappy with how we handled your request you may complain to the Information Regulator (South Africa) — details on our POPIA page.

11. Security compromises

If personal information is accessed or acquired by anyone without authorisation, section 22 of POPIA requires us to notify both the Information Regulator (South Africa) and every affected person as soon as reasonably possible. We will tell you what happened, what information was involved, what we have done about it, and what you can do. We will not delay that notification to manage embarrassment.

12. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects your rights or how we use your information, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again. Previous versions are available on request.

13. Contacting us

Our Information Officer is responsible for this policy and for your requests under it.

Information Officer

Michael Ian Rolle, Director

Email

admin@ellermon.com

Post

4A Westminster Avenue
Bryanston
Johannesburg
Gauteng, 2191
South Africa

Response time

Within 30 days