Privacy Policy

1. Introduction

Montessori Core (“we”, “our”, “us”) is committed to protecting the privacy of children, guides, parents, and school administrators who use our platform. This Privacy Policy explains what personal information we collect, how we process it, and your rights under the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

2. Information We Collect

We collect only the information necessary to provide our services:

• School account information: School name, email address of the administrator, and billing details.
• Staff and guide profiles: Names, email addresses, and role assignments within the school.
• Parent profiles: Names, email addresses, and relationship to enrolled children.
• Child records: First name, last name, preferred name, date of birth, enrollment status, allergies, and medical notes. These records are created by school administrators and guides.
• Observations and progress data:Guides record developmental observations in the classroom. This includes notes about the child’s activities, engagement, and mastery level in defined curriculum areas.
• Attendance: Daily attendance records including dates and status (present, absent, late).
• Media: Photos and videos uploaded to observations by guides, stored securely in Cloudflare R2. Photo consent is required per child before any media is captured.
• Analytics data: Only after you explicitly accept analytics cookies, we collect anonymised usage data through PostHog (session recordings, page views, feature usage).

3. How We Process Information

We process personal information for the following purposes:

• To provide and maintain our school management platform.
• To enable guides to log observations and track child progress.
• To generate parent-facing progress reports.
• To send transactional emails (invitations, confirmations, notifications).
• To process subscription billing through Paystack.
• To improve the platform through anonymised analytics (only with consent).

We do not sell personal information, use it for automated decision-making about children, or share it with third parties for their own marketing purposes.

4. AI-Assisted Report Generation

Montessori Core uses AI language models (Anthropic Claude) to assist guides in drafting narrative progress reports from classroom observations. Before any AI processing occurs:

• Child names are replaced with de-identified labels in the prompt sent to the AI model.
• No photos or media are sent to AI providers.
• All AI-generated drafts are reviewed and approved by a human guide before reaching parents.
• AI usage is tracked per school with token and cost monitoring for transparency.

5. Data Storage and Retention

We store data on infrastructure provided by the following third-party processors, all of whom maintain industry-standard security certifications:

• Supabase(database, authentication, file storage) — hosted in the EU (Frankfurt).
• Vercel(application hosting) — global edge network.
• Cloudflare R2(photo and media storage) — zero-egress object storage.
• PostHog(product analytics — only with explicit consent) — EU-hosted.
• Anthropic(AI model provider for report drafts) — data not used for model training.
• Resend (transactional email delivery).

Personal data is retained for the duration of the school’s active subscription plus 90 days. After account closure or subscription lapse, all personally identifiable information is deleted or anonymised within 30 days, in compliance with POPIA.

6. Your Data Subject Rights

Under POPIA, you have the right to:

• Access: Request a copy of all personal data we hold about a specific data subject (child). School administrators can initiate a per-child data export from the Admin Dashboard.
• Rectification: Request correction of inaccurate or incomplete personal data. Most data can be edited directly by school administrators.
• Deletion: Request deletion of personal data. School administrators can request child data deletion from the Admin Dashboard with optional grace periods.
• Objection: Object to the processing of personal information in certain circumstances.
• Complaint: Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact your school administrator or reach us at the contact details below.

7. Cookie Policy

Montessori Core uses the following categories of cookies:

• Essential cookies: Authentication session cookies required for the platform to function. These are set automatically and cannot be declined. Without them, you cannot sign in.
• Analytics cookies: PostHog cookies for understanding how the platform is used. These are onlyloaded after you explicitly click “Accept” on the cookie consent banner. If you decline, no analytics cookies are set.

You can manage your cookie preferences at any time by clearing your browser cookies and revisiting the site, where the consent banner will reappear.

8. Data Security

We implement appropriate technical and organisational measures to protect personal information:

• Encryption in transit (TLS 1.3) and at rest (AES-256 for database, SSE for object storage).
• Row-level security at the database layer ensuring strict per-school data isolation.
• Role-based access control limiting data access to authorised personnel.
• Regular security monitoring and error tracking via Sentry.

9. Data Processing Agreement

A Data Processing Agreement (DPA) is available for schools requiring a formal data processing contract. The DPA covers our obligations as a processor under POPIA and is accepted during school signup. School administrators can request a signed copy by contacting us.

10. Contact Us

For privacy-related inquiries, data subject requests, or to exercise your rights, contact: