POPIA Compliance Statement

Last updated: June 2026 · Effective: June 2026

1. About This Statement

This statement explains how BrainBattle, a product of KodeGuy (Pty) Ltd (“we,” “us,” or “our”), complies with the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa. POPIA is South Africa’s principal data protection legislation. Although BrainBattle is a global product used by people in many countries, we are incorporated in South Africa and therefore subject to POPIA.

2. Responsible Party

The responsible party (controller) for personal information processed through BrainBattle is:

KodeGuy (Pty) Ltd
South Africa
Email: privacy@kodeguy.com

3. Information Officer

KodeGuy has designated an Information Officer as required by POPIA. The Information Officer is responsible for ensuring that KodeGuy complies with POPIA, handling data subject requests, and liaising with the Information Regulator.

Information Officer contact: privacy@kodeguy.com

KodeGuy has registered its Information Officer with the Information Regulator of South Africa in accordance with POPIA.

4. What Personal Information We Process

We process the following categories of personal information:

• Name and email address (required for account creation)
• Account type and selected preferences
• PDF study material you upload
• AI-generated content created from your uploaded material
• Learning progress data
• Child profile data (for Parent/Child accounts) — first name, age, learning preferences, and PIN
• Subscription and billing status (payment details are processed and held by PayFast, not by KodeGuy)
• Technical data (IP address, server logs)

5. Lawful Basis for Processing

We process personal information on the following grounds under POPIA:

• Contract: processing necessary to provide the BrainBattle service you have signed up for
• Legitimate interest: security monitoring, fraud prevention, platform integrity
• Consent: where you have specifically agreed (e.g. the 18+ age confirmation at registration, and the guardian confirmation at child profile creation)
• Legal obligation: where we are required by law to retain certain records

6. Cross-Border Transfer of Personal Information

BrainBattle uses third-party service providers located outside South Africa. Personal information may therefore be transferred to and processed in the United States and European Union by the following operators:

• Vercel — application hosting (United States)
• Supabase — database, authentication, and file storage (United States / European Union)
• Replicate — AI content processing (United States)

Section 72 of POPIA permits cross-border transfers where the recipient country, organisation, or agreement provides an adequate level of protection for personal information. We contractually require each of these processors to protect personal information in a manner consistent with POPIA’s requirements.

7. Data Subject Rights

Under POPIA, you have the right to:

• Access: request details of the personal information we hold about you
• Correction: request that inaccurate, irrelevant, or out-of-date information be corrected
• Deletion: request that your personal information be deleted (subject to our legal retention obligations)
• Objection: object to processing of your personal information in certain circumstances
• Complaint: lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed

To exercise any of these rights, contact our Information Officer at privacy@kodeguy.com. We will respond within a reasonable time and no later than the timeframe required by POPIA.

8. Complaints to the Information Regulator

If you are not satisfied with our response to a data subject request, or if you believe we have not complied with POPIA, you may lodge a complaint with:

Information Regulator (South Africa)
Website: inforegulator.org.za
Email: inforeg@justice.gov.za

9. Children’s Information

POPIA prohibits the processing of personal information of children (persons under 18) without the consent of a competent person (parent or guardian). BrainBattle’s architecture reflects this: child profiles are created only by a parent or guardian who confirms their role at the time each profile is created. Full detail on child data protection is set out in our COPPA Compliance Statement.

10. Security

We implement reasonable technical and organisational measures to protect personal information from loss, damage, unauthorised access, or disclosure. These include database-level Row Level Security, HTTPS encryption, and access controls limiting who can view personal data within our infrastructure.

11. Retention

Personal information is retained for as long as your account is active. On account deletion, personal data is removed within 30 days, except where we are legally required to retain certain records (for example, billing records for statutory tax or accounting purposes).

12. Changes to This Statement

We may update this POPIA Compliance Statement from time to time. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact Us

For POPIA-related questions or to submit a data subject request:

Email: privacy@kodeguy.com