Privacy Policy

In-Odyssey is an AI-powered learning management and career-guidance platform operated by Profspect (Pty) Ltd ("In-Odyssey", "Profspect", "we", "us" or "our"). This Privacy Policy explains what personal information we collect from students, parents/guardians, teachers, service providers and visitors ("you"), why we collect it, who we share it with, and the choices and rights you have over it. By using the In-Odyssey website or platform, you acknowledge that you have read and understood this policy.

1. Who we are

Profspect (Pty) Ltd is the "responsible party" (data controller) for personal information processed through the In-Odyssey platform, as defined by POPIA. Our registered office and Information Officer can be reached using the details in the Contact us section below.

2. Information we collect

The information we collect depends on how you use In-Odyssey and which role(s) your account has.

2.1 Account & profile information

• Full name, email address, phone number and date of birth
• School/institution, grade or role (student, teacher, parent, service provider or admin)
• Password (stored as a one-way cryptographic hash — we never store or can view your plain-text password)
• Profile picture, where you sign in with Google or upload one
• For parent/guardian accounts: the names and grades of linked learners

2.2 Academic & career-guidance information

• Subjects, marks, grades, assignments, submissions and exam-practice results
• Psychometric assessment responses and the resulting personality profile, traits and persona
• Career, university and bursary matches generated from your academic and psychometric data
• Lesson, course and module progress, including any AI-generated remediation courses

2.3 Communications

• Messages sent through the in-platform messaging and notification tools (e.g. between students, teachers and parents)
• Enquiries submitted via our contact form, and any correspondence with our support team

2.4 Payment information

Where you purchase a subscription, voucher or item through the In-Odyssey shop, payments are processed by our payment partners PayFast and Ozow. We receive confirmation that a payment was made and basic transaction details (amount, date, reference) — we do not collect or store your card number, bank login details or PayFast/Ozow credentials. Those details are entered directly on PayFast's or Ozow's own secure payment pages.

2.5 Technical & usage information

• IP address, browser type, device information and approximate location (derived from IP)
• Log data such as pages visited, timestamps and security-related events (used to keep the platform safe from abuse, scanning and attacks)
• Cookies and similar technologies — see our Cookie Policy

2.6 Information from third-party sign-in

If you choose to register or log in using Google or LinkedIn, we receive your name, email address and (for Google) profile picture from that provider, as permitted by your settings with that provider.

3. How we use your information

• To create and administer your account, and provide access appropriate to your role
• To deliver the core LMS functionality — lessons, assignments, grading, timetables and progress tracking
• To generate psychometric profiles, persona matches, career and university recommendations, and personalised remediation lessons
• To enable communication between students, teachers, parents and service providers within the platform
• To process payments for subscriptions, vouchers and shop purchases
• To translate the website/platform into your selected South African language using Google Translate
• To detect, investigate and prevent fraud, abuse, unauthorised access and other security incidents
• To respond to enquiries sent via our contact form or support channels
• To comply with our legal obligations, including those under POPIA and applicable education-sector regulations

We do not sell your personal information to third parties.

4. Our legal basis for processing

We process your personal information on one or more of the following bases:

• Consent — for example, when you register an account, complete a psychometric assessment, or opt in to a non-essential cookie or communication
• Performance of a contract — to provide the services you or your school/parent have signed up for
• Legitimate interests — such as keeping the platform secure, improving our services and preventing fraud, balanced against your rights
• Legal obligation — where processing is required to comply with South African law

5. Children's privacy & parental consent

In-Odyssey is designed for use by learners in Grade 8–12, some of whom are children as defined by POPIA (under the age of 18). We take the protection of children's personal information seriously and process it only:

• with the consent of a parent or guardian, given during registration or via a linked parent account; or
• where necessary for the provision of educational services to the child, as permitted under POPIA; or
• where the processing is otherwise authorised by law (for example, to establish, exercise or defend a legal right).

Parents and guardians can link a parent account to their learner's profile to view academic progress, communications and reports. If you are a parent or guardian and believe your child has provided personal information without your consent, please contact us using the details in section 13 so we can review and, where appropriate, remove it.

6. Cookies & tracking technologies

We use cookies and similar technologies to keep you securely logged in, remember your language preference, protect the platform from bots and abuse, and (where applicable) process payments. Full details of every cookie we use, its purpose and how long it lasts are set out in our Cookie Policy, including how to manage or disable cookies in your browser.

7. Sharing your information

We do not sell or rent your personal information. We only share it with trusted third parties where necessary to operate the platform, namely:

• Service providers linked to your school — teachers, tutors and career-guidance providers you or your school have given access to
• Authentication providers — Google and LinkedIn, if you choose to sign in using those services
• Payment processors — PayFast and Ozow, for processing purchases
• Security & anti-bot services — hCaptcha, to protect registration and login forms from automated abuse
• Translation services — Google Translate, only for the text of the page you choose to translate
• Hosting & infrastructure providers — who store and process data on our behalf under contract, and may not use it for their own purposes
• Legal & regulatory bodies — where required by law, court order, or to protect the rights, safety or property of In-Odyssey, our users or the public

8. International data transfers

Some of the third parties listed above (such as Google) operate servers outside South Africa. Where your personal information is transferred outside South Africa, we take reasonable steps to ensure it remains protected in a manner consistent with POPIA, including relying on service providers that maintain appropriate security and contractual safeguards for cross-border data transfers.

9. How we protect your information

We apply technical and organisational measures appropriate to the sensitivity of your information, including:

• Encryption of data in transit using HTTPS
• One-way hashing of passwords — we never store passwords in plain text
• Role-based access controls, so users only see information relevant to their role
• Secure, HTTP-only session cookies and protections against common web attacks
• Monitoring and logging of suspicious activity to detect and respond to security incidents

No system can be guaranteed 100% secure. If we become aware of a security incident affecting your personal information, we will take reasonable steps to notify you and the Information Regulator where required by law.

10. Data retention

We retain personal information for as long as your account is active, and for a reasonable period afterwards to meet academic record-keeping, legal, accounting or reporting requirements. When information is no longer needed for these purposes, we securely delete or anonymise it. You may request earlier deletion of your information as described in section 11, subject to any legal obligations we have to retain certain records.

11. Your rights

Under POPIA, you have the right to:

• Be informed of what personal information we hold about you and why
• Request access to the personal information we hold about you
• Request that we correct or update inaccurate, incomplete or outdated information
• Request that we delete or de-identify personal information we no longer have a lawful basis to hold
• Object to the processing of your personal information for purposes such as direct marketing
• Withdraw consent you previously gave, where processing is based on consent (this does not affect processing that occurred before withdrawal)
• Lodge a complaint with the Information Regulator (South Africa) if you believe your information has been processed unlawfully

To exercise any of these rights, contact us using the details in section 13. We may need to verify your identity (or, for a learner under 18, the identity of a parent/guardian) before actioning a request. The Information Regulator can be contacted at inforegulator.org.za.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our platform, legal requirements, or the way we handle personal information. The "Last updated" date at the top of this page shows when it was last revised. Where changes are significant, we will take reasonable steps to bring them to your attention.

13. Contact us

If you have any questions about this Privacy Policy, or wish to exercise any of the rights described above, please contact our Information Officer:

• Email: kennedy.mbono@profspect.co.za
• Address: Midrand, Gauteng, South Africa
• Phone: +27 81 787 8977