1. Scope and privacy contact
This notice explains personal information handling on CTA Warriors, https://accounting-warriors.lovable.app. Contact the platform owner at yedwaathabile@gmail.com for privacy enquiries, complaints and requests.
2. Information we process
Account information includes your email, authentication identity and display name; optional profile information includes university and contact number. Depending on the features you use, information may include membership and access dates, written tutoring topics, tutor and session references, reviews, forum membership, messages and message metadata, study activity, quiz results, practice responses, AI prompts and conversation context, academic uploads, extracted text and generated reports. Policy records include accepted versions, acceptance times, separate processing and marketing choices, browser user agent and, where reliably available, an IP address. Providers may maintain technical security and delivery records under their own terms.
Information comes from you, your sign-in provider, the features you use, other conversation participants and integrated services such as BrightPath. Email and authentication information are required for an account; withholding them prevents registration. Optional university and contact details are not blanket prerequisites to registration, although a particular contact or tutoring action may need the details disclosed for that action.
3. Purposes and lawful grounds
We use relevant information to create and secure accounts, deliver educational tools, manage membership access, connect independent tutors and students, deliver messages, handle support and requests, record policy acceptance and protect against misuse. Processing is limited to what is reasonably necessary for those purposes. Depending on the purpose, applicable grounds include your informed consent, performance of an agreement, compliance with legal duties and legitimate interests permitted under the Protection of Personal Information Act (POPIA). Accepting a policy is not a waiver of POPIA rights or a blanket permission for unrelated processing.
Registration asks separately for personal-information processing consent. You may request withdrawal; where the information is necessary to operate your account or a requested service, withdrawal may mean that service cannot continue. We may retain records where another lawful basis requires or permits it, explaining that basis on request.
4. Optional marketing
Study tips and offers by email require a separate, unticked opt-in. Declining it does not prevent account creation. A record is kept of your choice independently of required account consent. No WhatsApp marketing permission is inferred from an email choice. You may withdraw email marketing permission at any time by contacting the owner; withdrawal affects future marketing, not the lawfulness of prior processing. We do not represent that an automated marketing delivery programme is currently configured.
5. AI and academic material
Using an AI feature sends the relevant prompt, selected uploaded material and necessary conversation context to external AI services through Lovable's AI gateway and model providers. Tutor responses may use web search. Remove unnecessary personal identifiers and third-party information before submission and only upload material you are authorised to share. We do not promise that all inputs are automatically anonymised, that providers keep no logs, that every provider excludes training use, or that all processing occurs in South Africa. Provider settings and agreements determine their processing; contact the owner for current details before submitting highly sensitive material. AI output may be inaccurate and must be independently verified; it is not an authoritative decision about your examination, career or legal rights.
6. Recipients and external services
Lovable Cloud provides account, hosting and database services. Lovable's AI gateway and the relevant model providers process AI requests. Google or Lovable may process sign-in when you choose those methods. BrightPath processes relevant tutoring request, profile, review and direct-message information to connect you with independent tutors. The tutor receives the information you send for that request or conversation. General forum messages are visible to participating signed-in users; joined private channels and groups have their own membership controls. Other users may retain or share copies of content they receive.
These services may process information outside South Africa. POPIA section 72 conditions must be met for applicable cross-border transfers, for example adequate legal or contractual protection or another lawful statutory basis. Your agreement to this notice alone is not proof of adequate overseas protection. Provider countries, subprocessors and contractual safeguards have not all been independently confirmed for this notice; request current details from the owner. External links and embedded third-party media may also disclose connection information directly to the external provider and are governed by its own privacy practices.
7. Browser storage and communication security
Some profile, study, practice, AI report and legacy activity records are held in your browser's local storage or IndexedDB rather than shared across every device. Authentication also uses browser storage necessary for a session. Clearing browser data removes those local copies, not all Cloud, third-party or recipient copies. Do not use a shared device without protecting and signing out of your account.
Tutor direct messages use BrightPath's managed delivery and are not end-to-end encrypted. The integrated services process readable message content to deliver them. Opt-in module/group forum channels use a separate client-side encryption mechanism; this does not conceal all account, membership or delivery metadata. The General channel is not private end-to-end encrypted messaging. Reasonable technical and organisational safeguards are applied, but no service is represented as 100% secure or error-free. Protect your account credentials and device. Report suspected compromise to the owner promptly.
8. Retention and deletion
Information should be kept only as long as justified by its purpose, legal duties, legitimate dispute needs or another lawful basis, then deleted, destroyed or de-identified as appropriate. A fixed, automated category-by-category retention schedule has not yet been implemented; the proposed 90-day upload, 730-day message, dormant-account and grace-period deadlines in the implementation brief are not promises of current automated deletion.
In the current analyzer, completing or failing processing clears saved attachment fields in that browser's analysis state; extracted input and reports can remain, and interrupted queued uploads may remain locally. Other academic tools may keep local attachments in IndexedDB. Use available deletion controls and contact the owner for assistance. The profile's confirmed Delete Account feature removes your account and specified linked platform records and clears the current browser's main application state. It does not automatically erase local copies on other devices, all IndexedDB keys, recipients' copies, BrightPath-held messages or every provider log and backup. External retention and deletion requests may need the relevant provider's involvement. Policy acceptance and consent evidence may remain for a justified legal/accountability purpose; it is not a licence for indefinite identifiable retention.
9. Your rights and requests
Subject to applicable legal requirements, you may request confirmation of processing and access to your information, correction, qualifying deletion, objection to processing and withdrawal of consent. Email the owner with the request and enough account information to identify it; do not send a password. We may ask for proportionate identity verification before disclosing information or changing records. Requests will be considered within the applicable legal requirements and a reasonable period; any refusal, lawful retention need or applicable fee must be explained. There is not yet an automated full-account data export or dedicated privacy-request queue, so use the contact channel rather than assuming those tools exist.
You may complain to South Africa's Information Regulator without first exhausting an internal process. Current complaint forms and contact routes are available at https://inforegulator.org.za/popia-forms/ . These policies do not restrict your statutory complaint or court rights.
10. Adults, tracking and updates
Registration is for people aged 18 or older. If a child's information has been submitted or an account was created contrary to that rule, contact the owner so it can be assessed under POPIA's rules for children's information. Do not intentionally upload children's information without a lawful basis.
Necessary authentication and browser storage support the service. Optional analytics or marketing tracking must not be treated as authorised merely because you accept the Terms or required processing consent. Third-party media and destinations have their own storage and tracking practices. We do not assert that all third-party tracking is blocked or that a full cookie-preference manager has been implemented.
A material change is published as a new version with its effective date. Where renewed acceptance is required, a review screen blocks continued account access until you accept or decline and sign out. Acceptance records are versioned; a later withdrawal of consent does not rewrite historical evidence. Contact the owner if any part of this notice does not match your experience.