Privacy policy

1. Who we are

Chalkline is operated by FlowBridge Systems (Pty) Ltd (“FlowBridge”, “we”), a company registered in South Africa.

For tutor (workspace-owner) accounts, FlowBridge is the data controller. For student data created inside a workspace, FlowBridge is a data processor acting on the tutor's instructions; the tutor is the controller of their students' data.

2. What we collect

• Account data: email address, display name, hashed password, role (owner, staff, student, super-admin), and authentication session identifiers.
• Workspace data you create: bookings, lesson notes, invoices, messages, uploaded files, branding settings, retention preferences, and connected calendar / payment account metadata.
• Payment metadata: Paystack and Stripe transaction identifiers, amounts, currency, and status. We do not store full card numbers, CVV codes, or full bank account details — those are handled directly by the payment processor.
• Usage and diagnostic data: anonymised app analytics and error logs. Log payloads exclude tokens, card data, message bodies, and personal identifiers by design.

3. Why we collect it

• To operate the service and the features you use.
• To bill your subscription and handle any payment disputes.
• To send transactional emails (booking confirmations, invoices, reminders, security notifications).
• To investigate abuse, debug problems, and improve reliability.
• To comply with our legal obligations.

4. Where data lives

• Database: Neon Postgres — multi-tenant with strict workspace isolation enforced on every query.
• File uploads (resources, branding logos): Vercel Blob storage, with tenant-prefixed paths to prevent cross-workspace access.
• Lesson recordings (when enabled as an add-on): uploaded directly to your own Google Drive. FlowBridge retains only the metadata pointing to your file.
• Hosting providers: Vercel (application + edge), Neon (database), Hetzner (per-tutor virtual machine for the optional Recording add-on). Data may transit through United States and European Union infrastructure as part of normal service delivery.

5. Who we share data with

We share data only with the sub-processors required to deliver the service. We do not sell personal information, ever.

• Paystack and Stripe — payment processing.
• Resend — transactional email delivery.
• Meta Cloud API — optional WhatsApp notifications, when enabled by the tutor.
• Google Drive — optional lesson recording offload, when enabled by the tutor.
• LiveKit — live lesson room video.
• Vercel, Neon, Hetzner — infrastructure and hosting.

6. Your rights as a workspace owner

Under POPIA (the Protection of Personal Information Act, South Africa) and equivalent laws, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.
• Request a portable copy of your workspace data.
• Withdraw consent where processing relies on it.
• Lodge a complaint with the Information Regulator of South Africa or the applicable supervisory authority in your jurisdiction.

Most requests can be handled in-product from Settings. For requests we cannot handle in-product (account closure, machine-readable data exports), email privacy@mychalkline.com and we will respond within 30 days.

7. Tutor responsibilities for student data

As the controller of your students' data, you are responsible for honouring their data subject requests — access, correction, deletion, and so on. You can export, edit, or delete student records from inside your workspace at any time. FlowBridge will assist you where reasonably necessary.

8. Retention

• Active workspaces: data is retained for as long as the subscription is active.
• After cancellation: a 90-day read-only window during which you can re-subscribe and restore access, or request a data export. After 90 days, the workspace and its data are permanently deleted.
• Tutor-controlled retention: you can set your own retention windows for messages, progress notes, and recording metadata from Settings → Data retention, subject to safe defaults.

9. Security

• All traffic to Chalkline is encrypted with TLS.
• Secrets (OAuth tokens, payment processor keys, webhook secrets) are encrypted at rest.
• Engineering access is least-privilege and audited.
• Tenant isolation is enforced at the application layer and validated by an automated cross-tenant test suite.
• No security model is perfect. If you believe you have found a vulnerability, please email privacy@mychalkline.com so we can investigate and fix it.

10. Cookies

Chalkline uses session cookies that are required for authentication. We do not use advertising cookies or cross-site tracking cookies.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to the workspace owner at least 14 days before they take effect. Non-material changes are reflected in the “Last updated” date.

12. Contact

Privacy questions or data subject requests: privacy@mychalkline.com.

Operator: FlowBridge Systems (Pty) Ltd, a company registered in South Africa.