Privacy Policy

1. Who this applies to

This Privacy Policy explains how CAPSKit (a South African concern) handles personal information when you use capskit.co.za or any tool linked from it. It applies to every visitor and user, regardless of where you're based.

CAPSKit is the responsible party for the personal information described in this policy under South Africa's Protection of Personal Information Act (POPIA).

2. What information we collect

Information you give us

• Name and email address, when you choose to use the prompt generator, we ask for your name and email once. Your name is used to personalise the experience; your email is used to sign you in via magic links and to save your prompts to your account. You can then use CAPSKit on this device and any other device, by clicking a magic-link sign-in email we send you.
• Newsletter opt-in, when you submit your email, you can opt in to receive occasional product updates. This is optional and separate from using the tool.
• Messages you send us, if you email us at we'll keep the email so we can reply.

Information collected automatically

• Technical data, when you visit, your browser sends standard information (IP address, browser type, device type, referring page, pages visited, time on page). Our hosting provider and analytics tools see this.
• Cookies and similar technologies, see Section 4 below.

Information we do NOT collect

We don't collect school details, learner data, payment information, or any sensitive personal information through the prompt builder. Whatever content you type into the builder's "extra topic" or "additional instructions" fields stays local to your browser session unless you submit a final prompt, in which case the prompt-generation request, including your typed text, is processed on our server and not stored beyond what's needed to send you the result.

3. How we use it

We use the information we collect to:

• Run the prompt builder, recognise you as a returning user, send magic-link sign-ins, generate prompts in response to your selections
• Improve the tool, understand which features teachers use, fix bugs, plan improvements (using anonymous analytics data)
• Communicate with you, reply to your emails; send newsletter updates if you opted in; send important service notices (e.g. major changes to terms)
• Show advertising, display ads (including third-party network ads like Google AdSense) to help fund the service, only if you've consented to advertising cookies
• Keep things secure, detect abuse, automated scraping, security incidents
• Meet legal obligations, respond to lawful requests from authorities, comply with applicable law

We never sell your personal information to anyone.

4. Cookies and tracking

We use three categories of cookies and similar local-storage techniques:

• Essential, these keep CAPSKit working. They remember your selections inside the prompt builder, your cookie banner choice, and your sign-in state. They cannot be turned off because the tool wouldn't work without them.
• Analytics (optional), anonymous data about which steps teachers complete and which features they use most. Helps us improve the tool.
• Advertising (optional), set by third-party networks like Google AdSense to help show relevant ads. Helps fund CAPSKit so it stays free.

You can change your cookie choices at any time by clicking "Manage cookies" in the banner that appears on your first visit, or by clearing your browser's cookies for capskit.co.za.

5. Who we share it with

We share the minimum personal information needed with the following sub-processors:

Sub-processor	Purpose	Region
Rackzar	Hosting infrastructure (web server, database)	South Africa (Cape Town)
Brevo	Sending magic-link sign-in emails and other transactional email	United States
Google AdSense (when enabled)	Serving advertising	United States
Cloudflare (if enabled)	CDN, DDoS protection, performance	Global (with EU/SA edge nodes)

Other than the sub-processors listed above, we do not share your personal information with third parties unless required by law or to protect CAPSKit, our users, or the public from harm.

6. Cross-border data transfers

Some of the sub-processors above are based outside South Africa (notably Brevo and Google in the United States). When we share your personal information with them, we rely on:

• Their published data-protection commitments and standard contractual safeguards
• The fact that you have consented to use a service operated using these third parties (by accepting these terms and continuing to use the tool)

This is permitted under POPIA where the receiving party is subject to laws or contractual safeguards that uphold the principles of reasonable protection.

7. How long we keep data

• Email addresses, kept while your account is active and for up to 24 months after last activity, then deleted automatically
• Magic-link tokens, expire after 24 hours; expired tokens are purged daily
• Analytics data, anonymous aggregates kept indefinitely; raw event logs kept up to 26 months
• Email correspondence, kept up to 36 months for support and reference, then deleted
• Server logs, kept up to 90 days for security and debugging, then automatically purged

You can ask us to delete your data sooner, see Section 8.

8. Your rights under POPIA

POPIA gives you the following rights over your personal information:

• Right to know what personal information we hold about you
• Right to access your personal information and obtain a copy
• Right to correct any inaccurate personal information
• Right to delete your personal information (subject to limited exceptions, like retention required by law)
• Right to object to certain processing, including direct marketing
• Right to complain to the Information Regulator if you believe we've handled your information improperly

To exercise any of these rights, email with the request. We aim to respond within 30 days.

The Information Regulator's website is inforegulator.org.za.

9. Children's data

CAPSKit is a tool for educators, not learners. We don't knowingly collect personal information from children under 18. If you're a teacher generating papers for learners, please do not include learner names, ID numbers, or other personal information about learners in the "extra topic" or "additional instructions" fields, that information would otherwise be processed by our AI providers, which we can't control on your behalf.

If you believe we've inadvertently collected information from a child, contact us and we'll delete it.

10. Security

We protect your personal information using reasonable measures, including:

• HTTPS encryption for all traffic between your browser and CAPSKit
• Encrypted database storage at the hosting layer
• Limited admin access to the database, secured with key-based authentication
• Regular security patching and dependency updates

No system is perfectly secure. If a breach affects your personal information in a way that creates a real risk of harm, we'll notify you and the Information Regulator as required by POPIA.

Google Analytics 4 (GA4): we use Google Analytics to understand aggregated, anonymous usage patterns (page views, traffic sources). IP addresses are anonymised and we do not enable Google ads tracking. Analytics fires from page load (legitimate interest); enhanced behavioural events fire only after you accept analytics cookies via the banner.

11. Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we'll update the "Effective" date at the top and notify you in a reasonable way (in-product notice, or email if you've given us one).

12. Contact and Information Officer

For any privacy questions or to exercise your POPIA rights:

• Email:
• Information Officer: The owner of CAPSKit acts as Information Officer for v1. The Information Officer is responsible for ensuring CAPSKit complies with POPIA.

If you're not satisfied with our response, you can lodge a complaint with the Information Regulator at inforegulator.org.za.

Thanks for taking the time to read this. We try to keep things simple and ask for as little as possible.