Privacy Policy

1. Who does what (POPIA roles)

Under the Protection of Personal Information Act (POPIA), each school or ECD centre using Huddles is the responsible party: it decides which children's information is recorded, for what purpose, and who may see it. Huddles is the operator: we process that information on the school's behalf and instructions, and we protect it as POPIA requires of an operator.

Practically, this means questions or requests about the information itself — access, correction, deletion — go to your school first. We support the school in carrying them out, and you can always reach us at support@huddles.co.za.

2. What is stored

• Learner information, provided by the school and parents: name, date of birth, class, emergency contacts, allergies and medical details, medical aid details.
• Daily records created by staff: attendance, meals, bottles, nappies, naps, activities, incidents, medicine given, and general notes — each stamped with the time and the staff member who logged it.
• Account information for staff and parents: name, email address and role.
• Files a school uploads, such as compliance documents, sick notes or activity attachments.
• Technical diagnostics: basic error and crash reports so we can fix problems (see section 5).

3. Where it is stored

Huddles runs on Google Firebase (Cloud Firestore, Storage and Authentication), encrypted in transit and at rest. Google's cloud infrastructure may store data in data centres outside South Africa; such transfers are protected by Google's contractual safeguards and security certifications, as POPIA requires for cross-border processing. Entries made offline are held on the staff member's device until they sync, and cached data is cleared from a device at sign-out.

4. Who can see what

• Teachers see the learners in their care.
• Principals and school admins see their school.
• Parents see their own child only — linked by the school, never self-registered.
• Huddles: a very small number of technical staff can access data strictly for support, maintenance and security, on the school's instructions.

These boundaries are enforced by server-side security rules, not just by what the app shows.

5. Services we rely on

• Google Firebase — authentication, database, file storage.
• Google reCAPTCHA — protects the service against automated abuse.
• Sentry — receives technical error reports (what went wrong in the code), not children's records.

There are no advertising networks and no third-party marketing trackers in Huddles, and we never sell personal information to anyone.

6. Retention and deletion

The school decides how long records are kept, in line with its own ECD record-keeping obligations. When a school stops using Huddles, its data is deleted on request. Individual records can be corrected or removed by the school at any time.

7. Your rights

Under POPIA you may ask what personal information is held about you or your child, and ask for it to be corrected or deleted. Contact your school first (it is the responsible party), or email support@huddles.co.za and we will help route the request. You also have the right to complain to the Information Regulator of South Africa (inforegulator.org.za).

8. Children

Huddles holds information about children because that is what safe childcare record-keeping requires — but children do not use Huddles themselves. Children's information is provided and controlled by their school and parents, under the school's authority as responsible party.

9. Changes and contact

If we change this policy, the date above changes with it and schools are told about material updates. Questions, concerns or requests: support@huddles.co.za.