Privacy policy.

Luthando App is used by children. That shapes every decision on this page — what we collect, where we keep it, and who is allowed near it.

Effective 21 August 2026 · Version 1.0

1. Who is responsible for your information

Luthando App is published by Navario, a South African company ("Luthando", "the Institution", "we", "us"). For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), Navario is the responsible party for the personal information described in this policy.

This policy covers the Luthando App mobile application, the website at luthandoapp.co.za, the Luthando Portal at portal.luthandoapp.co.za, and the live class and marketplace services we provide through them.

2. What we collect, and why

When you create an account

Your name, email address and cellphone number, and a password we never store in readable form. Depending on the kind of account, we may also collect a date of birth, gender, nationality, home language and the languages you want to learn, a profile picture, and how you heard about us.

When a parent adds a child

The child's first name, date of birth or grade, and the languages they are learning. We ask for the least we can and still teach well. A school name is collected only where a school affiliation code is used, so the discount can be applied.

When you learn

Which lessons, stories and games have been opened and completed, scores and points, and progress through a category. This is what makes a progress report possible and lets a learner pick up where they left off.

When you join a live class

The classes booked, attended and cancelled, and the audio and video of the session itself while it is running. Live classes run on Luthando Live, our own meeting service on our own servers — they are not routed through Zoom, Google Meet or any similar third party. Sessions are not recorded unless the educator tells the class they are recording it and the recording is stored for the learners in that class.

When you pay

What you bought, when, for how much, and a reference for the transaction. Card numbers never reach us. Payments are processed by Paystack, who collect card details directly on their own secure page. We receive confirmation that a payment succeeded, not the card.

When you teach or sell

Educators and sellers provide identity and qualification documents, banking details for payouts, and business registration where they have one. These are described in the Terms of Use. Banking details are held so that we can pay you, and are shared with Paystack to create the payout account that money settles into.

Technical information

Device type and operating system, app version, an IP address, and error reports when something breaks. We use this to keep the service working and to investigate abuse, not to build a profile of you.

3. Children's information

POPIA treats the personal information of a child as special. So do we.

• A child's account is opened by a competent person — a parent or legal guardian — who consents to our processing of the child's information on their behalf.
• Social features start switched off. Messaging, comments, video uploads, live-session chat and media sharing are disabled by default on a child's profile. A parent turns on only what they want, and can turn it off again at any time.
• Contacts are approved, not open. Where messaging is enabled, a child communicates only with contacts a parent has approved.
• Educators are vetted. Every educator submits identity and qualification documents, and an administrator checks them by hand before that educator may teach. Uploading a document does not grant access on its own.
• No advertising profiles. We do not use a child's information for targeted advertising, and we do not sell or share it with advertisers.

A parent may see, correct or delete their child's information at any time by writing to info@luthandoapp.co.za.

4. Our lawful basis for processing

We process personal information where:

• it is necessary to deliver what you asked for — running your lessons, taking your booking, delivering your order;
• you have consented, such as a parent consenting on behalf of a child, or your choosing to receive marketing email;
• it is required by law, such as keeping tax and payment records; or
• it serves a legitimate interest that does not override your rights — keeping the platform secure, preventing fraud, and protecting children on it.

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not undo processing that already lawfully happened.

5. Who else sees your information

We do not sell personal information. We share it only with the operators below, only to the extent each one needs, and under an obligation to protect it:

A seller sees only the lines of an order that belong to their own store. They never see what another store sold to the same buyer.

We may also disclose information where the law requires it, or where it is necessary to protect a child, a person's safety, or our legal rights.

6. Where your information is kept

Luthando runs on servers located in South Africa. Your account, your child's progress, your orders and your live classes are stored and processed here, in the Republic.

Two of the operators above — Google and the app stores — are international, and information sent to them may be processed outside South Africa. Where that happens, section 72 of POPIA applies, and we rely on those operators' own binding data protection commitments. Paystack processes South African card payments in the region.

7. How long we keep it

• While your account is open, we keep what is needed to run it.
• After you close your account, we delete or de-identify your personal information, except records we are obliged to keep.
• Payment and tax records are kept for five years, as South African tax law requires.
• Safety records — a report of harm to a child, for example — may be kept longer where that is necessary to protect someone.

8. How we protect it

• Traffic between your device and Luthando is encrypted in transit (HTTPS).
• Sensitive fields — names, phone numbers, dates of birth — are encrypted at rest in our database.
• Passwords are stored as one-way hashes. Nobody at Luthando can read your password.
• Card details never touch our servers.
• Access to personal information is limited to staff who need it for their work.

No system is perfectly secure. If a breach occurs that creates a real risk to you, we will notify you and the Information Regulator as POPIA requires.

9. Your rights

Under POPIA you have the right to:

• Know what personal information we hold about you, and ask for a copy.
• Correct information that is wrong, misleading or out of date.
• Delete information we no longer have grounds to keep.
• Object to processing based on legitimate interest.
• Withdraw consent you previously gave.
• Stop marketing — unsubscribe from any marketing email, or change it in your profile. Service messages about your account, classes or orders will continue.
• Complain to the Information Regulator.

To delete an account or specific data, use luthandoapp.co.za/delete-account or luthandoapp.co.za/delete-data, or write to us. We action requests within 30 days. We may ask you to confirm who you are first, so that nobody else can request your data.

10. Cookies and similar technologies

This website uses browser storage to keep you signed in and to remember your shopping basket between visits. These are necessary for the site to work — we do not use advertising or cross-site tracking cookies on luthandoapp.co.za.

11. Changes to this policy

When we change this policy we will update the effective date above. If a change materially affects how we handle your information — or your child's — we will tell you in the app or by email before it takes effect.