Privacy Policy

This Privacy Policy explains how CLEVERLY ZA (PTY) LTD ("Cleverly", "we", "us" or "our") collects, uses, processes, stores, protects and discloses personal information when you access or use the Cleverly platform, website, applications and related services (collectively, the "Platform").

Cleverly provides AI-assisted educational assessment and grading services to educators, schools, educational institutions and other authorised users.

This Privacy Policy applies to:

• educators and other Platform users;
• schools and educational institutions;
• students whose information is uploaded to the Platform by authorised users;
• website visitors;
• prospective customers;
• customers and subscribers;
• individuals who communicate with Cleverly; and
• personal information contained in assessments, assignments and other educational materials submitted to the Platform.

Cleverly is committed to protecting personal information and processing it responsibly and in accordance with applicable data protection laws, including the Protection of Personal Information Act 4 of 2013 ("POPIA").

Cleverly primarily operates in South Africa and is committed to complying with POPIA and applicable regulations made under POPIA.

Depending on the circumstances and the jurisdiction in which services are provided, other data protection laws may also apply.

Where applicable, Cleverly may take reasonable steps to comply with other data protection requirements, including foreign data protection laws where those laws apply to our processing activities.

This Privacy Policy should be read together with Cleverly's Terms and Conditions and any applicable agreements entered into between Cleverly and an educational institution or other customer.

The role Cleverly performs will depend on the nature and purpose of the relevant processing.

In relation to student information uploaded to the Platform by educators, schools or educational institutions, Cleverly will generally act as an Operator under POPIA.

The relevant educator, school or educational institution will generally act as the Responsible Party.

Cleverly processes such information primarily to provide the Platform and related services on behalf of the Responsible Party.

Cleverly will:

• process personal information in accordance with applicable instructions;
• maintain appropriate confidentiality obligations;
• implement reasonable technical and organisational security measures;
• process information only for authorised purposes; and
• assist the Responsible Party where reasonably required to fulfil applicable data protection obligations.

In certain circumstances, Cleverly may act as a Responsible Party in its own right.

This may include processing relating to:

• user account administration;
• customer and business relationship management;
• billing and subscriptions;
• website operation;
• marketing communications where permitted;
• security and fraud prevention;
• legal and regulatory compliance;
• customer support; and
• management of Cleverly's own business records.

Cleverly may collect and process the following categories of personal information.

When you create or use a Cleverly account, we may collect:

• full name;
• email address;
• telephone number;
• institution or organisation name;
• job title or educational role;
• username;
• login credentials;
• authentication information;
• billing information;
• VAT information where applicable;
• account preferences;
• subscription information; and
• communications with Cleverly.

Educators and institutions may upload assessment information to the Platform.

This may include:

• student names;
• student numbers or examination numbers;
• written or typed answers;
• handwritten assessment scripts;
• assignments;
• examination papers;
• marking memoranda;
• rubrics;
• marks;
• feedback;
• academic performance information;
• grading history; and
• other information contained within submitted educational materials.

Cleverly does not determine which student information an educator or institution chooses to upload.

Users should avoid uploading unnecessary personal information where it is not required for the intended grading or educational purpose.

Educational submissions may, in some circumstances, incidentally contain special personal information, including information relating to:

• health;
• religion;
• political views;
• race or ethnicity;
• criminal behaviour; or
• other categories protected under applicable law.

Cleverly does not intentionally require users to submit special personal information unless it is necessary for a legitimate educational purpose.

Where such information is contained in an uploaded assessment, Cleverly processes it only to the extent reasonably necessary to provide the Platform or comply with applicable legal obligations.

The Responsible Party remains responsible for ensuring that it has a lawful basis and appropriate authority for uploading such information.

When you access the Platform, we may automatically collect information such as:

• IP address;
• device information;
• browser type;
• operating system;
• access times;
• login activity;
• session information;
• pages or features accessed;
• system events;
• error logs;
• audit logs; and
• security events.

We use this information to operate, secure, maintain and improve the Platform.

Payments may be processed through third-party payment providers.

Cleverly may receive and retain information such as:

• billing name;
• billing address;
• transaction references;
• subscription plan;
• payment status;
• VAT information; and
• limited payment-related information supplied by the payment provider.

Cleverly does not intentionally store full payment card numbers or CVV security codes.

Payment information may be processed directly by third-party payment providers under their own privacy policies and security standards.

If you contact Cleverly, we may process:

• emails;
• support tickets;
• correspondence;
• screenshots;
• uploaded diagnostic information;
• technical information; and
• other information you voluntarily provide.

This information is used to provide support, investigate issues and improve the Platform.

Cleverly may receive personal information from third parties where reasonably necessary to provide or operate the Platform.

These parties may include:

• payment service providers;
• cloud hosting providers;
• authentication providers;
• educational institutions;
• business partners;
• integration providers; and
• service providers supporting Cleverly's operations.

We will process such information in accordance with applicable law and this Privacy Policy.

Cleverly may process personal information for the following purposes:

• providing AI-assisted grading services;
• processing assessment submissions;
• analysing handwritten and typed responses;
• comparing responses against marking memoranda and rubrics;
• generating suggested marks;
• generating feedback and grading commentary;
• providing educational analytics;
• maintaining user accounts;
• authenticating users;
• processing subscriptions and payments;
• providing customer support;
• communicating with users;
• maintaining and improving the Platform;
• monitoring system performance;
• detecting and preventing fraud and abuse;
• protecting the security of the Platform;
• investigating security incidents;
• complying with legal obligations;
• enforcing contractual rights; and
• establishing, exercising or defending legal claims.

Cleverly will not process personal information for purposes that are incompatible with the purpose for which it was collected unless permitted or required by applicable law.

Cleverly uses artificial intelligence and machine-learning technologies to provide its grading and educational functionality.

AI systems may be used to:

• analyse assessment responses;
• interpret handwritten or typed responses;
• compare responses against marking criteria;
• generate suggested marks;
• generate feedback;
• identify patterns in assessment performance; and
• produce educational analytics.

AI-generated results may be probabilistic and may not always be correct.

Cleverly's Platform is intended to assist educators. Educators remain responsible for reviewing and making final academic grading decisions where appropriate.

Cleverly does not intend for its AI systems to independently make legally binding decisions about students.

Cleverly may use aggregated, statistical or appropriately de-identified information to improve:

• grading accuracy;
• handwriting recognition;
• system performance;
• reliability;
• security; and
• Platform functionality.

Cleverly does not sell identifiable student information for AI model training.

Cleverly does not intentionally use identifiable student personal information to train external public AI models for purposes unrelated to providing the Platform.

Where personal information is required to operate the Platform, it will be processed only for authorised service-related purposes.

Cleverly processes personal information in accordance with the conditions for lawful processing under POPIA, including:

• accountability;
• processing limitation;
• purpose specification;
• further processing limitation;
• information quality;
• openness;
• security safeguards; and
• data subject participation.

Depending on the circumstances, Cleverly's processing may be based on:

• performance of a contract;
• compliance with a legal obligation;
• legitimate interests where permitted;
• consent where required; or
• another lawful basis permitted under applicable law.

Cleverly seeks to limit the personal information processed to information reasonably necessary for the relevant purpose.

Educators and institutions are encouraged to:

• avoid uploading unnecessary personal identifiers;
• avoid uploading information unrelated to grading;
• use appropriate access controls; and
• remove unnecessary personal information from documents where reasonably practicable.

Cleverly may disclose personal information to carefully selected service providers where reasonably necessary to operate the Platform.

These may include:

• cloud hosting providers;
• data storage providers;
• AI and technology service providers;
• security providers;
• authentication providers;
• payment processors;
• backup and disaster recovery providers;
• IT service providers;
• professional advisers;
• auditors; and
• legal advisers.

Where Cleverly acts as an Operator, such providers may process personal information on Cleverly's behalf subject to appropriate contractual and confidentiality requirements.

Cleverly does not sell, rent or trade personal information.

Cleverly may disclose personal information where reasonably necessary or required to:

• comply with applicable law;
• comply with a court order;
• respond to lawful requests from government authorities;
• protect the rights, property or safety of Cleverly or another person;
• investigate fraud or unlawful activity; or
• establish, exercise or defend legal claims.

Where legally permitted, Cleverly will take reasonable steps to notify the relevant customer or Responsible Party before making a disclosure.

If Cleverly is involved in a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, personal information may be transferred as part of that transaction.

Any such transfer will remain subject to applicable confidentiality and data protection obligations.

Cleverly may use cloud infrastructure, technology providers or other service providers located outside South Africa.

Where personal information is transferred outside South Africa, Cleverly will take reasonable steps to ensure that the transfer is permitted under applicable law, including POPIA.

Where applicable, cross-border transfers may be based on an adequate level of protection, contractual safeguards, consent, contractual necessity or another lawful basis recognised by POPIA.

POPIA places specific requirements on transfers of personal information outside South Africa.

Cleverly retains personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention may be necessary to:

• provide the Platform;
• maintain customer accounts;
• fulfil contractual obligations;
• maintain security and audit records;
• comply with tax, accounting and legal requirements;
• resolve disputes;
• investigate security incidents; or
• establish, exercise or defend legal claims.

Different categories of information may therefore be retained for different periods.

When an account is terminated or a subscription expires:

• access to the Platform may be suspended or terminated;
• customers may be required to export information before termination;
• information may remain temporarily in operational systems;
• information may remain in encrypted backups for a limited period; and
• information may be retained where required by law or reasonably necessary for legitimate business purposes.

Backup copies may be automatically overwritten in accordance with Cleverly's backup and disaster recovery procedures.

Cleverly takes reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• damage;
• alteration; and
• unauthorised disclosure.

These measures may include:

• secure cloud infrastructure;
• encryption in transit;
• access controls;
• authentication controls;
• role-based permissions;
• confidentiality obligations;
• logging and monitoring;
• security testing;
• vulnerability management;
• backup and recovery procedures; and
• incident response procedures.

POPIA requires appropriate safeguards to protect the integrity and confidentiality of personal information.

No electronic system can be guaranteed to be completely secure. Users should therefore also take reasonable steps to protect their accounts and login credentials.

Cleverly maintains procedures for identifying, investigating and responding to suspected security compromises.

If Cleverly becomes aware of a security compromise affecting personal information processed on behalf of a Responsible Party, Cleverly will take reasonable steps to:

• investigate the incident;
• contain and mitigate the incident;
• protect affected information;
• notify the relevant Responsible Party as required;
• cooperate with the Responsible Party's investigation; and
• take reasonable steps to prevent recurrence.

Under POPIA, an Operator must notify the Responsible Party if it has reasonable grounds to believe that a security compromise has occurred.

Where Cleverly is itself the Responsible Party, Cleverly will comply with its applicable notification obligations under POPIA.

Cleverly may use cookies and similar technologies to operate and secure the Platform.

These may include:

• session cookies;
• authentication cookies;
• security cookies;
• load-balancing technologies; and
• analytics or performance technologies.

Cleverly does not intend to use cookies for third-party behavioural advertising.

You may configure your browser to block or delete cookies. However, doing so may affect certain Platform functionality.

Cleverly is primarily designed for educators, schools and educational institutions and is not intended to require students to independently create accounts for the purpose of submitting personal information.

However, the Platform may process information relating to students, including minors, where such information is uploaded by an authorised educator or institution.

Where Cleverly acts as an Operator, the relevant educational institution or educator is responsible for:

• determining the lawful basis for processing;
• providing appropriate privacy notices;
• obtaining consent where required;
• complying with applicable requirements relating to children's information; and
• ensuring that uploaded information is lawfully collected and processed.

If Cleverly becomes aware that children's personal information has been unlawfully submitted, Cleverly may take reasonable steps to investigate and, where appropriate, restrict or delete the information.

Subject to applicable law, data subjects may have rights to:

• request access to personal information;
• request confirmation that personal information is being processed;
• request correction of inaccurate or incomplete information;
• request deletion or destruction where legally permitted;
• object to certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the Information Regulator.

POPIA recognises data-subject participation rights and provides mechanisms for correction, deletion, objection and complaints.

Where Cleverly processes student information on behalf of a school, institution or educator, Cleverly will generally direct data-subject requests to the relevant Responsible Party.

For example, a student or parent/guardian may need to contact the relevant school or institution where that organisation determines the purposes and means of processing the student's information.

Cleverly will reasonably assist the Responsible Party in responding to valid requests where required under applicable law or contractual arrangements.

Cleverly may request reasonable information to verify the identity of a person making a privacy request.

The Platform may rely on third-party services for functions such as:

• cloud hosting;
• payments;
• authentication;
• analytics;
• security;
• communications;
• infrastructure;
• backup; and
• other technical services.

Third-party providers may process personal information in accordance with their own contractual obligations and privacy policies.

Where appropriate, Cleverly will take reasonable steps to ensure that service providers processing personal information on its behalf provide appropriate confidentiality and security protections.

Users are responsible for:

• keeping login credentials confidential;
• using appropriate account security;
• ensuring they have authority to upload information;
• ensuring information uploaded to Cleverly has been lawfully obtained;
• avoiding unnecessary personal information in uploaded materials; and
• promptly reporting suspected unauthorised access or security incidents.

Educational institutions and educators remain responsible for the lawful collection and use of student information where they act as the Responsible Party.

Cleverly may send service-related communications necessary to operate the Platform, including:

• account notifications;
• security notifications;
• billing communications;
• service updates; and
• important administrative notices.

Where Cleverly sends direct marketing communications, it will do so in accordance with applicable law.

Users may unsubscribe from marketing communications where an unsubscribe mechanism is provided.

Cleverly may update this Privacy Policy from time to time to reflect:

• changes to the Platform;
• changes to our processing activities;
• changes in applicable law;
• regulatory developments; or
• changes to our business operations.

The updated Privacy Policy will be published on https://cleverly.co.za.

The "Last Updated" date at the top of this Privacy Policy will indicate when the policy was most recently revised.

Where required by law, Cleverly will provide additional notice or obtain consent for material changes.

If you have questions about this Privacy Policy, wish to make a privacy request, or wish to raise a concern about the processing of personal information, please contact Cleverly:

• CLEVERLY ZA (PTY) LTD
• Registration Number: 2026/071882/07
• 22 Sloane Street, Bryanston, Sandton, 2191, South Africa
• WhatsApp: +27 68 016 2753
• Website: https://cleverly.co.za

If you believe that your personal information has been processed unlawfully or that your rights under POPIA have been infringed, you may lodge a complaint with the Information Regulator of South Africa.

The Information Regulator is responsible for monitoring and enforcing compliance with POPIA.

The Information Regulator's current contact information includes:

• Information Regulator
• Woodmead North Office Park
• 54 Maxwell Drive
• Woodmead, Johannesburg, 2191, South Africa
• Email: enquiries@inforegulator.org.za
• Telephone: 010 023 5200

The Information Regulator provides a formal process for POPIA complaints.

© 2026 CLEVERLY ZA (PTY) LTD. All rights reserved.