Vinky Privacy Policy

Last updated: 2 November 2026

Vinky is built to help families revise calmly and consistently. Protecting the information of parents and children is part of providing that service. This policy explains which personal information we use, why we use it, who can see it, how we safeguard it and what you can ask us to do.

This policy is governed by South Africa’s Protection of Personal Information Act, 2013 (POPIA). It applies to our website, the Vinky Parent App, Vinky LevelUp and related account, payment and support services.

1. Who is responsible for your information?

Vyncora (Pty) Ltd, registration number 2026/367938/07, operates Vinky and is the responsible party for the personal information described in this policy.

Registered Information Officer: Natasha Vink (Information Regulator registration 2026-069799, registered 20 October 2026). You can contact her at vinkyrecap@gmail.com. Our full legal and contact details are in section 14.

2. Whose information do we process?

We process relevant information about adults who visit the website, sign up for a Parent App account, are invited into a family role, contact us or make a purchase. We also process information about children whose profiles are created by an adult with the appropriate authority and who use Vinky LevelUp. We may hold business-contact information about our service providers, contractors and advisers.

Children do not need to create an email-and-password account to use Vinky LevelUp. The adult account, family permissions and device-pairing rules determine which child profile can be accessed.

3. Information we collect

Adults and account holders

We collect the information needed to run and protect an account, including:

• Name, surname, email address, South African province, optional mobile number and any chosen parent label.
• Account relationship or role and invitations, where family sharing is available.
• A password hash (not a readable password), account-verification information, sign-in and security events.
• Acceptance or acknowledgement records: the relevant terms/notice version, date and time, and the recorded authority/consent when a child is added.
• Revision-plan choices, reward preferences, account settings, support messages and relevant notifications.
• Session cookies, locally stored app settings, device and connection identifiers needed for the service, security and device pairing.

We use an optional mobile number for account contact and support where appropriate. We do not require it for a normal child revision session.

Children

When an authorised adult adds a child and the child uses Vinky, we process relevant details such as:

• First name, optional surname, date of birth, grade, optional school and chosen pronouns or wording.
• Assigned subjects and topics, planned revision, answers, marking, first attempts, retries, dates, scores, progress and learning patterns needed to explain results and support further revision.
• Family-selected rewards and related progress.
• Child profile selection, paired-device association and technical activity necessary to deliver revision securely.

Vinky’s ordinary revision flow does not require a child to provide a personal email address, upload a photograph or share precise GPS location. We do not sell children’s information or use it to target children with advertising.

Payments and access

We may retain details of the chosen access option, children on the plan, current and past prices, discounts, vouchers, trial use, payment amounts and dates, payment outcomes, renewals, cancellations, refunds, payment references and the limited records needed for accounting and disputes. Our payment provider, PayFast, handles payment-card details. Vinky does not keep full payment-card numbers or card security codes; it may retain a PayFast-issued token or reference needed for an authorised recurring payment.

Website visits and contact

When you visit our website, technical systems may process your IP address, browser/device data, basic site-performance or security events and information stored through necessary cookies or local storage. If we enable optional analytics, we use it to understand website use and improve the site under the applicable privacy rules. The website will provide any consent or settings required for the tracking technologies actually used.

If you contact us by email, a website form or a messaging service, we receive the contact details and message you choose to send. Please do not include a child’s sensitive information unless it is relevant to your request, or send passwords or complete payment-card details.

Website visitors and analytics

Nothing is measured until you say yes. Our marketing website at vinky.co.za loads no analytics script, sets no analytics cookie and sends nothing to a third party until you accept the small banner asking whether we may count visits. If you decline, or ignore the banner, no analytics cookie is placed and nothing about your visit is sent anywhere.

If you accept, we use Google Analytics 4 (provided by Google Ireland Limited and Google LLC) to understand which pages help parents. It records the page you viewed, the site or search that referred you, the country-level area derived from your network connection, your browser and device type, and actions such as playing a video or clicking a trial or WhatsApp button. Google Analytics 4 does not log your IP address. The cookies it uses are named _ga and _ga_<identifier>, and last up to two years unless your browser clears them.

Our website analytics deliberately excludes personal information. We do not send a name, email address, phone number, child name, grade, school, answer, mark or any learning activity to Google Analytics, because the marketing website cannot see any of it: child and learning information exists only inside the Vinky Parent App, behind your sign-in. You can change or withdraw your choice at any time using Cookie settings in the footer of any page. Withdrawing stops the measurement and removes the analytics cookies.

Our hosting provider keeps ordinary web-server logs, including IP addresses, for security, abuse prevention and diagnostics. Those records exist whether or not you accept analytics, and are described in sections 8 and 9.

4. Why we use this information

We use personal information, only to the extent reasonably necessary and lawful, to:

• create and manage adult and child profiles, establish authorised family access and connect devices;
• deliver and mark revision, show progress, maintain learning history and support family-selected rewards;
• provide vouchers, trials, access plans and authorised payments, including receipts, billing support and disputes;
• operate our website and apps, secure accounts, detect faults and prevent unauthorised use;
• respond to enquiries, privacy requests and complaints;
• meet legitimate legal, financial, audit and regulatory obligations; and
• improve Vinky through appropriate, lawful analysis and genuinely de-identified information where practicable.

Adult processing may rely on contractual necessity, legal obligations, consent and other grounds allowed by POPIA. For the ordinary processing of a child’s personal information, Vinky relies on the permission of a competent person, usually the child’s parent or legal guardian, or another basis specifically permitted by POPIA.

5. Parental authority and consent

Before creating a child profile, the adult adding the child confirms that they have the legal authority to do so and expressly authorises Vinky to process that child’s information as described here. Vinky records that confirmation, when it was made and the version of this notice presented. If we allow additional authorised adults to share a family’s account, their access is limited to the permissions granted to them.

If you believe a child was added without proper authority, or want to withdraw consent, contact vinkyrecap@gmail.com. We may ask for reasonable proof of identity or authority before changing or disclosing a child’s information. Withdrawal of consent does not automatically require deletion of records we must lawfully retain, and may affect the ability to continue providing the service.

6. Who may access or process information?

Personal information is accessible only to people and organisations with an appropriate reason to use it. They may include:

• the authorised parent/guardian and other invited adults whose family roles permit access;
• authorised Vyncora administrators and technical/support personnel, subject to access controls;
• infrastructure and security providers who host or protect the website, apps and databases;
• email, notification, website-form and messaging providers used to communicate with you;
• Google Analytics 4 (Google Ireland Limited, with processing in the European Union and the United States) for website-visitor statistics, and only where the visitor has accepted it;
• PayFast to process authorised payments, payment tokens, refunds and payment notifications;
• an off-site backup provider holding protected recovery copies;
• professional advisers and public authorities where necessary or legally required.

Our app infrastructure is designed for the Domains.co.za cloud VPS environment. Website hosting, optional website forms and analytics, email delivery, and off-site backup facilities are provided through the services Vyncora selects and configures for launch. We use service providers subject to appropriate contractual, access-control and data-protection requirements. A current list of material operators and the processing locations relevant to your request can be obtained through our Information Officer.

We do not sell personal information. We do not use children’s information for advertising, and we do not allow vendors to use Vinky child records for their own marketing.

7. Transfers outside South Africa

Some necessary services, such as email delivery, website infrastructure, security or off-site backup, may involve processing outside South Africa. Where information is transferred across borders, Vyncora takes steps to ensure a lawful basis under POPIA section 72, including appropriate contractual or other safeguards where required. A proposed transfer of children’s information or special personal information to a recipient in a country without adequate protection will not proceed unless any applicable section 57 prior-authorisation requirement has been dealt with.

8. How we protect information

We apply reasonable technical and organisational safeguards, including secure encrypted connections, password hashing, session and device-access controls, restricted administrator permissions, logging and incident-response measures. Our recovery arrangements use encrypted off-site backups, access restrictions, defined retention and scheduled restoration checks. Protected backup copies are used for disaster recovery, not as an ordinary way for other users to browse child information.

No internet service can promise absolute security. If we reasonably believe personal information has been accessed or acquired by someone who is not authorised, we investigate and notify affected people and the Information Regulator where POPIA section 22 requires it.

9. How long we keep information

We keep personal information only for as long as it is reasonably needed to provide Vinky or to meet a lawful record-keeping, security, accounting or dispute-related obligation.

We do not promise that every historical, financial or backup record disappears at the instant someone presses Delete account. If a record must be retained, we restrict its use to the applicable lawful purpose.

10. Your rights and choices

Subject to POPIA and PAIA, you can ask us whether we hold your or your child’s information, request access or correction, object to processing where permitted, withdraw consent where that is the lawful basis, or request deletion. We may need to verify identity and legal authority before acting, especially for a child or shared family account.

You can use Settings → Your profile → Delete account to request account deletion, and Settings → Children for ordinary profile management. Remove from plan, Remove from Vinky and Delete account are different actions and have different consequences. If you need specific child records erased, or have a question about an archived child or a shared family, email the Information Officer.

Where we rely on your consent, such as website analytics, you can withdraw it at any time using Cookie settings in the footer. Withdrawing does not affect processing carried out before the withdrawal.

Our PAIA Manual explains how to request access to records and identifies the relevant request form.

11. Messages and marketing

We send necessary account, security, revision, access, payment and service communications. These are different from promotional marketing. Where we send direct electronic marketing to adults, we do so only in circumstances allowed by POPIA and provide a practical method to object or unsubscribe. Children’s personal information is not used for targeted advertising.

12. Complaints

You may contact Natasha Vink, Information Officer, at vinkyrecap@gmail.com. You also have the right to approach South Africa’s Information Regulator through its official website, https://inforegulator.org.za, or its eServices portal, https://eservices.inforegulator.org.za.

13. Changes to this policy

We keep the current version on our website and provide links from the Parent App, including signup and relevant settings. Where a change requires a fresh consent or other notice under applicable law, we obtain it before relying on the change. Vinky records the relevant acceptance/consent details as part of the account and child setup processes.

14. Legal and contact details

You may also read our Terms & Conditions and Refund & Cancellation Policy.