Privacy Policy

Last updated: 5 October 2026

This Privacy Policy explains what personal information JourneyBase (Pty) Ltd (registration number 2026/773468/07), a private company registered in the Republic of South Africa ("JourneyBase", "we", "us"), collects through the JourneyBase platform (the "Service"), why we collect it, and what rights you have over it. This policy is written to comply with the Protection of Personal Information Act, 2013 ("POPIA"). The Service is available to driving schools in other countries too; where the data protection law of another country applies to a school or learner (for example the EU or UK GDPR), the school remains responsible for its own compliance and we process personal information on its behalf as described below.

If you are a driving school registering on the Service, you are a "responsible party" under POPIA (a "data controller" under laws such as the GDPR) for the personal information of your own learners and staff that you enter into the Service. We act as an "operator" (a "data processor"), processing that information only on your instructions, as described in our Terms of Service. This policy covers both what we collect directly (e.g. about school accounts and billing), and how we handle information a school enters about its own learners and instructors.

1. Information We Collect

Depending on your role, the Service collects:

• Account information — name, email address, phone number, and role (school admin, instructor, learner, or observer).
• School information — school name, address, and contact details, plus payment details if a school connects its own PayFast merchant account.
• Learner progress data — licence category, curriculum stage progress, mock test attempts and scores, and lesson booking history.
• Location data — with the relevant device permission granted, GPS coordinates recorded during a lesson or a practice route, used to confirm lesson attendance and give instructors a record of the route driven. Location is only collected while a lesson or route recording is actively in progress, never continuously in the background.
• Documents you upload — compliance documents (e.g. vehicle roadworthy certificates, licence discs), proof-of-payment images, and profile photos.
• Communications — messages sent between users of the same school through the Service's direct messaging feature, and any feedback or support requests you submit to us.
• Payment information — processed by PayFast, our payment gateway partner. We do not receive or store your full card details; PayFast handles that directly.
• Sign-in information — if you use "Continue with Google", we receive your name, email address, and profile photo from Google to create or match your account. We never receive your Google password.
• Support requests — if you contact us through the "Report an issue" form we store your name, email address, your message and the page you were on, so we can reply and fix the problem.
• Technical and usage information — cookies required for you to stay signed in and to keep the Service secure (session and CSRF-protection cookies), plus basic usage information collected by the analytics and support-chat tools listed in section 3: for example the pages visited, the approximate location (country or city), and the browser and device type. These analytics and chat tools are only loaded, and only set their own cookies or similar identifiers, after you choose "Accept" in our cookie banner. We store your choice in a small cookie so we do not ask again, and you can change it at any time with the "Cookie settings" link at the bottom of our public pages or change your cookie choice here.

2. How We Use This Information

We use personal information only to operate the Service, specifically to:

• Create and manage accounts, and control access appropriately by role and by school.
• Schedule, confirm, and track driving lessons and practice routes.
• Record curriculum progress, mock test results, and attempt history.
• Process and reconcile payments for lessons and subscriptions.
• Send account-related notifications (e.g. booking confirmations, new messages).
• Respond to support requests and platform feedback.
• Maintain the security, integrity, and reliability of the Service.

We do not sell personal information, and we do not use learner, instructor, or school data for advertising.

3. Who We Share Information With

We share personal information only with the third parties needed to run the Service:

• PayFast — to process payments made through the Service.
• Google — only if you choose to sign in with Google, to authenticate your account.
• Supabase — our database and file-storage infrastructure provider, which hosts the underlying data on our behalf under its own security and confidentiality commitments.
• Render — application hosting for the Service.
• Cloudflare — content delivery and security filtering in front of our website; traffic to and from the Service passes through it.
• Google Analytics — measures how the website and the Service are used (page addresses and technical device information). We do not send learner names or lesson content to it.
• HubSpot — our support chat and ticketing tool. If you use the chat or contact us for support, it receives the messages you send, your email address if you give it, and technical information such as your browser and the pages you view. Our HubSpot account is hosted in HubSpot's European data centre. We do not send it learner records or lesson content.
• Microsoft Clarity — session-replay and heat-map analytics, used only on public, signed-out pages such as the home, pricing and sign-in pages.
• Cartrack — only for schools that opt into the paid vehicle-monitoring add-on, to sync GPS trip data the school already collects through its own Cartrack account.

We do not otherwise disclose personal information to third parties, except where required by law.

4. International Use and Where Your Data Is Stored

The Service is operated from South Africa and may be used by driving schools in any country. The providers listed above operate data centres in several countries, so personal information that you or your school enter into the Service may be stored and processed outside the country where you live, including in South Africa. Where personal information is transferred across borders we rely on our providers' contractual security and confidentiality commitments, and we act in line with the data protection law that applies, such as POPIA's conditions for transfers outside South Africa. If the law that applies to your school requires a specific transfer mechanism (for example standard contractual clauses), contact us and we will work with you to put one in place.

5. Data Retention

We retain personal information for as long as your account or your school's account remains active, and for a reasonable period afterward to meet legal, accounting, or dispute-resolution obligations. You can request deletion of your account's data at any time, as described in section 7 below.

6. Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse, and unauthorised access, including encrypted connections (HTTPS) and access controls that restrict each school's data to that school's own staff. No system is completely secure, so we cannot guarantee absolute security, but we work to keep the Service as safe as reasonably possible.

7. Your Rights

Under POPIA, you have the right to:

• Ask what personal information we (or your school, as responsible party) hold about you.
• Request that inaccurate or outdated information be corrected.
• Request deletion of your personal information, subject to any legal retention requirements.
• Object to the processing of your personal information in certain circumstances.

If you are a learner or instructor, please raise these requests with your driving school first, since they control your account as the responsible party. You can also contact us directly (see section 10) and we will assist or direct your request appropriately.

If you are in the EU, the UK, or another country whose law gives you additional rights — such as receiving a copy of your information in a portable format or restricting how it is used — you can exercise those rights in the same way. You may also have the right to complain to your local data protection authority; in South Africa this is the Information Regulator.

8. Children's Privacy

The Service is intended for use by driving schools, instructors, and learner drivers old enough to hold a learner's or provisional driving licence or permit in their country. Where the law of your country requires a parent or guardian's consent for a minor's information, your school is responsible for obtaining it. We do not knowingly collect personal information from children outside of this context.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after an update constitutes acceptance of the revised policy.

10. Contact

JourneyBase (Pty) Ltd (registration number 2026/773468/07), registered office: Unit 71 Kogelberg Estate, Haasendal Road, Cape Town, Western Cape, 7580.

Questions about this Privacy Policy, or requests relating to your personal information, can be sent via the in-app "Send feedback" option, to info@journeybase.co.za, or in writing to our registered office above.