Privacy Policy

Last updated: 3 September 2026

This Privacy Policy explains what personal information JourneyBase ("Service", "we", "us") collects through the platform, why we collect it, and what rights you have over it. JourneyBase is built and operated by Empath Technology Solutions, a South African company, and this policy is written to comply with the Protection of Personal Information Act, 2013 ("POPIA").

If you are a driving school registering on the Service, you are a "responsible party" under POPIA for the personal information of your own learners and staff that you enter into the Service. Empath acts as an "operator", processing that information only on your instructions, as described in our Terms of Service. This policy covers both what Empath collects directly (e.g. about school accounts and billing), and how we handle information a school enters about its own learners and instructors.

1. Information We Collect

Depending on your role, the Service collects:

  • Account information — name, email address, phone number, and role (school admin, instructor, learner, or observer).
  • School information — school name, address, and contact details, plus payment details if a school connects its own PayFast merchant account.
  • Learner progress data — licence category, curriculum stage progress, mock test attempts and scores, and lesson booking history.
  • Location data — with the relevant device permission granted, GPS coordinates recorded during a lesson or a practice route, used to confirm lesson attendance and give instructors a record of the route driven. Location is only collected while a lesson or route recording is actively in progress, never continuously in the background.
  • Documents you upload — compliance documents (e.g. vehicle roadworthy certificates, licence discs), proof-of-payment images, and profile photos.
  • Communications — messages sent between users of the same school through the Service's direct messaging feature, and any feedback or support requests you submit to us.
  • Payment information — processed by PayFast, our payment gateway partner. We do not receive or store your full card details; PayFast handles that directly.
  • Sign-in information — if you use "Continue with Google", we receive your name, email address, and profile photo from Google to create or match your account. We never receive your Google password.
  • Technical information — standard session and CSRF-protection cookies required for you to stay signed in and to keep the Service secure. We do not use advertising or cross-site tracking cookies.

2. How We Use This Information

We use personal information only to operate the Service, specifically to:

  • Create and manage accounts, and control access appropriately by role and by school.
  • Schedule, confirm, and track driving lessons and practice routes.
  • Record curriculum progress, mock test results, and attempt history.
  • Process and reconcile payments for lessons and subscriptions.
  • Send account-related notifications (e.g. booking confirmations, new messages).
  • Respond to support requests and platform feedback.
  • Maintain the security, integrity, and reliability of the Service.

We do not sell personal information, and we do not use learner, instructor, or school data for advertising.

3. Who We Share Information With

We share personal information only with the third parties needed to run the Service:

  • PayFast — to process payments made through the Service.
  • Google — only if you choose to sign in with Google, to authenticate your account.
  • Supabase — our database and file-storage infrastructure provider, which hosts the underlying data on our behalf under its own security and confidentiality commitments.
  • Cartrack — only for schools that opt into the paid vehicle-monitoring add-on, to sync GPS trip data the school already collects through its own Cartrack account.

We do not otherwise disclose personal information to third parties, except where required by law.

4. Data Retention

We retain personal information for as long as your account or your school's account remains active, and for a reasonable period afterward to meet legal, accounting, or dispute-resolution obligations. You can request deletion of your account's data at any time, as described in section 6 below.

5. Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse, and unauthorised access, including encrypted connections (HTTPS) and access controls that restrict each school's data to that school's own staff. No system is completely secure, so we cannot guarantee absolute security, but we work to keep the Service as safe as reasonably possible.

6. Your Rights

Under POPIA, you have the right to:

  • Ask what personal information we (or your school, as responsible party) hold about you.
  • Request that inaccurate or outdated information be corrected.
  • Request deletion of your personal information, subject to any legal retention requirements.
  • Object to the processing of your personal information in certain circumstances.

If you are a learner or instructor, please raise these requests with your driving school first, since they control your account as the responsible party. You can also contact us directly at jason.goliath@empathtechnologysolutions.com and we will assist or direct your request appropriately.

7. Children's Privacy

The Service is intended for use by driving schools, instructors, and learner drivers old enough to hold a South African learner's licence. We do not knowingly collect personal information from children outside of this context.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after an update constitutes acceptance of the revised policy.

9. Contact

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to jason.goliath@empathtechnologysolutions.com.

Need help? Open a ticket Get help — open a support ticket