GuardianLinkPOPIA notice
Draft. Not legal advice. Pending approval by Jeanne-Michael du Plessis, Duplessis Innovations. This notice is built from the GuardianLink privacy draft (version 0.1, 24 September 2026). It does not replace the school’s enrolment forms or consent records.
On this page
1. Responsible party and operator#
The school that uses GuardianLink is the responsible party for children’s and families’ information used for day-to-day care and parent communication. The school decides why that information is collected.
Duplessis Innovations (Pty) Ltd, registration number 2025/597983/07, Cape Town, South Africa, is the operator. We run GuardianLink and host the data on the school’s instruction. We do not use school data for our own marketing.
Information Officer for Duplessis Innovations: not yet appointed. Until a name is confirmed, write to hello@duplessisinnovations.com.
2. Whose information#
- Children enrolled at the school, typically aged 0 to 6. They do not have accounts and do not use the app
- Parents and guardians the school links to those children
- School staff: teachers, assistant teachers, principals, and admin assistants
3. Information collected#
On the school’s instruction, GuardianLink holds:
- Child name, class, enrolment, date of birth if recorded, and care logs for meals, sleep, toileting, activities, therapy notes the school chooses to record, supplies, day rating, and the teacher’s checkout comment
- Whether a day was good, okay, or concerning, and whether a concerning day has been acknowledged
- Parent and guardian name, email, phone if recorded, relationship, optional remarks, and the time a released report was first opened
- Family details the school stores, such as an emergency contact, home address, or pickup notes
- Staff name, email, role, and school membership
- A sign-in session, the school identifier, and basic technical data needed to run the service
The current app does not take photos and does not ask for camera, microphone, contacts, or precise location. Push device tokens are not collected. Supplying information for enrolment is the school’s process. If the school cannot keep the records it needs, it may be unable to use GuardianLink for that child.
4. Why it is processed#
- So teachers can record the day and check a child out
- So principals and admin assistants can keep enrolment accurate and acknowledge a concerning day before parents see it
- So linked parents can read a released report and leave a short remark
- So each school’s data stays separate, and so the service can be secured
The school needs its own lawful basis under POPIA, which commonly includes the enrolment relationship, a parent or guardian’s consent, and the school’s duty of care. Some care notes can be special personal information or information about a child. The school is responsible for collecting only what it needs and for any extra authorisation the law requires. Duplessis Innovations processes the information as operator under the school’s instruction.
5. Who receives it#
- Staff at that school, limited to the children and work their role allows
- Guardians the school has linked to a child, and only that child’s released reports
- Supabase, which hosts the database and authentication
- Vercel, which hosts the school portal and this website
- Resend, which sends transactional email such as sign-in codes and invites
- A regulator, court, or the school, when the law or the school’s role as responsible party requires it
We do not sell personal information and we do not share it with advertisers.
6. Cross-border transfer#
The Supabase hosting region is still to be confirmed. Until it is confirmed in writing, treat application data as hosted outside South Africa. Duplessis Innovations will use a written operator arrangement and the safeguards POPIA requires for a cross-border transfer, and the school should know that processing happens in that region. The portal and this website are hosted on Vercel.
7. How long it is kept#
The intended retention is: a leaver’s record is soft-deleted, with read-only parent access to already-released reports for 7 days; care records are kept for 5 years and then deleted. Some of those jobs are not automated yet. The school can ask us to delete. Deleting your own login removes the login and profile and revokes membership. Daily reports stay with the school. See delete account.
8. Your rights#
You may ask to access, correct, or delete personal information, to object where POPIA allows, and to withdraw consent where consent is the basis the school relies on.
Contact the school first. You may also email hello@duplessisinnovations.com. You may complain to the Information Regulator (South Africa): https://inforegulator.org.za.
9. This website#
getguardianlink.co.za does not create GuardianLink accounts. Demo and contact links open an email. The site uses Vercel Web Analytics to count visits. That is separate from the app, which does not include an advertising or analytics SDK.