Privacy Policy

Public URL: https://getguardianlink.co.za/privacy
GuardianLink is a product of Duplessis Innovations (Pty) Ltd, reg. 2025/597983/07.

Draft. Not legal advice. Pending approval by Jeanne-Michael du Plessis, Duplessis Innovations. Version 0.1 draft, last updated 24 September 2026. This page adapts that draft for this website: it does not name a school, it does not state a price, and it describes email-code sign-in, which is how GuardianLink works. It is not in force until it is approved.

1. Who we are#

GuardianLink is a teacher-to-parent communications app for nursery schools. Each school is a separate tenant.

Duplessis Innovations (Pty) Ltd (Cape Town, South Africa) builds and operates GuardianLink. GuardianLink is a product of Duplessis Innovations (Pty) Ltd, reg. 2025/597983/07.

How responsibility is split in this draft:

• The school is the responsible party under the Protection of Personal Information Act, 2013 (POPIA). The school decides why children’s and families’ information is used for day-to-day care and parent communication.
• Duplessis Innovations is the operator. We run the software, host the data on the school’s instruction, and do not use school data for our own marketing.

If that split changes after legal review, this policy will be updated before it is treated as final.

Contact#

• Email: hello@duplessisinnovations.com
• Auth and product mail is sent as GuardianLink (hello@mail.duplessisinnovations.com)
• Information Officer (placeholder until appointed): name to be confirmed, Duplessis Innovations. Use hello@duplessisinnovations.com for now.

2. Who this policy covers#

• School staff who sign in to the GuardianLink app or school portal (teachers, assistant teachers, principals, admin assistants)
• Parents and guardians who sign in to read their child’s daily report
• Children enrolled at a school that uses GuardianLink, typically aged 0 to 6. Children do not create accounts and do not use the app themselves

Duplessis Innovations also uses an internal operator console to set up a school. It is not a parent, teacher, or principal product, and this website does not link to it.

This public website (getguardianlink.co.za) explains the product. It does not create accounts. The “book a demo” link opens an email to hello@duplessisinnovations.com.

3. What information we process#

GuardianLink processes information the school and its staff enter, information parents submit, and limited technical data needed to run the service.

Children (on the school’s instruction)#

• Name, school, class, and date of birth if the school records it
• Enrolment and class allocations
• Daily care logs written by teachers, including meals and portions, naps and sleep, toileting, nappy changes and related personal-care notes, behaviour and activities, therapy session notes where the school records them, supplies the child may need, an overall day rating, and the teacher’s pickup comment
• Checkout status (good, okay, or concerning) and, if a day is marked concerning, whether a principal or admin assistant has acknowledged it before parents can see it
• A child photo field exists in the database. The current app does not take or attach photos. If a photo is stored later, that image is personal information about a child
• Soft-delete and left-school flags when a child leaves

Parents and guardians#

• Name, email, and phone number when the school records it
• Relationship to the child
• Login by an 8-digit email code. A password remains only as a fallback for an account that already has one. Phone one-time passwords are not part of this version
• Optional remarks on a released daily report, and the time those remarks were saved
• First-view read receipts so the school can see that a parent opened that day’s report
• Emergency contact name and phone, home address, and pickup notes if the school stores them on the family record

School staff#

• Name, email, and role (teacher, assistant teacher, principal, admin assistant)
• School membership and whether that membership is active
• Actions needed for the service, such as sign-in, a care log, checkout, or acknowledging a concerning day
• Device PIN login is not offered in this version

Technical and account data#

• Authentication session, stored on the device so you stay signed in
• School identifier
• App version and basic device or network state used to talk to the server
• Push notification device tokens are not collected. Push delivery is not part of the current service. If that changes, this policy will be updated before it happens
• Server and security logs, for example to prevent abuse. The app does not run advertising or analytics SDKs

We do not ask children to use the app. The current app does not collect precise location, contacts, microphone, or camera input.

4. Why we process it#

We process this information only to provide GuardianLink to the school:

• Let teachers record the school day and check a child out
• Let principals and admin assistants review the roll, acknowledge concerning days, and keep enrolment accurate
• Let linked parents read released daily reports and leave a short remark
• Record that a parent first opened a released report
• Keep each school’s data separate from other schools
• Secure the service, fix faults, and prevent misuse
• Support the school when they ask us to, for example to restore access

We do not use this information for advertising. We do not sell it. We do not use third-party tracking or advertising SDKs. Product improvement, if any, will use aggregated or non-identifying metrics only, and we will say so here if that starts.

5. Lawful basis (POPIA)#

• The school must have a lawful basis to collect and use children’s and families’ information for childcare and parent communication. That typically includes the enrolment relationship and consent from a parent or guardian, plus the school’s duty of care. GuardianLink does not replace the school’s own enrolment forms or consent records.
• Duplessis Innovations processes that information as the school’s operator, under the school’s instruction and this policy.
• Some records, including toileting, therapy notes, and wellbeing comments, can be special personal information and information about children. POPIA requires extra care. The school is responsible for collecting only what it needs and for obtaining any extra authorisation the law requires.
• We rely on the contract with the school to host and operate the service.
• We may process limited information to keep the service secure, for example blocking abusive sign-in attempts.

The service is transactional. There is no marketing list and no promotional email from GuardianLink.

6. Information about children#

GuardianLink is built for adults (staff and parents). Children aged 0–6 are data subjects, not app users.

• No child accounts
• No behavioural advertising
• No public profiles
• Access is limited to staff at that school and to guardians the school has linked to that child
• Concerning-day notes stay hidden from parents until a school administrator acknowledges them

Parents who believe a record is wrong should contact the school first. The school can correct the operational record. Duplessis Innovations can help the school make a correction or deletion when asked.

7. Who can see what#

Staff must not share logins. When someone leaves the school, the school must revoke their access promptly.

8. Where information is stored#

Application data is hosted on Supabase (Postgres and Auth) for project rfypettaosgupgqwtgtu.

Hosting region: to be confirmed. It is not recorded in the product repository. Until the region is confirmed in writing, treat the data as hosted outside South Africa unless we update this section. If the region is outside South Africa, Duplessis Innovations will use a written operator arrangement and the safeguards POPIA requires for cross-border transfers, including the school’s awareness that processing happens in that region.

The school portal is hosted on Vercel. This website is also hosted on Vercel.

9. Who we share information with#

We do not sell personal information. We do not share it with advertisers.

Push delivery is not enabled, and no push device tokens are stored. Older product notes mention SMS one-time passwords and a push provider. Those are not part of the current service and are not current sub-processors.

We may disclose information if the law requires it, or to the school when they are the responsible party and ask us to.

10. Retention and deletion#

Intended retention (some automated jobs are not finished; the school can still ask us to delete):

• If a child leaves, their record is soft-deleted. Linked parents should keep read-only access to already-released reports for 7 days, then lose parent access
• Care records are intended to be kept for 5 years, then permanently deleted
• In-progress drafts are intended to be cleared at the end of the day
• Auth sessions last until you sign out or the session expires
• Staff and parents can delete their own login in the app (Account, then Delete my account) or on the school portal (user menu). Public instructions are at https://getguardianlink.co.za/delete-account. You can also email hello@duplessisinnovations.com
• Deleting a login removes the Auth user and personal profile, revokes school memberships, and unlinks parent logins. Daily reports and other school records stay with the school. If you are the only active principal of a school, appoint another principal first
• If the school ends the service, we will export the school’s data on written request and then delete or return it according to the Terms of Service

11. Your rights (POPIA)#

Subject to the law and the school’s role as responsible party, you may ask to:

• Access the personal information we hold
• Correct information that is inaccurate or incomplete
• Delete or destroy information that we are no longer allowed to keep
• Object to processing in the cases POPIA allows
• Withdraw consent where consent is the basis the school relies on. The school may then be unable to keep using GuardianLink for that child

Parents should contact the school first. You may also contact Duplessis Innovations at hello@duplessisinnovations.com. A shorter POPIA notice is at /popia.

You may complain to the Information Regulator (South Africa): https://inforegulator.org.za. A fuller complaints address will be added once counsel confirms the wording.

12. Security#

• Separate school tenants and database access rules (row-level security) so one school cannot see another school’s children
• Encrypted connections (HTTPS) between the apps and the backend
• Authenticated accounts, using an email code, with a password only as a fallback
• No advertising or third-party tracking SDKs in the app

No online service is perfectly secure. The school remains responsible for who it invites, for staff leaving, and for how devices are shared in the classroom.

13. Cookies, tracking, and this website#

• The app does not include third-party advertising or analytics SDKs
• We do not sell personal information
• We do not track you across other companies’ apps or websites
• The school portal stores a session in the browser so you can stay signed in. That is not advertising
• This website uses Vercel Web Analytics to count visits. That count is separate from the app. The site does not run a contact form and does not create accounts

14. International readers#

GuardianLink is designed for South African schools and POPIA. If a parent or staff member is in the EEA or UK while using the service, we still process their information as described here, on the school’s instruction. European “controller / processor” language maps to the school as controller and Duplessis Innovations as processor. This paragraph is a courtesy pointer, not a full GDPR notice.

15. Changes#

We will update this draft when the Information Officer is named, when the Supabase region is confirmed, if a feature that changes what we collect is switched on, or when Jeanne-Michael du Plessis or counsel approves a final version. This URL will show the current text.

© Duplessis Innovations. Draft only.