Privacy Policy and POPIA Notice
1. About Us
Ambition International School (Pty) Ltd is a private company registered in South Africa. We operate MobyMax Reports, an educational progress reporting service for schools and homeschool families using the MobyMax learning platform, together with a related subscription service, Exceptional Results.
We operate the following four websites, all under this single company and governed by this single privacy policy:
- www.ambitionis.co.za — our school and reporting service site (currently active)
- www.mobymaxreports.co.za — the reporting service (the service is in the process of migrating here)
- www.mobymaxhomeschool.co.za — information for homeschool families (links to Exceptional Results for sign-up)
- www.exceptionalresults.co.za — our MobyMax subscription service for families
All four domains are operated by Ambition International School (Pty) Ltd and process information in accordance with this policy. Different sites collect different information depending on their purpose — the reporting sites collect learning and report data, while exceptionalresults.co.za additionally collects subscription and billing information (see Section 3).
Our Information Officer, Tim Stiff, is registered with the South African Information Regulator under registration number 2026-016709. The Information Officer’s registration certificate is available for download here: Download Registration Certificate (PDF).
2. Who This Policy Applies To
This policy applies to:
- Parents and guardians of students enrolled in our reporting service
- Teachers and school administrators using our system
- Students whose learning data we process (data subject rights are exercisable by their parent or guardian)
- Anyone who visits our websites
3. The Information We Collect
We collect the following categories of personal information:
About students (collected from MobyMax, parents, and teachers):
- Full name and surname
- Date of birth
- Age
- Date of enrolment in the service
- MobyMax weekly learning data (time spent, lessons completed, grade levels, benchmark scores)
- Teacher comments and observations
- A confidential “student profile” of learning preferences, motivations, strengths, growth areas, and contextual information provided by the teacher or parent to inform report writing
- Attendance records (school cohorts only)
- AI-generated narrative reports drawing on the above
About parents and guardians:
- Full name
- Email address
- Contact information
- Relationship to the student
- Records of which students you have access to view
Subscription and billing information (Exceptional Results subscribers):
For families who subscribe through exceptionalresults.co.za, we also collect information needed to manage your subscription:
- Subscription plan selected (for example Copper, Bronze, Silver, or Gold)
- Subscription status (for example active, lapsed, or cancelled)
- Billing dates and payment history (whether a payment succeeded or failed)
- A PayFast subscription reference linking your account to your payment arrangement
We do not collect or store your card number, CVV, or banking details. All card and payment processing is handled directly by PayFast (see Section 7). We only receive confirmation of payment status and the reference needed to manage your subscription.
About teachers:
- Full name
- Email address
- School/cohort assignment
- Login activity
- Reports generated and notes written
Special personal information (POPIA s26):
Some information we collect may qualify as special personal information, specifically information about the health or family circumstances of children. We collect this only where it is voluntarily provided by a teacher or parent to help us produce accurate reports. Where it is provided, we treat it with the additional protections POPIA requires. This information is never displayed on any report or shared outside our service.
Technical information collected automatically:
- IP address
- Browser type
- Device information
- Login times and page activity
- Cookies (see Section 14)
4. Why We Collect This Information (Purpose)
We process your information for the following purposes:
- To produce weekly and end-of-term progress reports for students
- To send these reports to parents and teachers
- To provide the secure login system (parent and teacher portals)
- To track attendance and learning progress over time
- To improve our service through aggregated, anonymised analysis
- To respond to your enquiries and requests
- To comply with our legal obligations
We do not use your information for any other purpose without your further consent.
5. Legal Basis for Processing (POPIA s11)
We process your information based on:
- Your consent — given when you accept this policy
- Performance of a contract — your enrolment agreement with us
- Legitimate interest — running the reporting service efficiently and safely
- Compliance with law — where we are required to keep certain records
You may withdraw your consent at any time. There are two ways to do this:
- Through the system: When you next log in, you can decline consent at the consent screen, which immediately stops the reporting service for your child.
- By email: Email info@mobymaxreports.co.za and we will action your request within a reasonable time, not exceeding 30 days.
Important distinction: Your consent covers two related things. First, it permits us to operate our reporting service for your child. Second, it covers our administration of your child’s access to the MobyMax learning platform.
We hold a single master MobyMax account, and your child’s individual MobyMax login is created and managed by us under that account. This means we — not you — control whether your child’s MobyMax access is active, suspended, or restored. You do not hold a direct account relationship with MobyMax.
MobyMax itself is a separate company based in the United States. Their platform stores your child’s learning records under our master account. We can request changes to that data within the controls MobyMax provides, but we cannot dictate MobyMax’s own retention practices (see Section 9).
If you withdraw consent, we will stop generating and sending reports for your child, deactivate your reporting portal login, and exclude your child’s data from all reports, dashboards and emails. Your child’s MobyMax login is not affected — they continue learning on MobyMax normally, and their learning data continues to be imported. Because your child remains enrolled, their reporting data is retained in our system (unused for reporting) and is deleted within 90 days of them leaving the service (Section 9). For school learners, end-of-term academic reports are retained under our legal obligation (Section 9). Withdrawal does not affect lawful processing carried out before withdrawal.
6. How We Use Artificial Intelligence
We use AI services, specifically Anthropic’s Claude AI, to interpret your child’s learning data and to draft narrative descriptions for inclusion in their reports.
- No automated decisions are made about your child. AI does not determine grades, promotions, interventions, or any other outcome that affects your child.
- A human teacher reviews every AI-generated report before it is sent to you.
- The AI receives your child’s learning data and (if provided) the confidential student profile. It does not retain this information after the report is generated.
- You have the right under POPIA s71 to object to automated decision-making. As we do not perform automated decision-making, this right does not currently engage, but we disclose AI use in full for transparency.
Declining AI-generated reports: Because our reporting service is built around AI-assisted narrative generation, declining consent for AI use means declining the reporting service as a whole. Your child’s underlying MobyMax learning subscription is unaffected — they continue to use MobyMax normally. If you would prefer reports without AI-generated narratives, please contact us at info@mobymaxreports.co.za to discuss whether a non-AI alternative can be arranged.
7. Who We Share Your Information With
We do not sell your information. We share it only with the following parties, and only as needed to deliver the service:
Internal access:
- Your child’s assigned teacher (school cohorts only — homeschool profiles are accessed only by the Information Officer)
- Tim Stiff (Information Officer and administrator)
Service providers (operators under POPIA s21):
| Provider | Location | Purpose | Data Shared |
|---|---|---|---|
| MobyMax (Learning App, Inc.) | United States | Core learning platform; stores your child’s learning records under our master account | Student name, login, learning activity, assessment and progress data |
| Anthropic, PBC | United States | AI narrative generation | Student name, performance data, profile context |
| API2PDF | United States | PDF generation | Full report HTML including student data |
| Brevo (Sendinblue) | European Union | Transactional email delivery | Parent/teacher email addresses, report PDFs |
| PayFast (by Network) | South Africa | Payment processing for Exceptional Results subscriptions | Parent name, email, payment amount and status (no card data is shared with us) |
| Domains.co.za | South Africa | Website hosting and database storage | All data we collect |
Each of these providers is bound by their own privacy commitments. We do not authorise any of them to use your information for purposes other than providing the service to us.
About MobyMax specifically: We operate a single master MobyMax account, under which each active student has a login. The learning data your child generates is stored by MobyMax in the United States. As the account holder, we retain access to this data for as long as MobyMax keeps it, which is what allows us to reactivate an inactive student. Because this data is held within MobyMax’s platform, our ability to permanently delete it is limited by MobyMax’s own systems and retention practices (see Section 9 and Section 10).
Department of Basic Education and Provincial Education Departments (school cohorts only):
For students enrolled at a registered school using our service (such as Ambition International School), we may be required by the South African Schools Act 84 of 1996 and provincial education legislation to share certain student records — typically enrolment information, attendance records, and assessment results — with the relevant Provincial Education Department (in our case, the Western Cape Education Department) or the national Department of Basic Education. This sharing is a legal obligation under POPIA s11(1)(c) and is not subject to consent. We share only the minimum information required by law.
For homeschool families and independent learners, we do not share any data with the Department of Basic Education. Homeschool reporting obligations remain the responsibility of the parent or guardian.
Other disclosures:
- We may disclose information if required by law, court order, or to protect the rights or safety of a person.
We do not share your information with advertisers, marketers, or any other third parties.
8. International Transfers (POPIA s72)
Some of the service providers listed above process your information outside South Africa, specifically in the United States (MobyMax, Anthropic, API2PDF) and the European Union (Brevo).
POPIA permits this transfer where:
- You have consented (you consent by accepting this policy)
- The transfer is necessary to perform our contract with you
- The recipient is subject to laws or contracts upholding adequate protection
We rely on a combination of your consent and contractual safeguards in our agreements with these providers.
9. How Long We Keep Your Information
| Data Category | Retention Period |
|---|---|
| Active student learning data | Duration of enrolment |
| Student reporting data after a student leaves the service | Deleted within 90 days of leaving |
| Student reporting data where the parent has declined consent | Reporting stops immediately, your reporting portal login is deactivated, and the data is excluded from all reports. The child’s MobyMax login continues. The reporting data is retained (unused) while the child remains enrolled, and is deleted within 90 days of the child leaving the service. For school learners, end-of-term academic reports are retained per the row below. |
| Free-trial data (14-day trial — MobyMax only, not part of reporting) | Imported but never actioned for reporting. Deleted within 30 days of trial expiry. |
| Student learning data held within the MobyMax platform | Retained by MobyMax under MobyMax’s own retention practices, which may extend for several years. The underlying records remain with MobyMax. We cannot guarantee permanent deletion of MobyMax-held data (see Section 10). |
| School learners’ end-of-term academic reports | Retained for 7 years after the learner leaves, under our legal record-keeping obligation (South African Schools Act 84 of 1996 and provincial education legislation). Retained even where deletion is requested. |
| Homeschool families’ reports | Not held under any statutory obligation — homeschool reporting is the parent’s responsibility (Section 7). Deleted on the standard schedule when the relationship ends. |
| Weekly report PDFs | Deleted within 90 days. These are not the statutory academic record and are not subject to the 7-year retention. |
| Parent/teacher account data | Until account is closed, then 12 months |
| Consent records | Indefinitely (legal proof requirement under POPIA) |
| Records of deletion and erasure requests (audit trail) | Retained indefinitely as proof of compliance. These records evidence the action taken; they do not retain the deleted personal data itself. |
| Audit logs of system access | 24 months |
| Email logs | 24 months |
After the retention period, data in our own systems is either anonymised (made impossible to link to an individual) or permanently deleted.
Backups: When we delete or anonymise data in our live systems, copies may persist in encrypted off-site backups maintained by our hosting provider (Domains.co.za) until those backups are overwritten in the normal backup rotation. We do not restore deleted personal data from backups except for disaster recovery.
10. Your Rights as a Data Subject (POPIA s5)
Under POPIA you have the right to:
- Be notified that your information is being collected (this policy)
- Access the personal information we hold about you or your child
- Correct any inaccurate information
- Delete your information (subject to legal retention requirements and the MobyMax limitation described below)
- Object to processing, including for direct marketing
- Withdraw consent at any time
- Complain to the Information Regulator
To exercise any of these rights, contact us at info@mobymaxreports.co.za. We will respond within a reasonable time, not exceeding 30 days.
For withdrawal of consent specifically: You may withdraw consent at any time by logging into our reporting portal and selecting “Decline” on the consent screen. This immediately stops the reporting service and deactivates your reporting portal login. Your child’s MobyMax login is not affected and they continue learning normally.
To re-enable reports after declining: Email us at info@mobymaxreports.co.za. We will manually re-enable your account and you can accept consent on your next login.
11. How to Complain
If you are unhappy with how we handle your information, please first contact us at info@mobymaxreports.co.za. We will do our best to resolve your concern.
If you remain unsatisfied, you may complain to the Information Regulator:
Email: complaints.IR@justice.gov.za
Website: https://inforegulator.org.za
12. Security Measures
We protect your information using:
- HTTPS encryption on all websites
- Password-protected user accounts
- Role-based access control (parents see only their own children; teachers see only their own classes)
- Database access restricted to the Information Officer and authorised technical staff
- Regular software updates and security patches
- Audit logging of access to confidential information
- Encrypted database backups
- Physical security at our hosting provider’s data centres
No system is perfectly secure, but we treat security seriously and respond promptly to any incident.
13. Children’s Data
Most of the information we process relates to children. POPIA s34-35 provides extra protection for children’s personal information. We collect children’s information only with the consent of a competent person (a parent or legal guardian) and use it only for the educational purposes described in this policy.
If you are a child reading this policy, please show it to your parent or guardian. They will deal with us on your behalf.
14. Cookies and Tracking
Our websites use cookies for:
- Keeping you logged in (essential)
- Remembering your preferences (functional)
- Understanding how the site is used (analytics)
You can disable cookies in your browser, but parts of the service may stop working. We do not use advertising or tracking cookies from third parties.
15. Changes to This Policy
We may update this policy from time to time. When we make significant changes, we will:
- Update the version number and effective date at the top of this document
- Notify you by email
- Ask you to re-consent on your next login
The latest version is always available at /privacy-policy/.
16. Reporting Service Opt-Out
We respect your right to opt out of our reporting service at any time. This section explains how the opt-out works and what happens to your information.
How to opt out:
When you next log into our reporting portal, you will see a consent screen. Click “Decline” to immediately opt out. You will be logged out and your reporting portal login will be deactivated. You will receive no further reports.
What happens to your child’s data:
- Your child’s reporting data in our system is excluded from all reports, dashboards, and email communications. While your child remains enrolled it is retained but not used; it is deleted within 90 days of your child leaving the service (see Section 9).
- Your child’s MobyMax login is not affected — declining stops our reporting, not your child’s learning. They continue using MobyMax normally.
- Reports already generated before your opt-out are retained in line with the retention periods in Section 9. They are not deleted automatically, in case you choose to re-enable later or in case educational record-keeping requires them. However, they are not re-sent to you.
- Your WordPress account on our reporting portal is removed. You can no longer log in.
- Your POPIA consent record (showing that you opted out, the date, and the version of the policy in effect) is retained indefinitely as legal proof of your decision.
The MobyMax learning account:
Your child’s MobyMax login is part of our master account. Declining reporting consent does not deactivate MobyMax — your child continues learning. We deactivate the MobyMax login only when the subscription ends. The underlying learning records remain stored with MobyMax (see Section 9), and we retain access to them as the account holder. We do not need you to contact MobyMax — we administer the account on our side.
What does NOT happen:
- Any reports already received by you remain in your inbox or saved files. We do not have the ability to recall sent emails or delete files in your possession.
Reactivating after a break:
If you return after a period away, your child’s historical MobyMax records may still exist, but we will normally set your child up with a fresh placement assessment rather than simply resuming old progress. After time away, a child’s actual learning level changes, and a fresh assessment places them correctly so they build from the right foundation. This gives the best educational outcome on return. To re-enable, email us at info@mobymaxreports.co.za. We will reactivate your child’s account and create a fresh login for the portal. On your next login, you will see the consent screen again and can accept.
Operational note:
When you opt out, we send an internal notification to our Information Officer (Tim Stiff) so we can complete the technical archival steps promptly. We may reach out to you by email to confirm the action or to ask if there is anything we could do better.
17. Contact Us
Email: info@mobymaxreports.co.za
Firlands
Gordons Bay
Western Cape
7140
South Africa