Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how AYLUKHA SOLUTIONS (PTY) LTD, operating through its software division Aylukha Technologies, collects, uses, stores and protects personal information when you use our websites, applications and services that reference this Policy.

By using any service that links to this Privacy Policy, you acknowledge that you have read and understood how your information is handled as described here.

This Policy works together with our Terms of Use, which govern the use of our websites, applications and services.

This Policy applies to:

• The Aylukha corporate website at aylukha.com
• CONVERO — our event and conference management platform
• EduFlow — our education and school management platform
• CORE — our collaborative research and academic productivity platform
• Any future Aylukha software product or service that expressly references this Privacy Policy

Where a specific product has additional privacy requirements imposed by law or regulation, that product may include a supplementary notice. Unless a supplementary notice says otherwise, this Policy governs.

2. Products covered

This Policy covers the following Aylukha products:

CONVERO is an event and conference management platform. It enables event organisers to manage participants, sessions, attendance, messaging, submissions and related event activities.

EduFlow is an education and school management platform. It supports school administrators, teachers, students and parents or guardians in managing academic records, attendance, assessments, timetables, fees and school communications.

CORE is a collaborative research and academic productivity platform. It supports researchers and research teams in managing projects, documents, literature, notes, tasks and AI-assisted research interactions.

References to "the services" or "our products" in this Policy mean any combination of the above products and the Aylukha corporate website, unless a section specifically addresses a single product.

3. Information we collect

We collect information that you provide directly, information that authorised organisations provide on your behalf, information generated through your use of our services and limited technical information necessary to operate and secure those services.

Account and identity information

When you create an account, we collect your name, email address, telephone number, profile information and authentication identifiers. Some products may also collect your job title, role or institutional affiliation.

Organisation, school, event and institutional information

Depending on the product you use, we may process the name and details of the organisation, school, event or institution you are associated with, your role within that entity and any membership or enrolment records.

User-generated content

We process content you create or upload within our services, including documents, notes, research materials, forum posts, comments, messages and other materials you choose to submit.

Communications and messaging

Direct messages, forum discussions, event or school communications and other correspondence sent through our services are processed to deliver the communication functionality.

Photographs, uploaded files and documents

Where you choose or are required to submit photographs, files or documents — for example as part of a challenge submission, event requirement or academic workflow — we process those files to provide the relevant service.

Academic, educational and research information

EduFlow may process academic records, attendance data, assessment results, grades, timetables and fee or payment records. CORE may process research projects, literature references, research notes and task records.

Event participation and attendance information

CONVERO may process information about your participation in events, including session registrations, attendance records, meeting participation and challenge or competition submissions.

Device, technical and diagnostic information

We collect device type, operating system, browser type, application version, IP address and diagnostic logs to operate, secure and troubleshoot our services.

Push-notification registration information

Where you enable push notifications, we process a device registration token or equivalent technical identifier to deliver notifications on your device.

Administrative, security and audit information

We process information related to account security, access controls, authentication events and system audit logs to protect accounts and detect unauthorised access.

4. CONVERO

CONVERO is our event and conference management platform. In addition to the general information described in section 3, CONVERO may process the following specifically to provide event management functionality:

• Participant profiles, event memberships and enrolment records
• Session registrations and attendance records
• Meeting participation information
• Direct messages between event participants where messaging functionality is enabled
• Forum posts, discussion threads and event communications
• Push-notification registrations for event-related alerts
• Challenge or competition participation records and submissions
• Photographs submitted as part of event requirements or challenge submissions

Event organisers and their authorised event administrators may have access to information necessary to administer their events, including participant lists, attendance records and submitted materials. This access is governed by the event organiser's own configuration and responsibilities.

5. EduFlow

EduFlow is our education and school management platform. It is designed to support schools, educational institutions, administrators, teachers, students and parents or guardians.

What EduFlow may process

Depending on the school's configuration, EduFlow may process:

• School and institutional account information
• Administrator, teacher, student and parent or guardian profiles
• Class and group membership records
• Academic records, including grades, assessment results and academic history
• Attendance records
• Timetable and scheduling information
• Fee and payment records where applicable
• School communications sent through the platform

Roles and responsibilities

The school or educational institution that configures and operates EduFlow acts as the data administrator for the student and learner information processed within that school's environment. Aylukha provides the platform; the school determines what information is collected and how it is used within the scope of the educational services it provides.

Parents and guardians should direct questions about how a specific school uses EduFlow to that school's administration.

6. CORE

CORE is our collaborative research and academic productivity platform. In addition to the general information described in section 3, CORE may process:

• Research project information and metadata
• Documents, literature references, notes and research materials that you upload or create
• Task and workflow records
• AI-assisted interactions where you choose to use AI-enabled features

You should only upload information to CORE that you are authorised to process. Aylukha is not responsible for the contents of materials that users choose to upload. AI-assisted functionality within CORE is described further in section 14 of this Policy.

7. How information is collected

We collect information through the following means:

Information you provide directly. When you create an account, fill in your profile, complete forms, send messages, upload files or otherwise interact with our services.

Information provided by authorised organisations. Schools, event organisers and other institutions may provide information about you when they configure or operate a service on your behalf.

Information generated through use. Activities such as submitting content, participating in events or assessments, sending messages and using AI-enabled features generate records that we process to provide the service.

Technical information. Device information, browser data, IP addresses, diagnostic logs and similar technical data are collected automatically when you access or use our services.

8. How information is used

We use personal information for the following purposes:

• To provide, maintain and improve our services
• To authenticate accounts and maintain account security
• To deliver communications, notifications and messages through our services
• To support event, school and research functionality as described in the relevant product sections
• To detect, prevent and respond to security incidents, fraud and misuse
• To troubleshoot issues and provide support
• To comply with applicable legal obligations
• To improve the reliability and performance of our products

We do not sell personal information. We do not use personal information for advertising or marketing profiling. We do not use personal information for purposes incompatible with those described in this Policy without first notifying you.

9. Legal basis and South African privacy law

AYLUKHA SOLUTIONS (PTY) LTD operates from South Africa. Our collection and processing of personal information is guided by the Protection of Personal Information Act, 2013 (POPIA).

Under POPIA, we process personal information on one or more of the following bases:

• You have given your consent
• Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract
• Processing is necessary to comply with a legal obligation
• Processing is necessary to protect a legitimate interest of yours or of a third party
• Processing is necessary for pursuing a legitimate interest of Aylukha

Where you are located in a jurisdiction with additional privacy rights — for example under the European Union's General Data Protection Regulation (GDPR) or other applicable data protection laws — those rights may also apply to you. This Policy is structured to support compliance with POPIA and to provide a reasonable foundation for responding to requests from users in other jurisdictions.

10. Children and educational information

EduFlow may process information about learners, including minors, where that information is provided by or managed through a school or educational institution.

Aylukha does not enter into direct relationships with minor learners. Consent for the collection and processing of a learner's personal information through EduFlow is appropriately obtained and managed by the school, educational institution, parent or guardian or other person authorised by law — not by Aylukha directly.

Schools and institutions using EduFlow are responsible for ensuring that they have the necessary legal authority and consent to collect and share learner information through the platform.

If you are a parent or guardian and have questions about how a school uses EduFlow to process a learner's information, please contact that school directly.

11. User-generated content and communications

Our services allow you to create and share content, including direct messages, forum posts, comments, uploaded files, photographs and other materials.

Content that you intentionally share with other participants, event attendees, classmates, colleagues or authorised administrators may be visible to those recipients within the scope of the platform. For example, a message sent in an event forum in CONVERO may be visible to other event participants, and an uploaded document in CORE may be accessible to collaborators on that project.

We do not access the content of your private communications except where necessary to respond to a support request you have initiated, to investigate a reported policy violation, or where required by law.

12. Camera, photographs and files

Where a product offers functionality that requires camera access — for example submitting photographic evidence as part of a challenge or event requirement in CONVERO — your device will request your permission before granting camera access.

We do not access your device camera at any time without your explicit action invoking that functionality. Camera access is limited to the specific interaction you initiate and is not used for continuous or background capture.

Photographs and files that you upload through our services are processed to provide the relevant feature and are handled in accordance with this Privacy Policy.

13. Push notifications

Where supported by a product, you may opt in to receive push notifications for service-related messages, event updates, school notifications or other relevant communications.

To deliver push notifications, we process a device registration token or equivalent technical identifier. This token is associated with your device and is used solely to deliver the notifications you have requested.

You can control notification permissions through your device's operating system settings at any time. Disabling notifications will stop delivery of push messages but will not affect other aspects of the service.

14. AI-assisted functionality

CORE and certain future Aylukha products may offer AI-assisted features that help with research, writing or other tasks.

When you use an AI-enabled feature, the content you submit to that feature may need to be processed in order to provide the AI interaction. AI-assisted functionality may process user-provided content using Aylukha systems and approved third-party AI infrastructure, where applicable.

AI providers and the technical architecture used to deliver AI-assisted functionality may change as the service evolves. Relevant privacy and security safeguards will apply to any such processing, and this Policy will be updated where material changes occur.

Content submitted to an AI feature is not used to train third-party AI models unless that use is explicitly established and disclosed. If such use is ever introduced, it will be clearly described in this Policy or in a product-specific notice, and you will be given the opportunity to review the change.

15. Service providers and third parties

Aylukha uses service providers to operate and deliver our services. These providers process information on our behalf for purposes such as hosting, databases, authentication, storage, notifications, communications and infrastructure.

Service providers may include, where applicable, providers such as Google Firebase and Resend:

• Google Firebase — used for hosting, authentication, databases, storage and push notifications across our products
• Resend — used for transactional email delivery, including contact form enquiries

This list is not exhaustive and reflects the providers we currently use. As Aylukha's infrastructure and product integrations evolve, the providers we work with may change. We will keep this Policy reasonably current.

Our service providers are contractually bound to process personal information only on our instructions and in accordance with applicable data protection obligations. They do not acquire any independent right to use your personal information for their own purposes.

Aylukha does not sell personal information. We do not share personal information with third parties for their own marketing or advertising purposes.

16. International processing

Some of our service providers may process information in countries other than your own. Where this occurs, we take reasonable steps to ensure that appropriate data protection safeguards are in place, as required by applicable law.

South Africa's Protection of Personal Information Act permits the transfer of personal information to recipients in foreign countries where the recipient is subject to law, binding corporate rules or a binding agreement that provides an adequate level of protection equivalent to the protections under POPIA.

17. Security

We take reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse or disclosure. These measures include encryption in transit, access controls, authentication, audit logging and regular security reviews.

No method of transmission or storage is completely secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security.

18. Data retention

We retain personal information only for as long as reasonably required to provide the services, to comply with legal and regulatory obligations, to resolve disputes, to enforce agreements and for other legitimate business purposes.

Different products and data categories may have different retention periods. For example, academic records in EduFlow may be retained for the duration of a learner's enrolment and for a reasonable period afterwards, while event data in CONVERO may be retained for the duration of the event and a reasonable post-event period.

When personal information is no longer required, we delete or anonymise it in accordance with our data retention practices.

19. Account deletion and personal data deletion

You have the right to request deletion of your account and associated personal data, subject to any legal retention obligations that may apply.

To request account and data deletion, please visit our Account & Data Deletion page, which provides a straightforward process for submitting a deletion request.

Before completing a destructive deletion, we may need to verify your identity or account ownership to protect you from unauthorised deletion requests.

Some information may need to be retained after account deletion where required by law, for security and fraud prevention, for financial or legal record-keeping, or for other legitimate obligations. Where this applies, we will explain what is retained and why.

20. Privacy rights

Depending on the jurisdiction in which you are located, you may have the following rights with respect to your personal information:

• Access — the right to request a copy of the personal information we hold about you
• Correction — the right to request that we correct inaccurate or incomplete personal information
• Deletion — the right to request that we delete your personal information, subject to legal retention requirements
• Objection or restriction — the right to object to or request restriction of certain processing activities
• Withdrawal of consent — where processing relies on your consent, the right to withdraw that consent at any time

To exercise any of these rights, please contact us using the details in the Contact section below. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

21. Cookies and website technologies

The Aylukha corporate website (aylukha.com) is designed to operate without unnecessary cookies. Only technologies strictly necessary to serve the site and to deliver the contact form enquiry functionality are used. An audit of the live website confirmed that no Google Analytics, Google Tag Manager, Firebase Analytics for Web, advertising pixels, behavioural analytics or equivalent tracking technologies are present.

We do not use analytics cookies, advertising cookies or third-party tracking technologies on aylukha.com. The contact form on the website sends data to our backend infrastructure for the sole purpose of delivering your enquiry; no tracking or profiling is performed.

If we introduce analytics or other non-essential technologies in the future, we will update this section and provide appropriate controls or consent mechanisms as required by applicable law.

22. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our products, services, legal obligations or data processing practices.

When we make material changes, we will update the "Last updated" date at the top of this page. Where appropriate, we will provide additional notice of significant changes.

We encourage you to review this Policy periodically. Your continued use of our services after changes are published constitutes acknowledgement of the updated Policy.

23. Contact

If you have questions, concerns or requests relating to this Privacy Policy or the handling of your personal information, please contact:

AYLUKHA SOLUTIONS (PTY) LTD
Registration No. 2025 / 572525 / 07
Aylukha Technologies
Durban, South Africa
Email: privacy@aylukha.com