Privacy Policy
How we handle the personal information your school puts into School Compliance, and what your rights are under the Protection of Personal Information Act, 2013.
Last updated 8 September 2026.
1.Who is responsible for what
Your school decides what to record about your governors, staff and anyone else, and why. That makes your school the responsible party under POPIA.
We hold and process that information on your instruction, and only to run the portal for you. That makes OuterJoin your operator. We do not decide what your school collects, we do not use it for our own purposes, and we never sell it.
2.What we hold
When you register: your school name and type, the contact person's name, role, email address and phone number, and your province.
Inside the portal: whatever your school puts there. In practice that is your governance policies and documents, your register of governing body members and staff with their names, email addresses, roles and terms of office, funding applications and quotes, spend approvals, meeting minutes and the signatures on them, and action items with their owners.
Automatically: an audit trail of who did what in the portal and when, because a governance system that cannot show that is not worth having. Plus ordinary server logs.
We never see your card. Card details go straight to Payfast and never reach our systems.
3.The AI compliance check
When someone at your school runs a compliance audit, the document they chose is sent to Anthropic, the makers of the Claude AI model, which reads it and returns a score and a list of gaps. Anthropic processes it in the United States and does not use it to train their models.
This only happens when a person deliberately runs a check on a document they have chosen. Nothing is sent in the background, and your register of people is never sent. If your school would rather no document left the country, do not use the compliance check feature, and tell us so we can note it on your account.
4.Who else touches it
We use these providers to run the service. Each one only gets what it needs to do its job.
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting, and storage of your school's documents and records. | United States and European Union |
| Anthropic | The AI compliance audit. When you run a check, the document you chose is sent to Anthropic's Claude model, scored, and the result returned. Anthropic does not use it to train their models. | United States |
| Resend | Sending email from the portal: invitations, password links, minutes and reminders. | European Union |
| Clerk | Sign-in and account security for schools on the shared platform. | United States |
| Payfast by Network | Card payments. We never see or store your card details. | South Africa |
5.Information leaving South Africa
As the table shows, some of these providers process data outside South Africa. POPIA allows this where the recipient is bound by an agreement that upholds standards substantially similar to POPIA's own, and our agreements with these providers do that.
If this matters to your governing body, ask us and we will talk you through it.
6.Keeping it separate and safe
Every school has its own physically separate data store, not a shared one with labels on the rows. A person can only reach a school's data if they are a member of that school, on that school's own web address.
Everything travels over an encrypted connection. Access credentials are stored encrypted. Passwords are never stored in a readable form and we cannot tell you what yours is, only help you set a new one.
7.How long we keep it
For as long as your school uses the portal. If your access ends we keep it for 90 days so you can ask for a copy or come back, and then delete it. See our Refund and Cancellation Policy.
We keep records of payments for as long as tax law requires us to.
8.Your rights
You may ask what we hold about you, ask us to correct it or delete it, and object to how it is used. Because your school is the responsible party, the quickest route is usually your own school administrator, who can do most of this in the portal directly.
You can also write to us at info@outerjoin.co.za and we will answer within a reasonable time.
9.Complaints
If we have not put something right, you can complain to the Information Regulator of South Africa, at inforegulator.org.za. We would rather you told us first, but you do not have to.
10.Changes
If we change this policy, the date at the top changes with it. If a change materially affects how your school's information is handled, we will email you before it takes effect.