Privacy Notice

MASTER PRIVACY NOTICE

Global privacy information for Veri-AQ users, supplemented by jurisdiction-specific notices

Academic Quality. Verified.

1. Responsible entity

The entity responsible for direct-to-user processing is the Veri-AQ contracting entity identified in the Entity and Jurisdiction Schedule or service order. In institution-controlled workflows, Veri-AQ may act as a processor/operator for institution-directed processing and as an independent controller/responsible party for security, billing, service administration and legal compliance.

2. Information we process

3. Purposes

• Provide and administer the selected Veri-AQ service.
• Maintain guardian/learner and institution workflows.
• Generate requested analyses, reports, tutoring and educational progress functions.
• Process subscriptions, payments and support.
• Protect accounts, users and the platform; prevent fraud/abuse.
• Comply with law, contracts, privacy rights and security obligations.
• Use limited service analytics only where lawful and configured to exclude protected academic/child content.

4. Current exclusions and future new purposes

5. Children and guardians

Child information is subject to heightened safeguards. South African under-18 processing follows the POPIA child framework. U.S. collection from a child under 13 is disabled unless an approved COPPA workflow is active. Guardian access is governed by product rules and applicable law; a guardian relationship does not automatically grant access to every learner-private Junior AI Tutor conversation or working content.

6. Recipients and processors/operators

Current material providers and their present service roles are listed below. Contractual, security and cross-border status is governed by the Subprocessor and Vendor Register.

Outbound email is sent from Veri-AQ’s own mail server. No third-party email-sending service processes user data.

The following eight analysis features are processed entirely on Veri-AQ-controlled infrastructure and send no content to a third party for the analysis itself: AI detection, citations, code similarity, completeness, handwriting, plagiarism, stylometry and writing quality. Content structure is not included in this statement pending internal verification.

7. Cross-border processing

Veri-AQ may process information in South Africa, the United States and other approved jurisdictions. Cross-border processing does not reduce applicable rights. South African personal information is transferred only after the applicable POPIA section 72 analysis and safeguards are documented. Institution-specific residency restrictions continue to apply where contracted.

8. Retention summary

9. Rights

• Access, correction and deletion/destruction where applicable.
• Object to certain processing and withdraw consent where processing depends on consent.
• Opt out of applicable marketing.
• Request human review or challenge of a significant automated result.
• Use jurisdiction-specific rights described in the South Africa, U.S., EU/EEA or UK supplements where applicable.

Veri-AQ acknowledges privacy-rights requests promptly and responds within the period set by the applicable law for the right invoked. Where the governing law permits an extension, the requester is informed of the extension and reason within the original statutory period. South African procedures and the EU/UK GDPR Supplement state the applicable jurisdiction-specific approach.

10. Security

Veri-AQ uses risk-based safeguards including access control, MFA for privileged access, encryption where appropriate, tenant separation, secure sessions, malware/file checks, audit logging, backup controls, retention/deletion workflows, vendor controls and incident response. No online system can guarantee absolute security.

Security compromises are escalated internally immediately. Where POPIA applies, Veri-AQ notifies the Information Regulator and affected data subjects as soon as reasonably possible after it is reasonably sure that a security compromise has occurred, using the manner currently prescribed by the Regulator and subject to any lawful delay. No universal fixed-hour commitment applies to POPIA notifications. Suspected compromises may be reported to privacy@veri-aq.com. Where another jurisdiction applies, including the GDPR, the applicable jurisdiction-specific notification threshold and deadline govern.

11. Changes

This Notice may change when processing, vendors, jurisdictions, products or law materially change. Where applicable, Veri-AQ will provide notice, obtain reconfirmation/consent or update institution schedules before the changed processing begins.

Legal review and mandatory-law notice. This policy framework is designed for Veri-AQ operations and must be reviewed by appropriately qualified counsel before a new entity, jurisdiction, school contract, under-13 U.S. workflow or materially new processing purpose is launched. Nothing in this document excludes rights or duties that applicable law does not permit the parties to waive.

Primary legal references

• POPIA: Protection of Personal Information Act 4 of 2013 — https://www.gov.za/documents/protection-personal-information-act
• COPPA: Children’s Online Privacy Protection Rule, 16 CFR Part 312 — https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
• FERPA: Family Educational Rights and Privacy Act, 34 CFR Part 99 — https://studentprivacy.ed.gov/ferpa

Contact details

Website: www.veri-aq.com | Support: support@veri-aq.com | Privacy / PAIA: privacy@veri-aq.com

Principal address: Hofmeyer Rd, Centurion, South Africa, 0157