Privacy Policy

1. Who We Are

Scholar Africa is a scholarship discovery and matching platform operated by Vyoma AI Studios. Our platform helps African students find and apply for scholarships worldwide.

Responsible Party / Data Controller: Vyoma AI Studios, operating Scholar Africa at https://scholar.africa.

Data Protection Contact: emailsuryateja.m@gmail.com (acting DPO)

For POPIA purposes, Scholar Africa acts as a responsible party as defined in section 1 of POPIA. For GDPR purposes (EU/EEA users), Scholar Africa acts as a data controller.

2. Data We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Special Categories

We do not intentionally collect special-category data (race, health, religion, etc.). Nationality is collected solely for scholarship eligibility matching and is not processed for any discriminatory purpose.

3. Why We Process Your Data

• Scholarship matching: Score your profile against 250+ scholarships to show personalised results.
• Account management: Create and maintain your account, authenticate logins, reset passwords.
• Communication: Send transactional emails (welcome, password reset, verification) and, with your consent, marketing emails (weekly newsletter, deadline reminders).
• Platform improvement: Analyse usage patterns (with analytics consent) to improve features and scholarship data.
• Security & fraud prevention: Detect and prevent abuse, unauthorised access, and attacks.
• Legal compliance: Maintain records required by applicable law, respond to data subject requests, cooperate with law enforcement where legally required.

We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

4. Lawful Basis (GDPR) & Justification (POPIA)

5. Third Parties & Data Sharing

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.

We may disclose data to law enforcement or regulatory authorities if required by law, a court order, or to protect the rights and safety of users or others.

6. International Data Transfers

Scholar Africa is hosted in Europe (Hostinger). However, some processors operate outside South Africa and the European Economic Area:

• United States: Google (Analytics, Gmail, OAuth), Anthropic (Claude API). These transfers are governed by Google's and Anthropic's Standard Contractual Clauses and applicable US privacy frameworks.

For South African users: transfers outside South Africa are made in compliance with POPIA section 72, which permits transfers where the recipient country provides adequate data protection or where we have implemented appropriate safeguards.

For EU/EEA users: we rely on Standard Contractual Clauses (SCCs) for transfers to the US.

7. Data Retention

When your account is deleted, personal fields are anonymised (name replaced with "[Deleted User]", email with a hash) rather than hard-deleted, to preserve scholarship application audit integrity. You may request confirmation of this process.

8. Cookies & Tracking

Our cookie banner appears on first visit. You can change your cookie preferences at any time from the "Cookie Preferences" link in the footer.

9. Your Rights

Under POPIA (for South African users) and GDPR (for EU/EEA users), you have the following rights:

• Right of Access (POPIA s.23 / GDPR Art.15): Request a copy of all personal data we hold about you.
• Right to Correction (POPIA s.24 / GDPR Art.16): Request correction of inaccurate or incomplete data.
• Right to Deletion / Erasure (POPIA s.24 / GDPR Art.17): Request deletion of your data (subject to legal retention obligations).
• Right to Object (POPIA s.11(3) / GDPR Art.21): Object to processing based on legitimate interest, including marketing emails.
• Right to Data Portability (GDPR Art.20): Receive your data in a structured, machine-readable format (JSON export available).
• Right to Withdraw Consent: Withdraw analytics/marketing consent at any time via cookie preferences or by emailing us. Withdrawal does not affect processing before withdrawal.
• Right to Complain: Lodge a complaint with the South African Information Regulator (inforegulator.org.za) or your local data protection authority.

To exercise your rights, use the Data Request Portal (when logged in) or email us directly.

10. Security

We implement appropriate technical and organisational measures to protect your personal information:

• Passwords are hashed using bcrypt (never stored in plaintext)
• Session tokens are cryptographically random and stored as SHA-256 hashes
• HTTPS enforced for all connections
• IP addresses are hashed before analytics storage
• Database access restricted to application user with minimum required permissions
• Security incident logging and 72-hour POPIA/GDPR breach notification procedure

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the South African Information Regulator within 72 hours and notify affected users without undue delay, as required by POPIA section 22.

11. Children

Scholar Africa is not directed at children under 18. We do not knowingly collect personal information from anyone under 18 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Display a notice on the Scholar Africa platform
• Email registered users (for significant changes)

Your continued use of Scholar Africa after a policy change constitutes acceptance of the revised policy. If you disagree with changes, you may request account deletion before the effective date.

13. Contact & Data Protection Officer

Response time: We aim to respond to all data subject requests within 30 days.