Privacy Policy

Responsible party

SCHOLLYUP (PTY) LTD, a South African private company (registration number 2026/756249/07) is responsible for the personal information described here. This policy covers our website and account services, not information you give directly to an external bursary provider. Contact info@schollyup.com about this policy. Our registered office is 109 Kingfisher Avenue, Germiston, Gauteng, 1428, South Africa.

Information you provide

An account may contain your name, email, age, province, citizenship or residency, education level, institution, qualification, field of study, interests and funding needs. You may enter Grade 11, Grade 12 or university marks, subjects, averages, APS and year of study. Some profile fields ask about income, background or circumstances relevant to bursary requirements.

We also handle saved bursaries, application status, notes, confirmation numbers, support requests, policy acceptance records and document checklist information. Private document uploads and AI generation are disabled in the current production pilot; if enabled later, we will update the relevant notice before use.

Sensitive information and learners

Optional ethnicity, disability or health, religion, gender, financial and similar eligibility details can be sensitive. We use them only for relevant matching or support, do not publish them, and restrict access. You can leave optional fields blank or update them in your profile. Our legal assessment of special personal information and children under POPIA remains open.

SchollyUp's profile form supports ages 16 to 24. Additional safeguards or an age restriction may be needed for users under 18; we are reviewing this with South African counsel. A user's click on a checkbox is not automatically sufficient authorisation for all processing of children's information.

Authentication, billing and technical data

Supabase manages email/password authentication and, where enabled, Google sign-in. We receive account identifiers and basic identity information, not your readable password or your Google password. Authentication uses browser storage to maintain your session.

The paid pilot is off. If you later use Paystack checkout, Paystack handles payment instruments and we receive transaction, customer, plan, status and subscription references needed to confirm access and handle disputes. We do not store full card numbers or CVVs.

Our systems and infrastructure providers process technical request details such as IP address, timestamps, browser information, route, error and security events for delivery, troubleshooting and protection. SchollyUp uses session storage for temporary personal workspace data and clears known legacy local-storage copies.

Google sign-in: information accessed and its purpose

Google sign-in is optional. If you choose it, Google sends basic identity information to Supabase Auth: your Google account identifier, name, email address and email-verification status, and a profile picture where Google supplies one. Supabase stores these identity details as authentication metadata. SchollyUp uses the verified account identifier to resolve your account and uses your name and email to prepare or display your profile and send essential account messages. It does not replace your stored marks, saved bursaries or completed profile when you sign in again.

We request only the openid, email and profile identity scopes. SchollyUp does not request access to your Gmail messages, Google Drive files, contacts, calendar or other Google account content. We do not receive your Google password. Choosing Google sign-in does not authorise SchollyUp to submit bursary applications, buy a product or send marketing messages.

Google sign-in: storage, sharing and control

Supabase processes and stores Google identity data to authenticate you and link your signed-in session to your SchollyUp account. SchollyUp stores your account name and email with your profile in its Supabase database. Vercel processes requests needed to deliver the service, and Resend receives the recipient address and message content for requested or essential email. Access is restricted to your account and authorised operational staff where necessary for support, security or a privacy request. We do not sell Google identity data, use it for advertising or send it to an AI model.

Authentication tokens and temporary sign-in state are used to maintain and protect your session. Reliability records contain an attempt reference, provider, coarse flow stage and result, browser family, duration and an allowlisted authentication hostname; they do not contain Google passwords, OAuth codes or tokens. Our infrastructure providers may separately process request and security logs as described below.

Google identity information is kept while needed for your account, with the retention and deletion exceptions described in this policy. Use Account settings to export your data or request account deletion, or contact info@schollyup.com. You can also remove SchollyUp's Google connection in your Google Account settings at https://myaccount.google.com/connections. Removing that connection stops future Google authorisations but does not by itself delete your SchollyUp account or saved data; request deletion separately. You can use email sign-in where available.

Why we use information

We use information to create and protect accounts, compare your profile with stored bursary requirements, save your progress, respond to support and privacy requests, send requested or essential messages, prevent misuse and comply with applicable obligations.

The matcher applies stored rules and may rank or explain opportunities. It does not determine eligibility or award funding. A strict filter is optional; other bursaries can remain visible. AI is disabled in the current pilot and is not used to invent catalogue listings.

Providers, sharing and transfers

Supabase supplies authentication and database services; Vercel hosts the website and server functions; Resend is configured for SchollyUp transactional email. Google Workspace handles business email, and Google may act as a sign-in provider if you choose that method. Paystack and Anthropic integrations exist in code but billing and AI are currently disabled in the pilot.

We do not sell your personal information. We share only what is needed with service providers, authorised advisers or lawful authorities. Following an official application link does not automatically submit your SchollyUp profile or documents to that provider.

Some providers may process information outside South Africa. We cannot represent that every service or backup stays in South Africa. We review provider locations and safeguards under POPIA before relying on cross-border processing. Contact us for more detail about a particular provider.

Storage, security and retention

We use access controls, authentication, restricted service credentials and secure transport to reduce risk. No online service is completely secure. Report suspected unauthorised access to us promptly.

We keep data while needed to provide an active account, resolve a request, prevent misuse or meet a legal record-keeping obligation. On account deletion we remove user-owned data through our deletion workflow, subject to lawful payment, audit, backup or dispute retention. Exact retention periods and provider backup windows are under review; we will publish approved periods when established.

Your choices and rights

You can edit your profile, export account data and request account deletion in Account settings. You may also ask info@schollyup.com about access, correction, deletion, objection, withdrawal of consent, marketing opt-out or a privacy complaint. We may need to verify your identity and may retain information where law permits or requires it.

You can complain to South Africa's Information Regulator. We will assess any security compromise and make notices required by applicable law. An Information Officer registration and PAIA manual are being reviewed; we do not claim completed registration here.

Communications and updates

Account, security, support and requested reminder messages are different from optional marketing. We do not use your acceptance of these policies as marketing consent. We will provide an opt-out for any marketing introduced later; essential account or security notices cannot always be stopped while the account is active.

Material privacy changes will be dated and brought to your attention where appropriate. The effective and update date of this version is shown below.