Privacy policy

Last updated 27 October 2026. Prepared with the Protection of Personal Information Act, 2013 (POPIA) in mind.

Who is responsible

The responsible party is TutorStack Pty Ltd (registration number 2025/504786/07), which runs Earn Path. You can reach us, including our Information Officer, through our contact page.

What we collect and why

Data	Why	Lawful basis	Kept for
Your assessment answers, and your first name if you choose to give it (used only to greet you on your results, plan and emails, and never sent to analytics). No ID number or contact details are asked for. The optional full profile also includes your work history, how you prefer to work, what motivates and drains you, and things you have done. We do not ask about health, religion, race, political views or other special personal information.	To produce your results, value profile and report	Your consent, given before you submit, and performance of the service you requested	24 months, then deleted automatically. You can delete them sooner yourself
Your account: email address, optional first name, and the date you agreed to these terms. If you set one, a password (stored only as a scrambled hash) and a two-step sign-in key	To give you a place for your plan, guides and receipts, and to keep it secure	Contract	Until you delete your account in Settings
Sign-in records: one-time codes and links (stored only as hashes, valid for 15 minutes), sign-in times and security changes	To sign you in and protect your account from misuse	Legitimate interest (security)	Codes until used or expired; sign-in and security records while your account exists
Guide progress: lessons done, quiz answers, XP, badges, streaks, saved templates, reminder settings and in-app notifications. XP and badges have no money value	To run the guides and show your progress	Contract	Until you delete your account
Email address for "email me my results" or "notify me", only if you tick the consent box	To send your results link and at most two follow-up emails, or one email when a guide is ready	Your consent	Until you unsubscribe (every email has a link) or 12 months, whichever is first
Email address on the contact form	To reply to you	Your consent	12 months
Order records (reference, amount, PayFast payment ID, status, and the referring source and device type of the visit)	Accounting, refunds, fraud prevention	Legal obligation	5 years
Aggregate counts: page path, funnel step (for example "saw the price" or "paid"), which section number of the test was finished (never your answers), the site or campaign that referred the visit and the device type (mobile, tablet or desktop), as daily totals only	Understand which pages and sources help people, and where they drop off	Legitimate interest	Indefinitely, as they contain no personal information

We set one cookie when you sign in (a session cookie, needed for your account to work). We set no advertising cookies, and no third-party analytics cookies unless you allow them (see Analytics below). We do not store IP addresses in our own analytics. We count page views and button taps (for example "took the test" or "shared a card") as totals per day in our own database. These counts are not linked to you. To see which sources lead to purchases, your browser keeps a short note in local storage of the site or campaign that referred you and your device type (for example "google|mobile"). It contains nothing about you, and is sent only with those counts and, if you buy, with your order record.

Analytics. We use two analytics tools.

• Ahrefs Web Analytics (run by Ahrefs Pte. Ltd., Singapore) counts visits on our public pages. It sets no cookies, stores nothing on your device and does not keep IP addresses. It counts unique visitors for one day at a time with a code that is thrown away every 24 hours, so it cannot follow you across days, devices or other sites. It sees the page address, the referring site, the device type, screen size, language and your city or country. Because nothing is stored on your device, it runs without the cookie notice. You can block it with any content blocker without losing any part of the site. Ahrefs may process this data outside South Africa.
• Google Analytics 4 (run by Google) loads only if you tap "Allow" on the cookie notice. If you tap "No thanks" or ignore the notice, it does not load and sets no cookies. When allowed, it sets Google Analytics cookies (named _ga) for up to 2 years, with IP anonymisation on and Google signals and ad personalisation off. It sees which pages are visited, the device type, the referring site and steps such as starting the test, seeing the price, starting checkout and a confirmed purchase (order reference and amount only), never your assessment answers, email or payment details. Google may process this data outside South Africa. You can change your mind at any time with "Cookie settings" at the bottom of every page, and you can block it with any content blocker without losing any part of the site. A short-lived rate-limit counter keyed on IP address is kept in memory only. Your in-progress assessment is saved in your own browser's local storage until you submit it.

Emails and reminders

We send account emails you need (codes, receipts, access to what you bought, security alerts). Guide reminders are optional and you control them in Settings: at most one a day, never between 20:30 and 07:30, and each has an opt-out link. Reminders about provisional tax only start after you tell us you have earned your first income. Emails are sent through a transactional email provider that only processes them to deliver them.

Signing in with Google

If you choose "Continue with Google", Google tells us your email address and name, and that Google has verified the email. We do not get your Google password, contacts or files, and we do not post anything.

Payments

Payments are processed by PayFast (Pty) Ltd. We never receive or store card details. PayFast's own privacy policy applies to the information you give them.

Sharing

We share personal information only with service providers that are necessary to run the service (hosting provider, PayFast, our email delivery provider and, if you use it, Google sign-in) under agreements requiring them to protect it, or where the law requires. Our hosting provider may process data outside South Africa; where it does, we rely on POPIA section 72 safeguards.

Your rights

• Download or delete your account: both are in Settings.
• Delete answers that are not in an account: use "Delete my answers" at the bottom of your results page.
• Order and receipt records are kept for five years, because tax law requires transaction records to be kept.
• Your other rights: ask what personal information we hold about you, ask us to correct or delete it, object to processing, or complain to the Information Regulator (inforegulator.org.za).

Because results are not linked to a name, include your results link or order reference when you contact us.

Security

Sign-in codes expire after 15 minutes and lock after five wrong tries. You can turn on two-step sign-in with an authenticator app, and sign out of every device from Settings. Access to admin functions is password-protected and logged. Data is stored in an encrypted-at-rest hosting environment. We will notify you and the Information Regulator of a security compromise as section 22 of POPIA requires.

Changes

We will date any change at the top of this page.