THE SILENT AUTHORITYScope, responsible party and audience
This Privacy Policy explains personal information processed in connection with The Silent Authority (TSA) website, app, accounts, subscriptions, support and related resources. The responsible party is Sinclair Press (Pty) Ltd, registration number 2026/763617/07, trading as The Silent Authority. TSA is intended for educators and professional users, not learner account registration. Official company, Information Officer and address particulars for access-to-information requests are accessible through the Legal & Compliance page.
Educator-created learner and parent/guardian records
Educators should only record or submit information they are authorised to handle for a legitimate school or professional purpose. A real incident may involve a learner’s identity, a health condition, a safeguarding disclosure or other sensitive facts. TSA does not prohibit the teacher from describing such incidents, but identifying and sensitive details must be limited to what is needed, kept out of marketing and payment fields, and handled under the relevant school’s policies and lawful instructions. Where an identifying detail is not required for guidance, use a non-identifying description.
TSA provides local-device case-record features for individual educators. Records saved through those features ordinarily remain on the educator’s device, subject to its browser/app storage, security settings and deletion behaviour. A teacher must still use the school’s official record and safeguarding processes when these are required. Do not assume that a local case record is automatically synchronised to the school or the company.
The custom-scenario guidance field is different from the device’s case-record area. When an incident is not resolved through the on-device instant library, the submitted description, including any learner details actually entered, is sent to our Supabase-hosted response service. This processing occurs even when the response is generated by server-side local rules and does not use an external AI model. Only the minimum necessary details should be entered, especially in cases involving children, health or safeguarding.
Instant responses, tailored scenarios and AI-assisted processing
TSA first checks its pre-prepared, on-device response library. When a custom description requires the hosted response service, the original description is transmitted to our protected Supabase Edge Function. The function can provide local rule-based guidance, including confidential health, emergency, safeguarding and safety routes. It does not automatically send the description to an external AI provider. Where the teacher’s request cannot be matched safely, the response may be general rather than individually tailored.
For certain ordinary classroom matters requiring an external AI fallback, the Supabase function replaces the entered incident with one of a limited set of fixed, non-identifying classroom summaries before invoking Groq. The original teacher-entered scenario, learner names, contact details, medical facts, safeguarding disclosures and other case particulars are not passed directly to Groq through the currently deployed guidance function. The server enforces an allowed-summary list at the external-call boundary. This safeguard does not mean that the original description never left the device: Supabase initially receives it.
Custom-scenario demand tracking. When an authenticated teacher uses the custom-scenario feature, TSA may submit an approved topic code, response route, account identifier and time to a separate analytics service. The event is account-linked and is not anonymous. The analytics endpoint is designed not to retain the original typed description in its event metadata. Ordinary infrastructure and security logs are separate from this limited topic event.
AI controls and limitations. Groq processes only the generic summary required for the applicable inference request. Groq’s published retention rules distinguish transient inference from usage metadata, which is still collected. A Groq Console reviewed on 9 October 2026 showed global Zero Data Retention (ZDR) enabled for inference; the exact production key-to-console association has not been independently attested. ZDR does not prevent processing in another country, remove all technical metadata or guarantee deletion across other service providers. TSA guidance is professional decision support, not a clinical diagnosis, substitute for emergency services or final school disciplinary determination.
Website resource forms and optional marketing
When you request a free resource, Sinclair Press processes the email address you provide, optional name, resource/form source and campaign attribution needed to deliver or administer that request. Resource delivery does not require optional promotional consent. If you separately tick the marketing box, the consent wording/version, time and source are recorded so TSA can send updates, practical resources and offers. You may unsubscribe or object at any time.
Accounts, subscriptions and transactions
Account identifiers, contact information, subscription status, payment references, service access and support or complaint records are processed as needed for authentication, delivery, billing, refunds, security and compliance. Paystack processes live TSA Pro subscription payments. We do not intentionally include learner incident descriptions in payment metadata, and TSA does not store raw payment-card credentials. Card information is handled through the payment provider's payment flow.
Service providers and cross-border processing
Service providers. Netlify hosts the website and installable web application. Supabase provides account authentication, entitlements, protected Edge Functions, hosted service data and account-linked topic analytics. Groq provides some generic, de-identified AI inference. Paystack processes paid TSA Pro transactions; Selar facilitates digital-product purchases. HOSTAFRICA provides domain/DNS services and HMailPlus business correspondence at evelyn@sinclairpress.co.za. Google/Gmail may separately process company correspondence where those services are actually used. Resend is operational for account verification and password-recovery messages sent through the authenticated domain auth.sinclairpress.co.za; it processes recipient email addresses, delivery/message details and related metadata. No learner incident information is intentionally passed to the payment or transactional-email services.
Where processing occurs. The TSA Supabase project’s primary database and authentication region is Ireland (EU, eu-west-1). Supabase’s terms permit specified operations, technical support and subprocessors outside that region, including Singapore and the United States. Groq’s inference service and its providers may process data in the United States and other operational locations even when ZDR prevents ordinary prompt/output retention. Resend states that customer content and delivery logs are stored in the United States. Netlify’s distributed delivery, Paystack, Selar, HOSTAFRICA and any separate email services may involve cross-border processing or onward transfers; individual service locations remain subject to provider confirmation where not independently established.
Legal transfer safeguards. Where POPIA applies to a transfer from South Africa, the responsible party must identify a permitted ground under section 72, including, where relied upon, a law or binding agreement with substantially similar privacy protections and onward-transfer terms. Supabase, Groq, Resend and Netlify publish data-processing agreements and subprocessor safeguards; their application to particular company accounts, destinations, child/health data and further transfers is reviewed in the company’s internal transfer assessment. A provider’s DPA, a European hosting region or ZDR status does not alone certify POPIA compliance. Sensitive or child-related submissions receive additional local routing and data-minimisation safeguards before any external AI request.
Institutional use. Where an educational institution formally adopts TSA, the school’s and Sinclair Press’s responsibilities and any operator agreement must be documented for the actual deployment. A teacher subscribing independently does not establish that the teacher’s school has entered into an institutional data-processing agreement with Sinclair Press.
Technical activity and analytics
The website and app may process technical logs and information necessary for security, error handling, account service and diagnostics. TSA also uses custom-scenario topic/category tracking as described above. At this review, the static website package did not show an independently loaded advertising pixel or third-party behavioural-analytics script; that does not mean hosted systems collect no service logs or product-use information. We review and update this notice when the active tracking, recipients or purposes materially change. Optional promotional email is separate from providing a requested resource or an account service.
Legacy records and exports
Where a user has older beta data in a hosted workspace, those records may require separate review, export or deletion. Do not assume that clearing local browser storage deletes historical hosted records. Contact us for assistance if older TSA records need to be located or removed, subject to applicable legal retention and identity verification. Exports and downloaded copies become the user's responsibility to secure and disclose lawfully.
Evidence and professional records
Guidance, scenario records and evidence references are decision-support tools, not a substitute for authorised school records or an official finding. Do not submit original confidential learner evidence through ordinary support, billing or custom-scenario channels. Review any downloaded PDF, JSON or other export before sharing it and secure copies under your employer's records and safeguarding policies.
Retention and deletion
Local case-record information ordinarily remains in the device’s protected app/browser storage until the user deletes it or the storage is cleared, subject to device and browser behaviour. Deleting an app or changing devices can also remove records. Hosted account, subscription and financial records are retained as needed for service operation, security, disputes and legal/accounting obligations, and may be subject to provider-specific retention or backups. Deleting a local record does not necessarily delete separate hosted account or topic events.
The currently deployed AI guidance function does not intentionally persist the submitted raw incident text in the separate topic-event analytics table, and Groq receives only a fixed generalised scenario for qualifying requests. However, raw descriptions reach the Supabase response service and may be present in infrastructure-level operational traces under provider controls. Groq’s ZDR setting, where applicable, concerns certain inference-content retention, not all usage metadata. The exact expiration periods for account-linked topic events, all security logs and every provider backup are still being documented; we do not promise immediate or universal deletion.
Subject to POPIA and legally required retention, individuals may request information, correction, deletion or an explanation of relevant processing using the contact details below. We may need to verify the requester’s identity, work with the applicable school when it controls a learner record and retain data required by law.
Notice, choices and contact
Information supplied for accounts, support and purchases is used for those services; information requested as mandatory will be identified at the relevant collection point. Optional marketing consent is separate and may be withdrawn through the unsubscribe page. Subject to POPIA, rights can include access, correction, deletion and objection. Contact evelyn@sinclairpress.co.za or telephone 071 405 2832. Statutory business and Information Officer particulars are available through the Legal & Compliance page. The Information Regulator receives applicable privacy complaints.
Complaints and privacy governance
Consumer complaints can be submitted through the Complaints route. Do not include learner information in an ordinary consumer complaint unless it is genuinely required through an authorised process.
PAIA and access to information
For access-to-information requests and the PAIA Manual, see the Legal & Compliance page.
Security
TSA uses HTTPS, server-side key management, authenticated backend services, access controls, privacy-aware AI routing and protected local storage for identifiable learner case records within the current app. For externally generated classroom guidance, the backend sends only an approved non-identifying summary to Groq. Teachers and institutions remain responsible for device security, access permissions, official incident records and appropriate confidential handling.
No online service can guarantee complete security or anonymity. If you believe learner or account information has been exposed or sent to the wrong recipient, promptly contact evelyn@sinclairpress.co.za so the situation can be assessed under the company’s privacy and incident-response procedures.
Last reviewed: 9 October 2026. This notice reflects the deployed functions and known provider arrangements as reviewed on this date. It is not a certification of legal compliance or a guarantee of fixed provider retention periods.