Your information, protected

Who we are

Leeto (leeto.technology) helps South African students calculate their APS score, and find the courses and bursaries they qualify for across all 26 public universities. Leeto is the “responsible party” under POPIA for the personal information described here. You can reach us about anything privacy-related at privacy@leeto.technology or on WhatsApp at +27 72 778 1322.

What we collect, and why

• Account details — your email address, so you can sign in and we can contact you about your account.
• Profile details — your name, date of birth, gender, contact details, address, school, matric year, subjects and marks. We use these to calculate your APS score and match you with courses and bursaries you qualify for. Your race is asked because universities require it on application forms for equity reporting. Your SA ID number is optional — you only add it if you want it pre-filled on the application form we prepare for you.
• Documents — files you choose to upload (ID document, matric results, school reports). They are stored so you can reuse them across applications. If you use the AI reading feature, the document is sent to our AI provider once to extract the details, and is not used to train any AI model.
• Usage information — anonymous, cookie-free statistics about how the site is used (which pages are visited, on what kind of device), so we can improve Leeto. This is never linked to your identity.

We collect this information directly from you, only process it for the purposes above, and never sell it to anyone.

Race and other special personal information

South African universities ask for race on their application forms for equity reporting required by national policy. POPIA treats this as special personal information, so we only process it with your explicit consent, and you can always select “prefer not to say”.

If you are under 18

POPIA requires a parent or guardian’s permission before we process a child’s personal information. If you are under 18, please make sure a parent or guardian knows you are using Leeto and is okay with it — we ask you to confirm this when you create your profile.

Who processes your information for us

We use a small number of trusted service providers (“operators” under POPIA) to run Leeto. Each one only receives what it needs to do its job:

Some of these providers store information outside South Africa. We only use providers that protect your information to a standard consistent with POPIA, as section 72 of the Act requires.

How long we keep it

We keep your information while your account is active. If you delete your account, your profile, documents and application records are permanently deleted. We may keep anonymised statistics that can no longer identify you.

How we protect it

Your information is encrypted in transit (HTTPS) and at rest with our hosting providers. Access is limited to what is needed to operate Leeto, and sign-in is handled by a dedicated authentication provider rather than passwords we store ourselves.

Your rights under POPIA

• Ask what personal information we hold about you, and get a copy.
• Correct anything that is wrong — you can edit your profile at any time.
• Delete your account and all your data yourself, from the bottom of your profile page, or by emailing us.
• Withdraw your consent at any time (this may mean parts of Leeto stop working for you).
• Object to how we process your information.
• Complain to the Information Regulator of South Africa: inforegulator.org.za · complaints.IR@inforegulator.org.za

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or with a notice on the site before the change takes effect, and we will always show the effective date at the top of this page.