Privacy

Paper Spot is a study aid for UNISA past papers. You can read every module page without giving us anything. This page says what we hold when you do, why, for how long, and how to have it removed. It follows the Protection of Personal Information Act (POPIA).

What we collect

Your phone number — only if you sign in, buy a pass, request a module, or send us a paper. It is the account: there is no password and no email. We send a one-time code to it by SMS, and a pass is tied to it.

A payment reference — when you pay by card. The card itself is handled by Whop, our payment processor; we never see or store card numbers. We keep the Whop payment id and our own reference so we can find your pass, refund it, or move it to the right number.

Page analytics — which module pages are opened, whether the unlock sheet was opened, and which link brought you here (a group, a search engine, an advert). Signed-out visitors are counted under a random device id, not a name. We also use PostHog to understand how the pages are used; it is configured to mask anything typed into a form, and it never records phone numbers or card details.

What you upload — a paper or memo you send us, and the number you give with it so we can unlock your module once it is verified.

What we do not collect

No names, no email addresses, no ID numbers, no card numbers, no location. Nothing is sold or shared with advertisers. We do not profile you.

Why

To sign you in, to grant and keep the pass you paid for, to tell you when a module you requested is live, and to see which pages help students and which do not. That is all the data is used for.

How long

Your number and passes: for as long as your account exists. Payment references: for as long as we may need to refund or trace a payment, and as long as the law requires us to keep transaction records. Our own analytics events: deleted after 12 months by a monthly job. PostHog usage data: kept by PostHog under its own retention, which on our plan is one year for events and 30 days for session recordings. Uploads: until verified and processed, then the file is deleted and only the extracted questions remain.

Who else sees it

Whop (card payments), Supabase (our database), Vercel (hosting), our SMS provider (the one-time code), and PostHog (analytics, EU servers). Each sees only what it needs for its job.

Your rights

You can ask what we hold about your number, ask us to correct it, or ask us to delete it. Deleting your account deletes your number, your passes and your study progress; a pass you paid for cannot be restored afterwards. Write to paperspot.help@gmail.com from the number or with the payment reference, and we will do it within 14 days. If you are unhappy with how we handled it, you may complain to the Information Regulator of South Africa.

Cookies

A session cookie to keep you signed in, a device id so a pass bought on this phone opens on this phone, and the analytics cookies above. The live site also loads Google Ads measurement, which sets its own cookies so Google can tell whether an advert led to a purchase; we send it no phone numbers or other personal data.

See also the terms and the takedown policy.