This policy explains what personal information the Academy collects when you use our app, why we collect it, who else handles it, and what rights you have over it. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
Last updated 25 September 2026
Who we are
Nikolas Michael Academy — a sole proprietorship operated by Nikolas Michael
5 Ypsilanti Avenue, Glen Ashley, Durban, 4051, South Africa
nik@nikolasmichael.co.za
Nikolas Michael is the responsible party for your personal information and the person who answers privacy requests.
What we collect, and why
- Name and email — to create your account, sign you in, name your certificate, and contact you about your membership.
- Password — stored only as a cryptographic hash by our authentication provider. We never see your actual password.
- Membership status — to know whether your membership is active. We record status and dates, not your card details.
- Portfolio photographs — photographs of your practical work, uploaded by you so Nikolas can assess your competence and give feedback.
- Progress and assessment — lessons completed, feedback given on your work, and whether a certificate has been awarded.
- Technical records — sign-in times and error logs, kept for security and to fix faults.
We never see your card details. Payments are processed by Paystack, or by Apple or Google where you buy inside the app. Your card number never reaches our app or our database.
Photographs of other people
If a photograph you upload shows a client, a model, or anyone other than yourself, you must have that person’s permission before uploading it. Please do not upload photographs that identify a client’s face without their agreement. You remain responsible for having obtained that consent.
Portfolio photographs are visible only to you and to Nikolas Michael, and are held in private storage that other students cannot reach.
We will not use your photographs in marketing, on social media, or anywhere public without asking you first and getting your agreement in writing.
Who else handles your information
- Supabase — accounts, database, photograph storage (United States)
- Paystack — card payments and subscription billing (South Africa / Nigeria)
- Bunny.net — video delivery (EU and global edge network)
- Apple / Google — app distribution, and in-app payments where used (United States)
Information leaving South Africa
Because our database and video hosting sit outside South Africa, your information is transferred across borders. POPIA permits this where the receiving provider offers comparable protection, and each provider above is contractually bound to that standard. If you would prefer your information not to be transferred in this way, we unfortunately cannot provide the service.
How long we keep it
- Account details — while your account is open.
- Portfolio photographs — for 12 months after your membership ends, then deleted. Sooner if you ask us.
- Certificate records — kept indefinitely, so a certificate can be verified in future. A qualification nobody can confirm is worth little.
- Payment records — five years, as South African tax law requires.
Your rights
Under POPIA you may ask what we hold about you, ask us to correct it, ask us to delete it and close your account, object to how we use it, or ask for it in a portable form.
Email nik@nikolasmichael.co.za and we will respond within 30 days. There is no charge.
To close your account and have your information erased, see Delete your account.
If you are not satisfied with how we handled your request, you may complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — POPIAComplaints@inforegulator.org.za, inforegulator.org.za.
Security
Accounts are protected by password, with optional two-factor authentication by email. Portfolio photographs sit in private storage only you and Nikolas can reach. Course videos are served through short-lived signed links. Information is encrypted in transit.
No system is perfect. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.
Children
The Academy is intended for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has registered, contact us and we will remove the account.
Changes
If we change this policy we will update the date above and, where the change is significant, tell you in the app or by email.