Executive Summary
Your school keeps its data
Purpose-built for POPIA
Nothing to install
What Taal Rooster Does
For Teachers
Create assignments
Define a topic, attach a rubric with four-level descriptors, set a max recording length and due date. Optionally record an explainer video.
Grade with context
Grading view places the video alongside the rubric. Click any point on the timeline to leave a comment anchored to that exact moment. Record audio feedback too.
Peer moderation
Assign moderator teachers or invite external moderators by email. Structured checklists keep reviews consistent. Grades are visible to you but stay private from the student. When peer feedback is enabled, post comments, delete any peer comment, or ban a student from a specific assignment's grid. Flagged comments (reported by students) surface with a reason and note for your review; resolved flags are retained for audit.
Template sharing
Share assignment structures across the department or school as reusable templates.
Class management
Create classes with join codes or links. Import rosters from Google Classroom. Track submission progress.
Printable grade reports
Generate customisable grade reports per student, including rubric scores, feedback, and moderation results.
For Students
Record at their own pace
Press record, preview, re-record as many times as needed. Drafts auto-save.
Works on any device
Laptop, tablet, or phone — any device with a browser and camera.
View feedback
Rubric scores, timestamped written comments, and audio notes from their teacher.
Peer feedback
When enabled, view classmates' public submissions and leave comments. Students can flag a comment as inappropriate, bullying, spam, or other — notifying the teacher immediately for review.
Resubmissions
Teachers can request resubmissions. Students see original feedback alongside the new recording.
For School Administrators
Admin dashboard
Centralised view of all teachers, classes, and platform activity.
Custom branding
Apply your school's colours and logo across the platform.
Default templates
Set school-wide default rubrics, moderation checklists, and print report templates.
Audit logging
Compliance-ready log of significant actions across the school.
Parental consent management
Built-in workflow for collecting and tracking consent for minor students.
How It Works
A simplified technical overview for IT staff evaluating the platform.
User's Browser
No install required
Taal Rooster Cloud
Auth, database, edge functions
Google Drive / OneDrive
School-owned storage
Video Upload Flow
- 1The student records a video in their browser.
- 2The video is temporarily uploaded to secure cloud staging storage.
- 3A server-side function transfers the video into the teacher's Google Drive or OneDrive folder.
- 4The temporary copy is deleted.
- 5Only a reference (file ID and link) is stored in the Taal Rooster database.
At no point is the video stored long-term on Taal Rooster infrastructure. The teacher's cloud storage account is the sole permanent location.
Authentication
Users can sign in with:
- Email and password
- Google account (OAuth 2.0)
- Microsoft account (OAuth 2.0)
Passwords are hashed using bcrypt and never stored in plaintext.
Data Ownership and Storage
This is the platform's most important architectural decision from a governance perspective.
What Taal Rooster stores
| Data | Where Stored | Retention |
|---|---|---|
| User profile (name, email, role) | Taal Rooster database | While account is active |
| Class structure and enrolment | Taal Rooster database | While account is active |
| Assignment definitions and rubrics | Taal Rooster database | While account is active |
| Submission metadata (grades, feedback) | Taal Rooster database | While account is active |
| Audit log entries | Taal Rooster database | While school is active |
What Taal Rooster does NOT store
| Data | Where Stored | Controlled By |
|---|---|---|
| Student video recordings | Teacher's Google Drive / OneDrive | The teacher / school |
| Teacher explainer videos | Teacher's Google Drive / OneDrive | The teacher / school |
| Audio feedback recordings | Teacher's Google Drive / OneDrive | The teacher / school |
No vendor lock-in
If you stop using Taal Rooster, all video content remains in the school's cloud storage.
No additional storage costs
Video storage uses the school's existing Google Workspace or Microsoft 365 allocation.
IT retains control
Workspace/365 admin consoles continue to govern sharing permissions, retention policies, and DLP rules.
Data residency follows your tenant
If your Workspace/365 is configured for a specific region, video files inherit that residency.
POPIA Compliance
The Protection of Personal Information Act, 2013 (POPIA) governs how personal information is collected, used, and stored in South Africa.
Lawful Basis for Processing (POPIA sections 10-12)
| Basis | Application |
|---|---|
| Consent (section 11) | Users provide explicit consent when creating an account. For minors, parental consent is obtained through a dedicated workflow. |
| Contractual necessity | Processing user data is necessary to provide the educational service. |
| Legitimate interest | Limited processing for platform security and audit logging. |
Conditions for Lawful Processing
| POPIA Condition | How Taal Rooster Complies |
|---|---|
| Accountability (Condition 1) | A designated Information Officer is responsible for compliance. |
| Processing limitation (Condition 2) | Only necessary data collected. No date of birth — just an 'under 18' declaration. Parent details deleted after consent. No IP addresses stored. |
| Purpose specification (Condition 3) | Data collected solely for account management, assignment facilitation, grading, and compliance. |
| Further processing limitation (Condition 4) | No marketing, profiling, advertising, or analytics tracking cookies. |
| Information quality (Condition 5) | Users can update their profile information at any time. |
| Openness (Condition 6) | Comprehensive Privacy Policy publicly accessible. |
| Security safeguards (Condition 7) | Encryption, access control, and database-level security policies. See Security section. |
| Data subject participation (Condition 8) | Self-service data export and account deletion. See Data Subject Rights section. |
Cross-Border Transfers (POPIA section 72)
| Service | Provider | Purpose | Safeguards |
|---|---|---|---|
| Cloud infrastructure | Supabase (AWS) | Database, auth, edge functions | SOC 2 Type II; encrypted in transit and at rest |
| Video storage | Google Drive / OneDrive | Student video recordings | Governed by school's Workspace/365 agreement |
| Authentication | Google / Microsoft | OAuth sign-in | Industry-standard OAuth 2.0 |
| Payment processing | Paystack | Subscription billing | PCI DSS Level 1 certified |
GDPR Alignment
For international schools or schools with European connections, Taal Rooster's practices also align with the EU General Data Protection Regulation:
Data minimisation
No DOB collected; parent PII deleted after consent; no IP addresses stored
Right to erasure (Art. 17)
Self-service account deletion removes all personal data
Right to portability (Art. 20)
Self-service data export in machine-readable JSON
Data Protection by Design (Art. 25)
Video in school's Drive, minimal PII, encrypted tokens — built in, not bolted on
COPPA Considerations (US Schools)
No personal information is collected from children without parental consent. The is_minor boolean avoids collecting date of birth. Error tracking is configured to strip all user-identifying information and disable session replays.
Data Breach Notification
In the event of a security breach, Taal Rooster will notify the Information Regulator as required by POPIA section 22, notify affected data subjects as soon as reasonably possible, and provide details of the breach and recommended protective measures.
Security Measures
Encryption
- TLS 1.2+ (HTTPS) for all data in transit
- AES-256-GCM for OAuth tokens at rest
- bcrypt password hashing
- SSL-encrypted database connections
Access Control
- Row-Level Security on every database table
- Role-based application routing
- Cloud storage tokens never exposed to browser
- JWT sessions with automatic expiry
Video Access Control
- Students can only view own submissions
- Teachers can only view own assignments
- Peers see only public submissions in their class
- All streaming proxied with per-request access checks
Audit Logging
- Account creation and deletion logged
- Data exports logged
- Parental consent events logged
- IP addresses architecturally removed — never recorded
- 7-year default retention (configurable per school); critical entries pinned indefinitely
Error Monitoring
- Email, username, and IP stripped from all error reports
- Session replay completely disabled
- Only technical data (stack traces, browser) transmitted
Parental Consent for Minors
In accordance with POPIA section 35, Taal Rooster implements a formal parental consent workflow for students under 18.
Registration
Student indicates they are under 18 via a checkbox (no date of birth collected) and provides parent/guardian name and email.
Consent request
The platform sends the parent an email with a unique, time-limited consent link (valid for 14 days).
Consent confirmation
The parent visits the link, reviews the student's name, and confirms consent.
Data cleanup
Upon confirmation, the parent's name and email are immediately deleted. Only the boolean flag and timestamp are retained.
Account restriction
Until consent is confirmed, the student account has restricted access.
No DOB collected
A simple checkbox replaces date of birth entirely.
Parent PII is transient
Name and email exist only during consent, then are permanently deleted.
Verifiable consent
Schools can confirm consent was obtained via audit log and profile flag.
Abuse & Safeguarding
Because student video files are stored in the teacher's or school's own Google Drive or Microsoft OneDrive — not on Taal Rooster's servers — we do not view, stream, or process the content of video submissions. This is the strongest single privacy protection we can offer, but it also means we rely on reports to identify abuse of the Platform.
Division of Responsibility
| Surface | Who can see | Who governs |
|---|---|---|
| Video content (face, voice, spoken content) | Teacher, school (via their own Drive/OneDrive) | School — using Google Workspace / Microsoft 365 admin controls |
| Assignment titles, rubrics, written feedback, peer comments | Teacher, student, school admin | Taal Rooster — reportable, actionable, subject to AUP |
| Account metadata, audit logs | Taal Rooster | Taal Rooster — retained per Privacy Policy |
Reporting Channels
Abuse reports
CSAM and child-safety reports
What We Can Do Without Viewing Videos
- 1Suspend the reporting user, the reported user, or both, pending investigation.
- 2Revoke submission links or share permissions under our control.
- 3Delete the file reference in our database (the underlying video file remains in the school's Drive for the school's own review, deletion, or preservation for investigation).
- 4Require the school or teacher to confirm the outcome of their own investigation before restoring access.
- 5Terminate the school's or user's account for a breach of the Acceptable Use Policy.
- 6Cooperate with lawful law-enforcement requests and preserve metadata as required.
What the School Is Expected to Do
- Maintain and apply an acceptable-use and safeguarding policy for students using the Platform.
- Use Google Workspace or Microsoft 365 admin controls to govern who can view, download, share, or delete video files in the school's cloud storage.
- Investigate reports promptly in accordance with the school's safeguarding policies and communicate outcomes to Taal Rooster.
- Preserve video files and related evidence for investigation or legal process where relevant, and delete content that breaches the school's policies or applicable law.
- Obtain and maintain verifiable parental consent for minor students in accordance with the Operator Agreement.
Law Enforcement Requests
Taal Rooster responds only to lawful orders (warrants, subpoenas, or equivalent instruments). Because video content is not in our possession, requests for video content are redirected to the school or to the relevant storage provider (Google LLC or Microsoft Corporation). Where we hold metadata responsive to a lawful request, we will cooperate and, where permitted, notify the affected account holder.
Data Subject Rights
Self-service tools are accessible from the Account Settings page.
Data Export (POPIA section 23)
Correction (POPIA section 24)
Deletion (POPIA section 24)
Right to Object (POPIA section 11(3)): Contact the Information Officer at contact@taalrooster.co.za to object to processing. Users may also lodge complaints with the Information Regulator of South Africa.
Infrastructure Requirements
What your school needs
- Internet connection: Standard broadband. A 2-minute video is ~20-50 MB.
- Web browser: Chrome, Firefox, Safari, or Edge (last 2 major versions).
- Camera and microphone: Built-in or external. Most devices have these.
- Google Workspace or Microsoft 365: Teachers need an account for storage. Most schools already have this.
What your school does NOT need
- Server hardware or hosting
- Software installation
- IT configuration for storage
- Network allowlisting (standard HTTPS to well-known domains)
- Mobile device management
Device Compatibility
| Device | Support |
|---|---|
| Windows laptop/desktop | Full (Chrome, Edge, Firefox) |
| macOS laptop/desktop | Full (Chrome, Safari, Firefox) |
| Chromebook | Full (Chrome) |
| iPad / iPhone | Full (Safari, Chrome) |
| Android tablet / phone | Full (Chrome) |
Pricing
Both plans include a 14-day free trial. No credit card required.
Individual Licence
Also available quarterly (R300) or annually (R1,000 — 2 months free)
- Up to 5 active classes
- Unlimited assignments
- Unlimited submissions
- Google Drive / OneDrive integration
- Timestamped video feedback
- Audio feedback notes
- Peer feedback & moderation
- Template sharing
- 4-level rubric descriptors
School Licence
Also available quarterly (R2,280 — 1 month free/yr) or annually (R8,300 — 2 months free)
- Everything in Individual, plus:
- Unlimited teachers at the same school
- Unlimited students
- School admin dashboard
- Custom branding & school colours
- Default rubric & checklist templates
- Cross-department template bank
- Customisable print report templates
- Audit logging for compliance
- Parental consent management
- Priority support
After the trial
All existing data remains intact and accessible. Teachers simply cannot create new assignments. Video files remain in Drive/OneDrive — never deleted by Taal Rooster.
Implementation and Onboarding
Timeline
| Phase | Duration | Activities |
|---|---|---|
| Decision | — | Review this guide, trial the platform |
| Activation | 10 minutes | Admin registers, sets up school profile and branding |
| Teacher onboarding | 1 day | Teachers register, connect Drive/OneDrive, create classes |
| Student onboarding | 1 lesson | Share join codes; students register and join |
| First assignment | 1 lesson | Teacher creates assignment; students record and submit |
School Administrator
- 1.Register and select School Licence trial
- 2.Invite teachers or share the registration link
- 3.Configure branding (colours, logo)
- 4.Set default rubric templates (optional)
Teachers
- 1.Register or accept invitation
- 2.Connect Google Drive or OneDrive (one-time)
- 3.Create a class and share join code
- 4.Create first assignment with rubric
Students
- 1.Register with join code or link
- 2.Complete parental consent if under 18
- 3.Open assignment and record video
- 4.Submit
Google Classroom Integration
Teachers who use Google Classroom can import their existing class rosters directly, avoiding manual student enrolment.
Frequently Asked Questions
General
Do students need a Google or Microsoft account?
No. Students sign in with email and password. Their recordings upload to the teacher's cloud storage, not their own.
Can I use this for subjects other than languages?
Yes. Any subject that benefits from video — presentations, drama, science explanations, music, PE demonstrations — works the same way.
What happens to our data if we stop using Taal Rooster?
All video files remain in the school's Drive/OneDrive. Submission metadata can be exported. Taal Rooster never deletes video files in the school's own cloud storage.
Data and Privacy
Where are student videos stored?
In the teacher's own Google Drive or OneDrive. Taal Rooster stores only a file reference, never the video itself.
Does Taal Rooster sell or share personal data?
No. Personal data is used exclusively for providing the educational service. No advertising, no profiling, no third-party data sharing.
Is date of birth collected?
No. Students indicate whether they are under 18 via a simple checkbox. Date of birth is never collected, stored, or processed.
Can students see each other's videos?
Only if the teacher enables peer feedback for a specific assignment. Students can then view classmates' submissions marked as public.
Technical
Does Taal Rooster require any software installation?
No. It runs entirely in the web browser. Nothing for IT to deploy, update, or maintain.
What bandwidth does it require?
A typical 2-minute student video is 20-50 MB. Standard school broadband is sufficient.
Does it work on Chromebooks?
Yes. Full functionality in Chrome on Chromebooks.
Are there any firewall or network configuration requirements?
No special configuration needed. Standard HTTPS to well-known domains (Google, Microsoft, Supabase). Your Google Drive or OneDrive admin may need to grant access for the platform.
Billing
Is there a free trial?
Yes. 14 days, no credit card required. All features available during the trial.
Are there per-student charges?
No. The School Licence covers unlimited teachers and students for a single annual fee.
Can we pay by EFT/bank transfer?
Please contact us to arrange alternative payment methods.
Contact and Information Officer
General Enquiries
contact@taalrooster.co.za
Privacy and Data Protection
Information Officer: contact@taalrooster.co.za
- Responding to data subject access requests
- Handling privacy complaints
- Coordinating with the Information Regulator
- Overseeing POPIA compliance
Abuse & Safeguarding
contact@taalrooster.co.za
- Reports of content or conduct on the Platform
- Acknowledged within one business day
- CSAM reported to SAPS & FPB as required by law
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: complaints.IR@justice.gov.za
Website: inforegulator.org.za
Ready to get started?
Set up your first class in under two minutes. Free 14-day trial, no credit card required.