TrainAgent
Privacy

What TrainAgent processes, why, who else touches it, and for how long. Written to be checkable rather than comfortable.

Last updated 17 October 2026

1Who this is and what it covers

TrainAgent is a training assessment platform operated from South Africa. It listens to technical training deliveries, produces a transcript, and assesses the quality of the teaching against a published rubric, citing the transcript for every judgement.

This policy covers the TrainAgent platform, the marketing site at trainagent.co.za, and the tenant workspaces served from it. It is written with the Protection of Personal Information Act 4 of 2013 (POPIA) in mind.

2Two different roles, and which one applies

For the training content our customers put through the platform, the customer is the responsible party and TrainAgent is an operator. They decide which sessions are captured and who is told. We process it on their documented instruction and for no other purpose.

For our own account holders, our marketing site and our billing, TrainAgent is the responsible party.

This distinction decides who must obtain consent to record a session. It is the customer, not us. See clause 4.

3What is processed, why, and for how long

Meeting audio
Captured only for sessions a customer has scheduled for assessment. Converted to a transcript, then used to produce the assessment. Retained for the term of the customer agreement and deleted on written request.
Transcripts
The evidence every score is cited to. A score without its transcript is an opinion, so the transcript is kept as long as the assessment it supports.
Trainer identity and assessments
Name, work email, the sessions delivered and the resulting scores and findings. Used to give the trainer their own feedback and to show change over time.
Learner pulse responses
Anonymous by construction. See clause 5.
Account data
Email address, display name, role and workspace membership. Used to sign you in and decide what you may see.
Security audit log
IP address, user agent and the name of whoever acted, against sensitive actions. Personal fields are automatically redacted after 90 days and the entries deleted after 400 days.

Where a period is stated above it is enforced in code. Where it is not, deletion is on request and is carried out by a person.

4Recording, and who has to say so

A session is only captured when a customer schedules it for assessment. Nothing is recorded speculatively and there is no always-on listening.

The customer is responsible for telling participants that a session is being captured and assessed, and for obtaining any consent the law requires of them. TrainAgent provides the means and refuses to assume the permission.

Where the platform joins a meeting to capture it, it appears in the participant list under the customer’s own name. It is never disguised as a person.

5Learner feedback is anonymous by construction

Pulse responses carry no identity because the database has nowhere to put one. The table has no user, email, IP or session column. This is a structural guarantee, not a setting that could be switched off.

Responses are only ever read back as an aggregate, and the aggregate returns nothing at all below three responses, so a small group cannot be de-anonymised by arithmetic.

6Who else processes it

We use a small number of providers, each for one stated purpose:

Amazon Web Services
Hosting. The application runs in the Ireland region.
Microsoft Azure
Meeting capture. Audio recorded from meetings is held in the South Africa North region and transcribed in the United Kingdom.
Anthropic
The assessment model, running in the United States. Transcripts are sent for assessment and are not used to train models.
Supabase
Database, authentication and file storage, hosted in Ireland.
Resend
Transactional email: invitations, sign-in codes and notifications.

We do not sell personal information, and we do not share it for advertising.

7Where it lives, and when it leaves

The application is hosted on Amazon Web Services in Ireland, within the EU. The audio captured from meetings is in the South Africa North Azure region. The audio is transcribed in the United Kingdom, on a machine that reads it from South Africa and returns the transcript. The database and file storage that hold transcripts, assessments and account records are hosted in Ireland, within the EU. Assessment requests are processed by Anthropic in the United States, and email is delivered by a provider outside South Africa. Each of those is a cross-border transfer, and we rely on the recipient being subject to law or binding agreement that provides comparable protection, as POPIA section 72 requires.

8How it is protected

Every workspace is isolated at the database level rather than by application code, so a query that forgets to filter by tenant returns nothing rather than someone else’s training. Administrator accounts require multi-factor authentication. Traffic is encrypted in transit and data is encrypted at rest. Sensitive actions are recorded in an audit log that the operator reviews.

9Assessment is evidence-based, and says when it cannot judge

Assessments are produced with the help of a language model, and every judgement is verified against the transcript before it is shown. A finding whose citation cannot be verified is withheld. A criterion whose evidence does not hold is reported as insufficient evidence rather than scored.

An assessment is a professional development instrument. It is not designed to be, and should not be used as, the sole basis for a decision about a person’s employment. A trainer may ask for the evidence behind any score and may dispute it.

10Your rights

You may ask what we hold about you, ask for it to be corrected, ask for it to be deleted, or object to how it is used. If you are a trainer or a learner, the fastest route is usually the organisation that engaged you, because they decide what is captured. You may also write to us directly and we will act on it.

You may also complain to the Information Regulator of South Africa.

11Changes

When this policy changes materially we will say so on this page and date it. The date at the top is always the date of the version you are reading.

12Contact

Write to hello@trainagent.co.za. Privacy requests are answered by a person, not a form.

Questions about anything on this page: hello@trainagent.co.za. See also Privacy, Terms and Support.