Privacy Policy
STATUS: DRAFT — NOT LEGAL ADVICE — REQUIRES ATTORNEY REVIEW BEFORE PUBLISHING. This document was drafted by an AI assistant to give a South African attorney a concrete starting point, grounded in what the SA Legal Doc Summariser codebase actually collects, stores, and processes as of 2026-07-13. It has not been reviewed by a qualified lawyer and must not be published, relied upon, or treated as POPIA-compliant until it has been.
[TODO: ...]markers show facts that need to be confirmed or supplied before this is publishable — do not delete them until they're resolved.
Last updated: [TODO: date of attorney sign-off]
1. Who This Policy Covers
This Privacy Policy explains how SA Legal Doc Summariser ("we", "us", "the
Service"), available at salegal.buildyard.co.za, collects, uses, stores,
and protects personal information under the Protection of Personal
Information Act 4 of 2013 (POPIA).
Responsible Party:
[TODO: legal entity or trading name and registration details — as of this draft, no registered company was found referenced anywhere in the codebase; confirm whether the Service is operated as a sole proprietorship or a registered entity, since POPIA requires the Responsible Party to be identified, and the operating structure affects personal liability. This is a decision for Eldrid, not something to assume.]
Information Officer:
[TODO: POPIA requires every Responsible Party to designate an Information Officer (can be the business owner for a small operation) and register them with the Information Regulator. Name/contact needed here.]
Contact for privacy queries:
[TODO: no public-facing support/privacy email currently exists — the only outbound address is a no-reply sending address (noreply@salegal.buildyard.co.za), and the in-app contact form requires an existing logged-in session, which isn't appropriate for e.g. a data-subject access request from someone without an account. A real, monitored address is needed here — e.g. privacy@ or support@ on the same domain.]
2. What Personal Information We Collect
We follow data minimisation: we only collect what the Service actually needs to function.
| Data | Purpose | Collected when |
|---|---|---|
| Email address | Account identification, magic-link login, billing, trial-limit enforcement | Sign-up / login |
| Document text you submit for analysis | Generating your AI analysis | Each analysis request |
| Analysis results (JSON) | Displaying and (if applicable) re-serving your results | Each analysis |
| Usage/subscription status | Enforcing free-trial limits and Pro entitlement | Ongoing |
| IP address | Rate-limiting/abuse prevention, security logging | Every request |
| Payment information | Billing | Handled entirely by our payment processor, Lemon Squeezy — we do not receive or store card details ourselves (see § 5) |
We do not collect: phone numbers, physical addresses, ID numbers, or any other personal information beyond what's listed above.
Important — your document text is not stored permanently. Once an analysis is generated, we retain only a one-way SHA-256 hash of the document text (used to detect if you submit the identical document again, so we can serve a cached result instead of re-analysing it) and the AI-generated analysis output. The original document text itself is not kept in our database after the analysis completes.
[TODO: attorney to confirm this framing is accurate and sufficient — verify against the actual current behavior of lib/db.ts and the document_analyses cache table before publishing, in case this changes.]
3. How We Use Your Information
We process your personal information for the following purposes, which we believe constitute justifiable processing under POPIA:
- To provide the Service — authenticating you, running your requested document analyses, and enforcing free-trial/subscription limits (processing necessary for the performance of a contract with you).
- To communicate with you — sending login links, welcome emails, and responses to support queries you initiate.
- To bill you, if you subscribe to a paid plan (processed by Lemon Squeezy, see § 5).
- For security and abuse prevention — rate-limiting, fraud detection, and logging security-relevant events (legitimate interest).
- To comply with legal obligations, where applicable.
We do not sell your personal information. We do not use your document text or analysis results to train any AI model.
[TODO: attorney to confirm the last sentence against Anthropic's actual API terms currently in effect — API usage is typically not used for model training by default, but this should be verified against Anthropic's current commercial terms rather than assumed, and re-checked if the Anthropic API agreement ever changes.]
4. Legal Basis for Processing
[TODO: attorney to map each processing purpose in § 3 to POPIA's specific "justifiable processing" conditions (Section 11) — consent, contractual necessity, legal obligation, protection of a legitimate interest, etc. This draft assumes contractual necessity for core service delivery and legitimate interest for security logging, but that mapping should be confirmed, not assumed.]
5. Who We Share Your Information With
We use the following third-party service providers ("operators" under POPIA) to run the Service. Each only receives the minimum data needed for its function:
| Provider | Purpose | What they receive | Location |
|---|---|---|---|
| Supabase | Database, authentication | Email address, analysis results, hashed document identifiers | EU (eu-west-1, Ireland) |
| Anthropic (Claude API) | AI document analysis | The text of documents you submit for analysis | [TODO: confirm Anthropic's API data-processing region/terms] |
| Resend | Transactional email delivery (login links, welcome email) | Email address | [TODO: confirm Resend's data-processing region] |
| Lemon Squeezy | Payment processing (Merchant of Record) | Payment details, billing email — handled entirely by Lemon Squeezy, not received by us | [TODO: confirm] |
Cross-border transfer notice: because our database provider (Supabase)
hosts data in the EU rather than South Africa, this involves a cross-border
transfer of personal information under POPIA Section 72.
[TODO: attorney must confirm this is adequately disclosed and, if necessary, add the specific safeguard/justification POPIA requires for this transfer — e.g. adequate level of protection in the destination country, or another Section 72 ground. Do not publish this policy without that confirmation — this is one of the more legally exposed parts of the whole document.]
We do not sell, rent, or otherwise trade your personal information to third parties for their own marketing purposes.
6. How Long We Keep Your Information
| Data | Retention period |
|---|---|
| Audit logs | 2 years |
| Security logs | 90 days |
| Error logs | 30 days |
| Account (email) and analysis results | For as long as your account is active, or as required by law |
[TODO: attorney to confirm these periods are POPIA-appropriate for their respective purposes — POPIA requires retention no longer than necessary for the purpose, not a fixed period; confirm the reasoning for each, not just the number.]
7. Your Rights Under POPIA
As a data subject, you have the right to:
- Access the personal information we hold about you;
- Correct inaccurate or outdated information;
- Request deletion of your personal information (subject to any retention we're legally required to keep);
- Object to processing carried out on the basis of legitimate interest;
- Complain to the Information Regulator of South Africa if you believe we have not handled your information lawfully.
[TODO: at the time of this draft, there is no self-service way to exercise these rights in the app — no account-deletion feature exists yet (docs/SECURITY.md already flags a DELETE /api/account endpoint as outstanding). This section should not be published claiming a right to deletion exists in practice until that endpoint is actually built, or until an alternative manual process (e.g. emailing a request) is clearly described and actually staffed.]
To exercise any of these rights, contact us at [TODO: same contact-address gap as § 1].
Information Regulator contact details:
[TODO: attorney/Eldrid to insert the Information Regulator's current published contact details — these can change, don't hardcode from memory.]
8. Security Measures
We implement technical and organisational measures to protect your information, including:
- Row-Level Security (RLS) enforced at the database level on all tables containing personal information;
- Rate limiting on all API endpoints to prevent abuse;
- Encrypted connections (TLS) for all data in transit;
- Security event logging and monitoring;
- Least-privilege access to production credentials.
No system is completely secure, and we cannot guarantee absolute security of information transmitted to the Service.
[TODO: attorney to confirm this section meets POPIA's "appropriate, reasonable technical and organisational measures" standard (Section 19) — this is a summary, not an exhaustive security audit; docs/SECURITY.md has more detail if needed for reference.]
9. Cookies
[TODO: confirm exactly which cookies the Service sets — at minimum, a Supabase session/authentication cookie is required for login to function. Confirm whether any analytics or marketing cookies are in use; if none, state that explicitly (which removes the need for a cookie-consent banner for anything beyond strictly-necessary authentication cookies); if any exist or are added later, this section and the consent-banner requirement both need updating together, not separately.]
10. Children's Privacy
The Service is intended for business use by adults. We do not knowingly
collect personal information from children. [TODO: attorney to confirm appropriate age threshold/wording for the SA context.]
11. Changes to This Policy
We may update this Privacy Policy from time to time. [TODO: attorney to specify the notice mechanism for material changes — e.g. email notice to registered users, and how far in advance.]
12. Contact Us
[TODO: same contact-address gap noted in § 1 and § 7 — resolve once, use consistently everywhere in this document.]