Privacy Policy

• Who processes what. Account data (name, email, sign-in records): us. Payment data: Paddle (merchant of record) — we never see card numbers. Document content: processed to deliver the service, stored in Google Drive; Google LLC is a subprocessor.
• Lawful basis / POPIA + GDPR. Contract performance for the service; legitimate interest for security logs; consent where required.
• What we log. Processing runs, sign-ins, membership and capacity checks — append-only, for integrity and support.
• What we don't do. No selling of data, no advertising use, no training of AI models on customer documents, no reading of customer content except customer-initiated, logged support.
• Retention. Account data for the account's life plus 12 months after closure; logs 12 months; document artifacts live in your Drive under your control — deleting them is in your hands, always — except where a longer period is required by law (for example, financial and tax records, which are kept for the statutory period).
• Your rights. Access, correction, deletion, portability (trivial: it's your Drive), complaint to the Information Regulator / relevant authority.