Privacy Policy

1. Introduction

Litrevu is committed to protecting your personal information in compliance with the Protection of Personal Information Act (POPIA) of South Africa, the General Data Protection Regulation (GDPR) of the European Union, and the California Consumer Privacy Act (CCPA) of the United States, as applicable to your jurisdiction.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using Litrevu, you consent to the data practices described in this policy.

2. Information We Collect

We collect the following types of personal information:

2.1 Information You Provide:

• Name and email address during registration
• Payment information (processed securely through our payment provider)
• Research papers and documents you upload
• Research queries and generated content
• Communication with our support team

2.2 Information Automatically Collected:

• IP address and device information
• Browser type and version
• Usage data and analytics
• Cookies and similar technologies

3. How We Use Your Information

We process your personal information for the following purposes:

• To provide and maintain our Service
• To process payments and manage your account
• To improve and personalize your experience
• To communicate with you about updates and support
• To comply with legal obligations
• To protect against fraud and unauthorized use

4. Legal Basis for Processing

We process your personal information based on:

• Your consent (which you may withdraw at any time)
• Performance of our contract with you
• Compliance with legal obligations
• Our legitimate interests in operating our business

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication measures
• Secure data storage with reputable cloud providers
• Regular backups and disaster recovery procedures

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. When data is no longer needed, we securely delete or anonymize it.

7. Your Rights Under POPIA

You have the following rights regarding your personal information:

• Access: Request a copy of your personal information
• Correction: Request corrections to inaccurate or incomplete data
• Deletion: Request deletion of your personal information
• Objection: Object to certain types of processing
• Restriction: Request restriction of processing
• Portability: Receive your data in a portable format
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at [email protected].

8. Your Rights Under GDPR (European Economic Area Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure (“Right to Be Forgotten”): Request deletion of your personal data, subject to legal retention obligations.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

Lawful Basis for Processing: We process your data on the following legal bases under GDPR Article 6:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Service you requested (account management, report generation, payment processing).
• Consent (Art. 6(1)(a)): Marketing communications, optional analytics, and cookies beyond essential functionality.
• Legitimate Interests (Art. 6(1)(f)): Fraud prevention, service improvement, and security measures.
• Legal Obligation (Art. 6(1)(c)): Tax and financial record-keeping requirements.

To exercise any GDPR rights, email [email protected]. We will respond within 30 days. If you are dissatisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.

9. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: Litrevu does not sell your personal information. We do not exchange personal data for monetary or other valuable consideration.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Correct: You may request correction of inaccurate personal information.

Categories of personal information we collect: Identifiers (name, email, IP address), commercial information (purchase history, credits), internet activity (usage data, browser type), and user-generated content (uploaded papers, research queries).

To exercise your CCPA rights, email [email protected] with the subject line “CCPA Request.” We will verify your identity and respond within 45 days.

10. Special Personal Information

We do not intentionally collect special personal information (such as religious beliefs, race, health information, or biometric data). If such information is inadvertently collected through uploaded documents, it is processed solely for providing our Service and protected with enhanced security measures.

11. Children's Privacy

Our Service is not intended for children under 18. We do not knowingly collect personal information from children. If we discover we have collected information from a child, we will promptly delete it.

12. Third-Party Services

We use trusted third-party services for:

• Payment processing (payment details are not stored on our servers)
• Cloud hosting and storage (Amazon Web Services)
• Email communications
• Analytics (in aggregated, non-identifiable form)

AI Processing: To provide our core service, the text content of your uploaded reference papers and your research inputs are sent to third-party AI providers (currently OpenAI and Google) for processing. This processing is necessary to generate citations, summaries, and report sections. These providers process your data under their enterprise/API terms, which prohibit using your data to train their models. Your uploaded PDF files themselves are stored securely on our own infrastructure and are not shared with AI providers in their original form.

All third-party providers are bound by confidentiality agreements and applicable data processing terms.

13. Cross-Border Data Transfers

Litrevu is based in South Africa. Your information may be transferred to and processed in countries outside your country of residence, including South Africa, the United States (where our AI processing providers and cloud infrastructure are located), and other jurisdictions. These countries may have data protection laws that differ from those in your jurisdiction.

We ensure appropriate safeguards are in place for cross-border transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission for EEA data transfers
• Data Processing Agreements (DPAs) with all third-party processors
• Ensuring recipients provide a level of data protection that is at least equivalent to the requirements of POPIA and GDPR
• Obtaining your consent where required by applicable law

By using our Service, you acknowledge and consent to the transfer of your information to South Africa and other countries as described in this policy.

14. Direct Marketing

We will only send you marketing communications with your explicit consent. You can opt-out at any time by:

• Clicking the unsubscribe link in any marketing email
• Contacting us at [email protected]
• Updating your preferences in your account settings

15. Data Breach Notification

In the event of a data breach that may affect your personal information, we will notify you and the Information Regulator as required by law, providing details of the breach and steps we are taking to address it.

16. Cookies Policy

We use cookies and similar technologies to:

• Maintain your session and authentication
• Remember your preferences
• Analyze usage patterns to improve our Service

You can control cookies through your browser settings, though some features may not function properly without them.

17. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through the Service. Your continued use after changes constitutes acceptance of the updated policy.

18. Information Officer

Our designated Information Officer for POPIA compliance can be contacted at:
Email: [email protected]
Address: 103 Leeuwkop Road, Sunninghill, Johannesburg, 2191

19. Complaints

If you have concerns about how we handle your personal information, please contact us first. You also have the right to lodge a complaint with the Information Regulator:
Website: https://inforegulator.org.za/
Email: [email protected]