Privacy Policy

1. Introduction

Litrevu is committed to protecting your personal information in compliance with the Protection of Personal Information Act (POPIA) of South Africa, the General Data Protection Regulation (GDPR) of the European Union, and the California Consumer Privacy Act (CCPA) of the United States, as applicable to your jurisdiction.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using Litrevu, you consent to the data practices described in this policy.

2. Information We Collect

We collect the following types of personal information:

2.1 Information You Provide:

• Name and email address during registration
• The university you name, if you choose to name one. It is optional, and we use it only to count how many of our students are at each university.
• Payment information (processed securely through our payment provider)
• Research papers and documents you upload
• Research queries and generated content
• Communication with our support team

2.2 Information Automatically Collected:

• IP address and device information
• Browser type and version
• Usage data and analytics
• Cookies and similar technologies
• When you sign up or buy, a one-way (SHA-256) hash of your email address, sent to Google Ads to measure which ads led to the signup or purchase (see sections 12 and 16)

3. How We Use Your Information

We process your personal information for the following purposes:

• To provide and maintain our Service
• To process payments and manage your account
• To improve and personalize your experience
• To send you product and account emails, and to answer support requests
• To measure how visitors use the site and which ads and pages lead to signups and purchases (Google Analytics and Google Ads)
• To comply with legal obligations
• To protect against fraud and unauthorized use

4. Legal Basis for Processing

We process your personal information based on:

• Your consent (which you may withdraw at any time)
• Performance of our contract with you
• Compliance with legal obligations
• Our legitimate interests in operating our business

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (HTTPS)
• Regular security assessments and updates
• Access controls and authentication measures
• Secure data storage with reputable cloud providers
• Regular backups and disaster recovery procedures

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. When data is no longer needed, we securely delete or anonymize it.

You can remove a paper from your library at any time, and nobody else can see your library. Removing a paper does not by itself delete the stored copy of the file. You can delete your account from your profile page: that removes your account, your library, your drafts and the stored copies of the PDFs you uploaded. Litrevu stores an identical PDF only once, so a PDF that another account also uploaded may be kept for that account. To have a stored file deleted without deleting your account, email [email protected].

7. Your Rights Under POPIA

You have the following rights regarding your personal information:

• Access: Request a copy of your personal information
• Correction: Request corrections to inaccurate or incomplete data
• Deletion: Request deletion of your personal information
• Objection: Object to certain types of processing
• Restriction: Request restriction of processing
• Portability: Receive your data in a portable format
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at [email protected].

8. Your Rights Under GDPR (European Economic Area Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure (“Right to Be Forgotten”): Request deletion of your personal data, subject to legal retention obligations.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

Lawful Basis for Processing: We process your data on the following legal bases under GDPR Article 6:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Service you requested (account management, report generation, payment processing).
• Consent (Art. 6(1)(a)): Google Analytics and Google Ads cookies, ad personalisation, and the hashed-email conversion measurement described in section 12. In the EEA, the UK and Switzerland these stay off until you press Accept on the cookie banner. Google's tag still loads before you choose: until you press Accept, or after you press Decline, it sends Google measurement signals without cookies (Google Consent Mode), which include your IP address and browser. The attribution and currency cookies in section 16 are not covered by the banner.
• Legitimate Interests (Art. 6(1)(f)): Fraud prevention, service improvement, security measures, and product and account emails (each with an unsubscribe link, see section 14).
• Legal Obligation (Art. 6(1)(c)): Tax and financial record-keeping requirements.

To exercise any GDPR rights, email [email protected]. We will respond within 30 days. If you are dissatisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.

9. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: Litrevu does not sell your personal information. We do not exchange personal data for monetary or other valuable consideration.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Correct: You may request correction of inaccurate personal information.

Categories of personal information we collect: Identifiers (name, email, IP address), commercial information (purchase history, passes), internet activity (usage data, browser type), and user-generated content (uploaded papers, research queries).

To exercise your CCPA rights, email [email protected] with the subject line “CCPA Request.” We will verify your identity and respond within 45 days.

10. Special Personal Information

We do not intentionally collect special personal information (such as religious beliefs, race, health information, or biometric data). If such information is inadvertently collected through uploaded documents, it is processed solely for providing our Service and protected with enhanced security measures.

11. Children's Privacy

Our Service is not intended for children under 18. We do not knowingly collect personal information from children. If we discover we have collected information from a child, we will promptly delete it.

12. Third-Party Services

We use trusted third-party services for:

• Payment processing (payment details are not stored on our servers)
• Cloud hosting and storage (Amazon Web Services)
• Email communications
• AI processing (OpenAI and Google, described below)
• Analytics (Google Analytics): how visitors use the site, which pages they view and which features they use
• Advertising measurement (Google Ads): which of our ads lead to signups and purchases. When you sign up or buy, your browser sends Google Ads a one-way (SHA-256) hash of your email address, not the address itself, so Google can match the signup or purchase to an ad click (Google calls this Enhanced Conversions)
• IP location (ipapi.co, with ip-api.com as a fallback): to show prices in your currency, your IP address is sent to an IP-location service when you visit, in every region and whatever you choose on the cookie banner. The country and currency it returns are kept in your browser (see section 16)
• Public research indexes (Crossref, OpenAlex, DataCite, doi.org and the US National Library of Medicine): when you use a free tool, the reference, DOI, title or search terms you enter are sent there to look them up. The search string builder also sends your research question to our AI provider to suggest search terms, under the same no-training terms. Nothing you type into a free tool is saved to a database or linked to your account.

AI Processing: To provide our core service, the text content of your uploaded reference papers and your research inputs are sent to third-party AI providers (currently OpenAI and Google) for processing. This processing is necessary to answer your questions, find and cite passages, and draft text. We use these providers through their paid API services, whose terms prohibit using your data to train their models. Your uploaded PDF files themselves are kept in our own cloud storage (Amazon Web Services) and are not sent to AI providers in their original form.

All third-party providers are bound by confidentiality agreements and applicable data processing terms.

13. Cross-Border Data Transfers

Litrevu is based in South Africa. Our infrastructure and AI providers (Amazon Web Services, Google and OpenAI) may store or process your information outside your country of residence, including outside South Africa. These countries may have data protection laws that differ from those in your jurisdiction.

We ensure appropriate safeguards are in place for cross-border transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission for EEA data transfers
• Data Processing Agreements (DPAs) with all third-party processors
• Ensuring recipients provide a level of data protection that is at least equivalent to the requirements of POPIA and GDPR
• Obtaining your consent where required by applicable law

By using our Service, you acknowledge and consent to the transfer of your information to South Africa and other countries as described in this policy.

14. Emails We Send

When you have an account, we send product and account emails to its address: for example a welcome, tips on getting started, reminders about unfinished work or an unfinished checkout, and occasional offers. Each of these emails carries an unsubscribe link. Receipts for a purchase, and essential service messages such as a password reset you asked for, are still sent after you use the unsubscribe link. You can stop the product and account emails at any time by:

• Clicking the unsubscribe link in any of them
• Contacting us at [email protected]

15. Data Breach Notification

In the event of a data breach that may affect your personal information, we will notify you and the Information Regulator as required by law, providing details of the breach and steps we are taking to address it.

16. Cookies Policy

We use cookies and similar technologies to:

• Maintain your session and authentication
• Remember your preferences
• Show prices in your currency: the geo_cc and geo_curr cookies hold the country and currency code from the IP lookup in section 12 for 24 hours, and a copy of each is also kept in your browser's local storage, which does not expire. They are set in every region, whatever you choose on the cookie banner
• Credit the ad you came from: if you arrive by clicking one of our Google ads, the gclid cookie holds Google's ID for that click for 90 days, with a copy in your browser's local storage, which does not expire. If you sign up, the click ID is stored with your account. It is set in every region, whatever you choose on the cookie banner
• Credit the partner who referred you: if you arrive through a partner's link, the litrevu_ref cookie holds the partner's code for 30 days, a random visitor ID is kept in your browser's local storage, and we record the visit (with your IP address, your browser, the page you landed on and the site you came from) for that partner. If you sign up, the referral is stored with your account. It is set in every region, whatever you choose on the cookie banner
• Record how you first found us: the site you came from, any campaign tags in the link and the page you landed on are kept in your browser's local storage and, if you sign up, stored with your account. This happens in every region, whatever you choose on the cookie banner
• Analyze usage patterns to improve our Service (Google Analytics)
• Measure which of our ads lead to signups and purchases (Google Ads)

Your choice on the cookie banner: if you are in the European Economic Area, the United Kingdom or Switzerland, Google Analytics and Google Ads cookies, ad personalisation and the hashed-email measurement in section 12 stay off until you press Accept. Everywhere else they are on by default, and pressing Decline turns them off. In every region Google's tag still loads; without your consent it sends Google measurement signals without cookies (Google Consent Mode), which include your IP address and browser. The banner does not control the currency, ad-click, partner-referral and first-visit records described above. Your choice is stored in your browser; to change it, clear this site's data in your browser and choose again.

You can also control cookies through your browser settings, though some features may not function properly without them.

17. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through the Service. Your continued use after changes constitutes acceptance of the updated policy.

18. Information Officer

Our designated Information Officer for POPIA compliance can be contacted at:
Email: [email protected]
Address: 103 Leeuwkop Road, Sunninghill, Johannesburg, 2191

19. Complaints

If you have concerns about how we handle your personal information, please contact us first. You also have the right to lodge a complaint with the Information Regulator:
Website: https://inforegulator.org.za/
Email: [email protected]