Privacy Policy

1. Introduction

This Privacy Policy explains how SizaPoint collects, uses, shares, and protects personal information when you use our website and workspace. We aim to meet the requirements of major data protection frameworks that may apply to our users, including the EU/UK General Data Protection Regulation (GDPR), South Africa's Protection of Personal Information Act (POPIA), and the California Consumer Privacy Act (CCPA/CPRA).

2. Information We Collect

• Account information: name, email address, institution and academic level (if provided), and authentication credentials.
• Content you provide: documents, notes, and prompts you upload or type into the workspace.
• Usage information: feature usage, AI credit consumption, and device/browser information, collected to operate and improve the Service.
• Security sessions: when you sign in we record browser, operating system, approximate location (from IP), and last activity so you can review active devices and sign out remotely. We email you when a new device signs in.
• Billing information: plan and payment status, handled by a PCI-compliant payment processor — we do not store your full card details ourselves.
• Communications: messages you send us through the contact form or support channels.
• Voice content (Siza Voice): the questions you speak to Siza, and the audio, transcripts and spoken answers saved in your Siza Voice library.

3. How We Use Information

• To provide, maintain, and personalise the workspace and its AI features.
• To process payments and manage subscriptions.
• To communicate with you about your account, security, and — where you've opted in — product updates.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

4. How AI Features Process Your Content

When you use an AI-powered tool, the relevant portion of Your Content is sent to a third-party AI model provider under contract solely to generate the requested output (for example, a summary, outline, or grammar suggestion). We do not permit AI providers to use your content to train their general-purpose models.

5. Documents You Upload for Processing

• When you upload a document (for example, an assignment, dissertation, or thesis) to Document Studio or another document tool, we store the original file, any working copies, and the corrected output so we can process your request and let you download the result.
• These files are processed only to provide the feature you asked for — reviewing structure, headings, numbering, captions, citations, references, and consistency — and to show you what changed.
• Files are stored in encrypted cloud storage. We keep the original alongside the corrected version so the change is auditable and never destructive; we do not overwrite your uploaded file.
• Where a document tool uses AI to interpret ambiguous content (for example, whether a heading is really a heading), the relevant portion is sent to a contracted AI provider solely to generate that result. AI providers are contractually prohibited from using your documents to train their general-purpose models, and we do not use your uploaded documents to train models.
• Uploaded documents and their processed outputs are retained while your account is active and deleted when you delete the item, or when your account is deleted, subject to the limited retention described below. Guest "Try" document sessions are not retained after the session ends.

6. Siza Voice (Audio and Speech)

• Speaking to Siza: when you press the microphone in Ask Siza or Talk to Siza, your recording is sent to a contracted speech-to-text provider (currently OpenAI, with Google as a backup) to turn it into text. We use the audio only to produce that transcript and do not keep the recording after it has been transcribed. The transcript is then handled like any other message you send.
• Hearing Siza: when you ask Siza to read something aloud — a Listen recording, a spoken lecture, a spoken answer, or a voice reply in Ask Siza — the text to be read is sent to a contracted text-to-speech provider (currently OpenAI, with Google or Amazon Web Services as backups). Like our other AI providers, they process it solely to provide the feature and are not permitted to use it to train their general-purpose models.
• Your Siza Voice library: the audio we generate for Listen recordings, lectures and spoken answers is stored in encrypted cloud storage, with its transcript (and, for spoken questions, your question), so you can replay it. We keep each recording for up to 12 months or until you delete it; after 12 months the audio is removed and the transcript stays in your library until you delete it. Deleting a recording removes both. Short spoken replies in Ask Siza are deleted automatically within 7 days.
• Free device voice: the free device voice — also available without an account in the guest Ask Siza preview, where nothing is saved — uses your browser's own speech recognition and read-aloud. Depending on your browser or device, that processing may be done by your browser or operating-system provider (for example Google for Chrome or Apple for Safari) under their own privacy terms, not by SizaPoint.

7. Legal Bases for Processing (where GDPR/POPIA apply)

• Performance of a contract — to provide the Service you've signed up for.
• Consent — for optional communications such as the newsletter, and for non-essential cookies.
• Legitimate interests — for security, fraud prevention, and service improvement, balanced against your rights.
• Legal obligation — where we must retain or disclose information to comply with the law.

8. Sharing of Information

We do not sell your personal information. We share information only with service providers who process it on our behalf under contract (for example, cloud hosting, email delivery, and payment processing), with your institution where you've joined an institutional workspace, or where required by law.

9. International Data Transfers

Where personal information is transferred across borders, we rely on recognised transfer mechanisms such as Standard Contractual Clauses, and we require service providers to apply protections consistent with this Policy.

10. Data Retention

We retain account and content data for as long as your account is active, plus a limited period afterward to comply with legal, accounting, or security requirements. Guest "Try" sessions are not retained after the session ends. Siza Voice recordings are kept for up to 12 months, as described in section 6.

11. Your Rights

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account and associated data.
• Object to or restrict certain processing, and withdraw consent at any time.
• Request a portable copy of your data.
• Lodge a complaint with your local data protection authority.

12. Children's Privacy

The Service is intended for students at secondary and tertiary education level and above. We do not knowingly collect personal information from young children without the consent required by applicable law.

13. Security

We use industry-standard cloud infrastructure with encryption in transit and at rest, access controls limiting who can view your data, and secure, hashed storage of authentication credentials. See our Security & Data Protection page for more detail.

14. Changes to this Policy

We will update the effective date and version at the top of this page whenever this Policy changes, and provide direct notice of material changes where required by law.

15. Contact and How to Exercise Your Rights

For privacy questions or to exercise any of the rights above, email our privacy team at privacy@sizapoint.com, or use our Contact page under the "General enquiry" topic. We aim to respond within the timeframes required by applicable law.

SizaPoint operates from South Africa and is the responsible party for your personal information under POPIA. Our Information Officer can be reached at privacy@sizapoint.com. If you are in the EU or UK, you may contact the same address for GDPR / UK GDPR matters; where we are legally required to appoint an EU or UK representative under Article 27 GDPR, that representative's details will be published on this page.

You also have the right to lodge a complaint with a supervisory authority — in South Africa, the Information Regulator (inforegulator.org.za); in the EU/UK, your local data protection authority.