Who we are
Contralysis ("Contralysis", "we", "us") operates the Contralysis web application and related services.
For privacy enquiries or to exercise your rights, contact us at support@contralysis.co.za.
Personal information we collect
We collect information you provide directly and information generated when you use the service:
- Account data: email address, display name, optional profile picture (for example from Google sign-in), and authentication credentials (passwords are stored as hashes, not plain text).
- Support and contact messages: content you submit through support forms or email.
- Payment-related data: subscription status, plan details, and transaction references processed by Paystack. We do not store full payment card numbers on our servers.
- Usage data: actions such as uploads, analysis requests, and technical logs needed to operate and secure the service.
Contract and document data
When you upload a contract, we extract text from the document and may temporarily store file data to complete processing. Analysis results (including summaries, risks, scores, and related fields) are stored so you can view them in your dashboard.
Contract text and analysis outputs may contain personal or sensitive information belonging to you or third parties named in the document. You are responsible for ensuring uploads comply with applicable law and any confidentiality obligations.
To perform analysis, contract text is sent to Google Gemini (Google's generative AI service) under our instructions for processing.
Cookies and session storage
We use session cookies and similar technologies to keep you signed in and to protect your account. Session data is stored using our authentication infrastructure (including server-side session storage linked to your account).
You can control cookies through your browser settings, but disabling essential cookies may prevent you from using signed-in features.
How we use information
We use personal information to:
- Provide, maintain, and improve the contract analysis service.
- Authenticate users and enforce security.
- Process subscriptions and communicate about billing.
- Respond to support requests and send service-related emails (for example confirmations or receipts via our email provider).
- Comply with legal obligations and protect against abuse or fraud.
Sharing and processors
We do not sell your personal information. We share data with service providers who process it on our behalf, only as needed to run the service:
- Google: OAuth sign-in and Gemini AI analysis.
- Paystack: payment and subscription processing.
- Resend (or similar email providers): transactional and support email delivery.
- Cloud infrastructure providers: hosting, databases (including MongoDB), and caching (including Upstash Redis) for application and session data.
Retention and deletion
We retain account and contract analysis data for as long as your account is active or as needed to provide the service, comply with law, resolve disputes, and enforce agreements.
Uploaded file buffers may be held temporarily in cache for processing and are not intended for long-term storage.
You may request deletion of your account and associated personal information by contacting support@contralysis.co.za. We will respond in line with POPIA and applicable law. Some information may be retained where required by law or legitimate business needs (for example billing records).
Security
We implement reasonable technical and organizational measures to protect personal information, including access controls, encryption in transit where supported, and secure credential handling.
No method of transmission or storage is completely secure. You use the service at your own risk regarding the security of information you choose to upload.
Your rights under POPIA
Subject to POPIA and applicable law, you may have the right to:
- Request access to personal information we hold about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of personal information in certain circumstances.
- Object to processing or request restriction of processing where applicable.
- Lodge a complaint with the Information Regulator (South Africa) if you believe your rights have been violated.
Cross-border transfers
Some processors (including Google) may process personal information in countries outside South Africa. Where we transfer data internationally, we take steps designed to ensure appropriate safeguards consistent with POPIA and our agreements with processors.
Children
The service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Material changes may be communicated through the service or email where appropriate.
Contact
Privacy enquiries and POPIA requests: support@contralysis.co.za.