Privacy Policy

1. What We Collect

When you use Amicus, we may collect the following:

• Identity: Your name and email address, provided via Google Sign-In or Sign in with Apple. If you use Sign in with Apple and choose to hide your email, Apple provides us with a private relay address instead of your real email address.
• Apple Sign In data: When you sign in with Apple, we also store a stable Apple user identifier (used to recognise you on subsequent sign-ins, since Apple does not return your email after your first sign-in) and an Apple refresh token. The refresh token is used solely to revoke your Sign in with Apple authorisation when you delete your account — we do not use it for any other purpose.
• Uploaded documents: Files you upload to your Case File (PDFs, Word documents), including any text extracted from them.
• Conversation history: Messages exchanged with the Document Builder and New Chapter support chat during your session.
• Payment confirmation: We receive a payment notification from PayFast confirming a successful transaction. We do not store your card number or banking details — these are handled exclusively by PayFast.
• Usage data: Number of sessions used, account creation date, and payment status.
• Technical data: IP address, browser type, device information, and access logs, collected automatically by our hosting and infrastructure providers (Vercel, Supabase) for security and operational purposes.

2. How We Use Your Data

• To authenticate you and provide access to your account.
• To store and retrieve your uploaded case documents.
• To send your document content to the AI (Anthropic Claude) to generate timelines, drafts, and responses.
• To process payments via PayFast and unlock continued access.
• To monitor service performance, reliability, and security.

We do not use Your Content to train AI models. Anthropic's commercial API terms prohibit the training of models on customer-submitted data by default, and we do not opt in to any such use. Your uploaded documents and conversations are used solely to provide the service to you.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Third-Party Services

Amicus relies on the following third-party services to operate:

Each provider has their own privacy policy governing how they handle data passed to them. We encourage you to review those policies.

4. Data Storage and Security

Your data is stored on Supabase, which uses PostgreSQL with row-level security policies that restrict access to your own data only. All data is encrypted in transit using TLS. File uploads are stored in private Supabase Storage buckets accessible only through authenticated API calls.

No system is perfectly secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security and accept no liability for unauthorised access resulting from events beyond our reasonable control.

We will notify affected users without undue delay if we become aware of a security breach involving their personal information, as required by section 22 of POPIA.

5. International Data Transfers

Some of the third-party providers we use to operate Amicus — including Anthropic, Supabase, and Vercel — process data on servers located outside South Africa, primarily in the United States and the European Union. By using Amicus, you consent to your personal data being transferred to and processed in these jurisdictions. We rely on each provider's contractual commitments and applicable safeguards (such as Standard Contractual Clauses and equivalent protections) to ensure that your data continues to be protected to a standard comparable to that required under the Protection of Personal Information Act 4 of 2013 (POPIA).

6. Account Deletion

You can permanently delete your account at any time from within the app at /account/delete. Account deletion will permanently remove your user record, your uploaded documents, your timeline entries, your co-parenting schedule, your checklist, and your conversation history.

If you signed in with Apple, your Sign in with Apple authorisation will also be revoked via Apple's API at the time of deletion.

If you are unable to access the in-app deletion flow, you can request deletion by emailing potfiction@gmail.com. We will action deletion requests within 30 days. Account deletion is permanent and cannot be undone.

7. Your Rights

You have the right to:

• request a copy of the personal data we hold about you;
• delete your account and all associated data — directly within the app at /account/delete, or by emailing us;
• correct inaccurate personal information;
• object to the processing of your personal information in certain circumstances;
• withdraw consent to processing (note: this may mean we can no longer provide the service to you);
• lodge a complaint with the Information Regulator of South Africa if you believe we have not handled your personal information lawfully.

To exercise any of these rights, email potfiction@gmail.com. We will respond within 30 days.

Information Regulator (South Africa)
Website: inforegulator.org.za
Email: POPIAComplaints@inforegulator.org.za

8. Information Officer

For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), the designated Information Officer for Amicus is Jaco Rossouw. The Information Officer can be contacted at potfiction@gmail.com.

9. Children

Amicus is intended for use by adults aged 18 and over. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at potfiction@gmail.com and we will take steps to delete that information.

10. Cookies

Amicus uses session cookies only, set by NextAuth for authentication. These cookies are necessary for you to stay signed in and are not used for tracking or advertising. We do not use third-party analytics or advertising cookies.

11. Retention

We retain your data for as long as your account is active. When you delete your account, your user record, uploaded documents, timeline entries, and all associated data are removed from our active database immediately. If you signed in with Apple, your Sign in with Apple authorisation is also revoked at the time of deletion. Backup copies (if any) are overwritten within 30 days.

Payment records may be retained for up to 7 years as required by South African financial regulations.

12. Contact

Questions or concerns about this Privacy Policy? Email potfiction@gmail.com.