01Who we are
Bhekalile Solutions (Pty) Ltd, registration number 2021/629717/07, of D1747 Umlazi, Durban, KwaZulu-Natal, 4031, South Africa, operates the Replexia platform (“Replexia”, “the Platform”, “we”, “us”, “our”).
For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), we are the responsible party for the personal information described in this policy, except where we act as an operator on behalf of an Institution (see section 9).
02What this policy covers
This policy explains what personal information we collect when you use Replexia, why we collect it, who we share it with, how long we keep it, and what rights you have.
It applies to all users of the Platform, including students, researchers, supervisors, mentors, institutional administrators, and visitors to our website.
03Personal information we collect
3.1Information you give us
| Category | Examples |
|---|---|
| Account information | Name, email address, password (stored hashed), account type, institution or organisation, field of study or work, qualification level |
| Profile information | Role, research area, supervisor or supervisee links, optional biographical details |
| Project content | Research topics, project descriptions, chapter structures, drafts, uploaded documents, notes, citations, bibliographies, datasets |
| Communications | Messages sent through supervision or coaching features, support requests, feedback |
| Payment information | We do not currently collect payment information, as paid tiers are not yet available. When they are, payments will be handled by a third-party payment provider, we will not store full card details, and this policy will be updated to name that provider before any payment is taken |
3.2Information collected automatically
- IP address, browser type, device type, operating system
- Pages visited, features used, timestamps, session duration
- Error and diagnostic logs
- Cookies and similar technologies (see section 12)
3.3Information from third parties
- Publicly available bibliographic and citation metadata from academic sources (for example OpenAlex, Unpaywall, Crossref). This is generally about published works and their authors, not about you.
- Where you join through an Institution, that Institution may provide us with your name, email address, and enrolment or programme details.
3.4Special personal information
We do not intentionally collect special personal information as defined in section 26 of POPIA (such as health, religious, political, biometric, or criminal information).
However, research documents you upload may contain such information — for example, health data in a clinical research thesis, or personal information about research participants. Where this is the case:
- you are responsible for ensuring you have the necessary ethics clearance and participant consent;
- you should anonymise or pseudonymise participant data before uploading wherever your research design allows it;
- we process such material only as necessary to provide the Platform to you.
04Why we process your personal information, and on what basis
| Purpose | Lawful basis under POPIA |
|---|---|
| Creating and managing your account | Performance of a contract with you (s11(1)(b)) |
| Providing the Platform’s analysis, feedback, and validation features | Performance of a contract (s11(1)(b)) |
| Enabling supervisor and institutional access you have authorised | Consent (s11(1)(a)) / performance of a contract |
| Processing payments and preventing fraud | Contract; legal obligation (s11(1)(c)) |
| Security, monitoring, and abuse prevention | Legitimate interests (s11(1)(f)) |
| Improving the Platform through aggregated, de-identified usage analysis | Legitimate interests (s11(1)(f)) |
| Service announcements and essential notices | Contract |
| Marketing communications | Consent — you may opt out at any time (s69) |
| Complying with legal and regulatory obligations | Legal obligation (s11(1)(c)) |
05Automated processing and artificial intelligence
Replexia uses artificial intelligence and automated systems to analyse your work and generate feedback, scores, claim assessments, citation checks, and structural guidance.
These outputs are advisory. They are not decisions about you. No academic result, grade, disciplinary finding, or other decision with legal or similarly significant effect is made by the Platform. Any such decision remains with you, your supervisor, or your institution.
Under section 71 of POPIA you have the right not to be subject to a decision based solely on automated processing that has legal consequences for you. Because the Platform does not make such decisions, section 71 does not ordinarily apply — but if you believe an automated output has been used to make a decision about you, you may contact our Information Officer to request human review.
We do not use your content to train artificial intelligence models. We contractually require the AI providers we use not to train on data submitted through our service.
06Who can see your content
6.1Supervisors and mentors
If you link a supervisor, mentor, or reviewer to a project, they can access the categories of information indicated at the time of linking. Some features are designed to show a supervisor only your progress and position, not your unsubmitted drafts — where that is the case, the Platform will make it clear.
You may remove a supervisor’s access at any time through your account settings, unless your Institution’s own arrangements require it to remain.
6.2Institutions
Where you use Replexia through an institutional account, that Institution’s administrators may access usage and progress information relating to their users, and, depending on the configuration they have chosen, project content. Institutions set their own access policies and are responsible for them.
6.3Our team
Access to user content by our personnel is restricted to what is necessary for support, security, and maintenance, is logged, and is subject to confidentiality obligations.
07Service providers and sub-processors
We share personal information with the following providers, who process it on our instructions only:
| Provider | Purpose | Location |
|---|---|---|
| Contabo | Hosting the Platform and database | Germany (EU) |
| Anthropic | Generating feedback and analysis | United States |
| Crossref, OpenAlex, Unpaywall | Citation lookups — queries only, no user documents are sent | United States |
| Brevo | Transactional and service email | France (EU) |
This list is accurate as at the effective date above. We update it whenever we add or change a provider. If you are assessing Replexia on behalf of an institution and need supporting documentation, contact our Information Officer.
08Cross-border transfers
Some of our service providers are located outside South Africa. This means your personal information may be transferred to, stored in, or processed in other countries.
Under section 72 of POPIA, we may only transfer personal information outside South Africa where one of the following applies:
- the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection;
- you have consented to the transfer;
- the transfer is necessary for the performance of a contract with you; or
- the transfer is for your benefit and consent is not reasonably practicable.
We rely on contractual safeguards with each provider and, where applicable, on the necessity of the transfer for performing our contract with you. Copies of the relevant safeguards are available from our Information Officer on request.
09When we act as an operator
Where an Institution deploys Replexia for its own users, that Institution is the responsible party for the personal information of those users, and we act as its operator under sections 20 and 21 of POPIA. In that case:
- we process personal information only on the Institution’s documented instructions;
- we maintain the security safeguards required by section 19;
- we notify the Institution without undue delay of any security compromise;
- requests from users to exercise their rights are referred to the Institution.
A separate written operator agreement governs these arrangements.
10How long we keep your information
| Data | Retention period |
|---|---|
| Account information | For as long as your account is active |
| Project content and documents | For as long as your account is active, or until you delete it |
| Data after account closure | 30 days, then deleted from live systems |
| Encrypted backups | Expire on our ordinary backup cycle, within 90 days |
| Financial and tax records | 5 years, as required by South African tax and companies legislation |
| Security and access logs | 12 months |
| De-identified, aggregated usage statistics | Indefinitely — this data can no longer identify you |
11How we protect your information
We apply the security safeguards required by section 19 of POPIA, including:
- encryption of data in transit (HTTPS/TLS) and encryption of backups;
- hashed password storage;
- role-based access control and least-privilege access for personnel;
- logging and monitoring of administrative access;
- regular software patching and dependency review;
- automated backups with offsite copies.
No system is perfectly secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.
12Cookies
We use cookies and similar technologies for:
- Strictly necessary purposes — keeping you logged in, security, load balancing. These cannot be disabled.
- Functional purposes — remembering your preferences.
We do not currently use advertising, marketing, or third-party analytics cookies. If we introduce them, we will update this policy and, where required, ask for your consent before they are set.
You can control cookies through your browser settings, though disabling strictly necessary cookies will prevent the Platform from working.
13Direct marketing
We will only send you electronic marketing where you have consented, or where you are an existing customer and the marketing relates to similar services. Every marketing message includes an unsubscribe link. Section 69 of POPIA and section 45 of the Electronic Communications and Transactions Act apply.
14Your rights
Under POPIA you have the right to:
- be told what personal information we hold about you;
- access that information, subject to the procedures in the Promotion of Access to Information Act 2 of 2000 (PAIA);
- correct or update information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
- request deletion of information we no longer have a lawful basis to keep;
- object to processing based on legitimate interests, on reasonable grounds;
- withdraw consent where processing is based on consent, without affecting processing already carried out;
- export your content in a usable format;
- complain to the Information Regulator.
To exercise any of these rights, contact our Information Officer at info@replexia.com. We will respond within 30 days. We may need to verify your identity first.
15Complaints to the Information Regulator
If you are not satisfied with how we have handled your personal information, you may complain to:
The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Tel: 010 023 5200
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
A POPIA complaint is lodged in writing using POPIA Form 5, available from the Regulator’s website.
16Children
The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from children. Under section 34 of POPIA, processing personal information of a child requires the consent of a competent person. If you believe a child has provided us with personal information, contact our Information Officer and we will delete it.
17Changes to this policy
We may update this policy. The current version is always available at replexia.com/privacy. Where a change materially affects how we use your personal information, we will notify you by email or in-app notice before it takes effect.
18Contact us
Information Officer — Andile Mngadi
Bhekalile Solutions (Pty) Ltd
D1747 Umlazi, Durban, KwaZulu-Natal, 4031, South Africa