Privacy Policy

Crytation is operated by Crytation (Pty) Ltd, a private company registered in South Africa, of 57 Crawford Drive, Douglasdale, Johannesburg (postal address: 134 Market Street, Johannesburg North, 2188). We are the responsible party for your personal information under South Africa's Protection of Personal Information Act (POPIA). Our Information Officer is Matthew Phillips, who you can contact at myaccountdata@crytation.com. This policy explains what we collect, why, who we share it with, and your rights.

• Account details: your name, email address and password (stored only as a secure hash), and an optional avatar. We do not collect your occupation, institution or biographical details.
• What you do in Crytation: the searches you run, the questions you ask the Evidence Brief, and the articles, trials, notes, folders, projects and briefs you save or share.
• Feedback and support messages you send us.
• Technical data: device type, browser, IP address and usage logs.
• Business contacts: for outreach to institutions, we may record the names and work email addresses of staff from publicly available sources such as institutional websites.

You need to give us your name and email to create an account; without them we can't provide one. Everything else is optional.

• To provide the service you signed up for: running searches and briefs, saving your library, sending in-app alerts and answering support requests. This is necessary for our agreement with you.
• To keep Crytation secure, prevent misuse, apply usage limits and improve the service, using aggregated or anonymised data where we can. These are our legitimate interests.
• To use analytics cookies and send marketing emails, only with your consent, which you can withdraw at any time.

Crytation is a literature tool, not a clinical record. Please don't enter names, ID numbers or other details that could identify a patient in searches, questions, notes or shared projects. If we find such information, we may delete it.

We do not sell your personal information. We share it only with providers that help us run Crytation, and only as far as needed:

• Base44, our platform provider, for hosting, database, email delivery and AI processing.
• Microsoft 365, for our business email (messages you send to our @crytation.com addresses).
• The AI model provider Base44 uses to generate Evidence Briefs and study details, which receives your question and the article text being summarised and, to expand, interpret and spell-check search terms, the words you type into Article Search (never your name or email).
• Literature and trial databases (Europe PMC, NCBI/PubMed, Crossref, DOAJ, OpenAlex, ClinicalTrials.gov, ISRCTN and the EU Clinical Trials Information System), which receive your search terms but not your name or email.
• Google Analytics, only if you accept analytics cookies.
• Our payment processor, once paid plans launch.

Internal notifications that alert our team to new sign-ups or feedback contain no personal information; the details stay within our platform and our email.

We may also disclose information when the law requires it, or to protect the rights, property or safety of Crytation and its users.

Our providers store and process data outside South Africa. We transfer it because this is necessary to provide the service you signed up for, and we rely on our providers' data protection commitments. Base44 stores our data in the United States.

• Search history: until the end of the month in which you ran the search.
• Trial search history: until the end of the month in which you ran the search.
• Evidence Brief logs, used for daily limits and cost monitoring: 12 months.
• Saved articles, notes, folders, projects and briefs: until you delete them or close your account.
• Feedback and its conversation thread: until your request is resolved and you ask us to remove it.
• Records of your data requests: your name and email are removed 12 months after we complete the request; anonymous counts are kept for our annual report to the Information Regulator.
• Account data: deleted within 30 days of a request to close your account; copies in our provider's backups expire on its normal backup schedule.
• Business contacts: until they ask us to stop, and no longer than 24 months.
• Admin access logs (which administrator viewed or changed your data, and when): 24 months.
• Cached search results and article metadata, not linked to you: 24 hours and 30 days.
• Payment records, once paid plans launch: 5 years, as tax law requires.

We protect your information with industry-standard encryption and access controls. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security. If a security breach affects your personal information, we will notify the Information Regulator and you as soon as reasonably possible.

Crytation uses essential cookies to maintain your session and authenticate your account. We also use Google Analytics cookies (such as _ga) to collect anonymized usage data—visits, sessions, and general engagement—which helps us improve the platform. Analytics cookies are only loaded after you accept them via the consent banner shown on your first visit; you may decline at any time. We do not use advertising cookies. You can control or clear cookies through your browser settings, but disabling essential cookies may affect functionality. You can change your choice at any time using the Cookie settings link at the bottom of every page.

You may ask to see the personal information we hold about you, correct it or delete it; object to how we use it; withdraw consent you've given; and opt out of marketing at any time. You can download a copy of your data at any time in Settings. You can also send access, correction, deletion or objection requests through our Contact page. You can update your profile in the app, or email myaccountdata@crytation.com, and we will respond within 30 days. If you are in the European Economic Area, you also have rights under the GDPR, including data portability and restricting processing. If you're unhappy with how we handle your information, you may complain to the Information Regulator of South Africa (inforegulator.org.za) or, in the EEA, to your local data protection authority.

We only send marketing emails if you opt in, when you sign up or in Settings. Every marketing email has a one-click unsubscribe link, and you can turn them off in Settings at any time. When we contact staff at institutions about Crytation, we contact them once to ask whether they want to hear more, and we stop if they say no.

Crytation is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has given us personal information, email myaccountdata@crytation.com and we will remove it.

We may update this policy. We will tell you about material changes by email or in the app before they take effect, and the date at the top shows the latest version.

For questions about this policy or your data, email myaccountdata@crytation.com. For anything else, use our contact page or email contactus@crytation.com.