Privacy Policy

1. Scope and responsible party

This Privacy Policy applies to SCUL Strategic Analysis (“SCUL”), including the SCUL website, web application and Android application published under the package name com.seowebsitedesign.scul.

SCUL Systems (Pty) Ltd is responsible for the personal information described in this policy. We are based in Sandton, Johannesburg, South Africa and process personal information in accordance with South Africa’s Protection of Personal Information Act, 2013 (“POPIA”) and, where applicable, other privacy laws such as the EU General Data Protection Regulation (“GDPR”).

2. Information we collect

SCUL does not request access to your contacts, precise location, camera, microphone, call history or SMS messages. The Android application currently requests internet access only.

3. How we use information

• Authenticate users through email/password or Google sign-in.
• Create and maintain profiles and apply account-access status.
• Provide private Research Assistant history and personalised account features.
• Send Research Assistant prompts for AI-assisted responses when the user chooses that feature.
• Protect the service, investigate misuse, enforce terms and maintain reliability.
• Respond to support, privacy, security and account-deletion requests.
• Meet legal, tax, regulatory and recordkeeping obligations where applicable.

We do not sell personal information. We do not use personal information for third-party targeted advertising, and the current application does not include a native advertising or analytics SDK.

4. Structured assessment processing

Entering text into the scenario builder does not transmit it by itself. When you select Run strategic analysis, the structured fields are sent over an encrypted connection to an authenticated Firebase callable function. The function checks your account-access status and processes the assessment using SCUL's server-held deterministic rules and curated corpus.

The current function returns the result to your device and does not intentionally write the submitted scenario to your Firestore profile or Research Assistant history. Limited request and security information may still appear in infrastructure logs. Structured assessment fields are not sent to Google Gemini unless you separately include them in a Research Assistant question.

5. Service providers and sharing

We disclose information only as needed to operate SCUL, comply with law, protect rights or complete a transaction requested by the user. Current categories include:

• Google Firebase: Firebase Authentication processes sign-in and identity data. Cloud Firestore stores profiles, access status and user-scoped Research Assistant search history. Firebase Functions processes submitted structured assessments and brokers Research Assistant requests.
• Google Identity services: Google’s account chooser and credential services support Google sign-in on Android and the web.
• Google Gemini API: Questions, conversation context and relevant SCUL corpus context are sent through an authenticated Firebase Function to Google’s generative-language service. We do not intentionally add your profile fields to those prompts.
• Website and infrastructure providers: Our hosting and network providers may process IP addresses and request/security logs to deliver and protect the service.
• Google Fonts: The web application may request font files from Google, which can expose standard connection information such as IP address and browser details.
• Google Play: Google independently processes information when users download, install or manage the Android application through Google Play.

We may also disclose information where required by law, court order or a lawful request; to investigate fraud or security threats; or as part of a merger, restructuring or sale, subject to appropriate confidentiality and notice requirements.

6. Legal grounds for processing

Depending on your location and relationship with us, we rely on one or more of the following grounds: performing our contract with you; taking steps requested before entering a contract; your consent, including your choice to use Google sign-in or the Research Assistant; our legitimate interests in providing and securing SCUL; and compliance with legal obligations.

Where processing is based on consent, you may withdraw that consent, but withdrawal does not affect processing that was lawful before withdrawal.

7. International processing

SCUL Systems is based in South Africa. Our service providers, including Google, may process information in South Africa and other countries. Those countries may have different privacy laws from your home jurisdiction.

Where required, we use contractual, organisational and legal safeguards for cross-border processing and take reasonable steps to ensure that recipients provide an adequate level of protection.

8. Security

We use reasonable technical and organisational measures appropriate to the information we process. These include encrypted network connections, Firebase authentication controls, user-scoped Firestore security rules, restricted administrative access and release signing for the Android application.

No system is completely secure. You are responsible for protecting your password and device, and for notifying us promptly if you suspect unauthorised access.

9. Retention

• Account and profile data: retained while your account is active and until it is deleted or no longer required for the purposes described here.
• Research Assistant history: retained in your account until the account or associated history is deleted, unless a shorter institutional retention arrangement applies.
• Support and legal records: retained only as long as reasonably needed to resolve the request and meet legitimate legal, security, fraud-prevention or recordkeeping obligations.
• Backups and logs: residual copies may remain for a limited period in protected backups or security logs before being overwritten or deleted.

We review retention needs periodically and delete or anonymise information when it is no longer reasonably required.

10. Account deletion

You may request deletion of your SCUL account and associated personal information at any time. A verified deletion request covers your Firebase authentication account, SCUL profile and user-scoped Console search history, subject to limited information we must retain for security, fraud prevention or legal compliance.

Visit our dedicated deletion page for the request steps. You do not need to reinstall the application, and you should never send us your password.

11. Your privacy rights

Subject to applicable law, you may ask us to:

• confirm whether we hold personal information about you;
• provide access to or a copy of your information;
• correct inaccurate or incomplete information;
• delete information or restrict its processing;
• object to certain processing;
• provide portable data where applicable; or
• withdraw consent where processing relies on consent.

We may need to verify your identity before completing a request. South African users may lodge a complaint with the Information Regulator (South Africa). Users elsewhere may also contact their local data-protection authority.

12. Children

SCUL is a professional analytical application intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information to SCUL.

13. Changes to this policy

We may update this policy when SCUL, our service providers or legal obligations change. We will post the revised policy on this page and update the “Last updated” date. Where a change is material, we will provide additional notice where reasonably practicable.

14. Contact us