Version 2026-09-30

Privacy notice

This notice explains what personal information Sui Generis Labs collects through this website, why, where it is kept, and what you can do about it. It is given in terms of section 18 of the Protection of Personal Information Act, 2013.

Who is responsible

SUI GENERIS LABS (PTY) LTD, registration number 2026/430169/07, a private company registered in South Africa with its registered office in Bloemfontein, Free State. The information officer is Hennie de Swardt, who can be reached at admin@suigenerislabs.co.za.

What is collected

There are three separate things, and it is worth keeping them apart.

1. Your account. When you sign in we hold your email address and the sign-in events associated with it. This is handled for us by Clerk.
2. Client records you choose to save. If you save a client record, we store what you enter: names, and whatever detail the tool you are using captures. That includes identity numbers, and not only the client's. Where a document names them, the identity numbers of a spouse, of children including minors, and of anyone appointed as executor, trustee or guardian are stored with the record, because that is what the documents require and what makes the record worth keeping. It also includes dates of birth, marital regimes, family relationships, entities and asset information. Nothing is saved unless you deliberately save it.
3. What stays on your own computer. The drafting tools run inside your browser. Anything you type into a tool, and every document it produces, stays on your machine unless you save it to a client record. We never see it. There are two exceptions, each described below: a trust deed you ask for as a PDF, and a trust deed you send to Trust Review to be read.

Why

To let you sign in, to keep the client records you choose to keep so that they fill themselves in the next time you draft, and to run and support the service. We do not use client information for anything else, we do not sell it, and we do not use it to train anything.

Who can see client records

An adviser sees only their own client records, and one adviser cannot see another's. The firm administrator, who is the information officer named above, can open any record in order to help an adviser, to regenerate a document, and to support and administer the service. This access is limited to that purpose and is logged, showing which record was opened and when. This is internal access within Sui Generis Labs as the responsible party; records are not disclosed to any other third party.

Whether you have to provide it

An email address is required in order to have an account, because there is no other way to sign you in. Everything else is voluntary. If you do not save client records, the tools still work in full; you simply retype the details each time and keep the documents yourself.

Where it is kept, and the cross-border question

The database is hosted by Neon in Frankfurt, Germany. The website runs on Vercel and sign-in is operated by Clerk, both of which process information outside South Africa. Where a trust deed is produced as a PDF, the document is sent to our own conversion service, which runs on Google Cloud Run in Belgium, and the converted file is returned to your browser. Where a trust deed is sent to Trust Review, it goes to our own review service on Google Cloud Run in Frankfurt, Germany, and is read there by Google's Gemini model on Vertex AI, in the same region. Each of these is a transfer of personal information to a foreign country under section 72 of the Act. The European Union has data protection law that upholds principles substantially similar to those in the Act, and each operator outside our own control is bound by a data processing agreement requiring them to protect the information and to process it only on our instructions.

Documents sent for conversion

A trust deed contains the full names and identity numbers of the founder, the trustees and the beneficiaries. When you ask for it as a PDF, that document is transmitted to the conversion service, converted, and returned to you.

The service is ours, not a third party's. The document is written to a temporary directory for the length of that one request and deleted as soon as the file is returned. It is never written to a storage bucket, it is not retained, and it is not used for any other purpose. The service's logs record only technical detail about the conversion itself and never the contents of the document. If you would rather a deed never left your browser at all, produce it in the format the tool generates locally and convert it yourself.

Trust deeds sent for review

Trust Review reads an existing trust deed and its Letter of Authority and flags the points that need attention. Those documents contain the full names and identity numbers of the founder, the trustees and often the beneficiaries. When you press Analyse, the files go from your browser directly to our review service on Google Cloud Run in Frankfurt, Germany. That service passes them to Google's Gemini model on Vertex AI, in the same Frankfurt region, which reads them and returns the review to your browser.

The review service is ours. It holds the documents in memory for the length of that one request only: they are never written to disk or to a storage bucket, not retained, and not used for any other purpose. Its logs record only the size of the files, how long the review took and whether it succeeded, never names, identity numbers or any content of the documents. Google processes the documents as our operator under its cloud data processing terms, and does not use them to train its models. Only a signed-in adviser can send a deed for review. If you would rather a deed never left your browser, do not use Trust Review for it.

Who else sees it

Only those operators, and only to the extent needed to run the service: Vercel for hosting, Neon for the database, Clerk for sign-in, our own conversion service for the moment a deed is turned into a PDF, and our own review service with Google's Gemini model on Vertex AI for the moment a deed is read by Trust Review. No client information is shared with anyone else. Who inside Sui Generis Labs can open a record is dealt with under Who can see client records above.

How long it is kept

Client records are kept until you delete them. There is no automatic deletion, because you are better placed than we are to know when a matter is finished. You can delete any client record, and everything stored against it, from the Clients page at any time, and deletion is immediate and permanent. If you close your account, tell us and we will remove what remains.

Security

Everything is served over an encrypted connection and the database is reachable only with credentials held by the application. Access to the tools requires an invitation and a code sent to your email address; there are no passwords to be guessed or reused. We cannot promise that any system is perfect, and if information under our control is accessed by someone who should not have it, we will notify you and the Information Regulator as the Act requires.

Your rights

You may ask what we hold about you and receive a copy of it, ask us to correct or delete anything that is inaccurate, irrelevant or out of date, and object to our processing. Ask at admin@suigenerislabs.co.za.

If you are not satisfied, you may complain to the Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. General enquiries enquiries@inforegulator.org.za, complaints POPIAComplaints@inforegulator.org.za.

A word about whose information this is

When you save a client record you are usually saving somebody else's personal information, not your own. You remain responsible for having a lawful basis to collect and share it, and for telling that person what you are doing with it. We process it on your instruction, as your operator, and we do not contact your clients.

Changes

This is version 2026-09-30. If it changes materially you will be asked to read and accept the new version before you can carry on using the client record.

The service is currently in beta. Please use invented families rather than real client detail while that remains the case.