Where your words go

You choose which country processes what you type. This is what that means, what is actually sent, and why both choices are allowed — and, if you run a school or a business here, where you stand when what you are holding belongs to the people you serve.

Where your words are processed

  • Your data goes to America.
  • Cheaper. Your data goes to China.

You pick this where you type — beside the box you describe things in, and again when you sign in. It takes effect on the very next thing you type, and you can change it whenever you like.

Last updated 17 August 2026.

Why both of these are allowed

South Africa's privacy law — POPIA — does not stop you sending personal information to another country. It sets conditions, and section 72 is the part that names them. Two of those conditions apply here, and either one on its own would be enough.

  • You chose it. Consent from the person whose information it is has always been a lawful basis for sending it abroad, which is the whole reason this is a question you get asked instead of an answer we picked for you.
  • The provider is under contract. Whichever country you choose, the company processing your words is bound by an agreement that lets them do it only on our instructions — not use it for their own purposes, not pass it on, not keep it for their own reasons.

Which country the AI runs in

The AI that builds your apps and answers your questions runs on servers in another country, and you choose which. America is the default. Where a second country is offered, the option appears when you sign in and again beside the box you type in, and you can change it whenever you like.

What is sent depends on what you are doing. When you type anything into the assistant — asking it to build something, or simply asking it a question — it receives what you type and the names of your data sources and apps, not the information inside them. The names are sent so that a question phrased in your own words can be recognised as a question about your records. For a spreadsheet you uploaded, the name we hold includes its column headings, so those are sent too. If you attach a file to the conversation, the first rows of it are sent as well — up to 40 of them — because looking at the file is what you attached it for. A picture you paste or attach — a screenshot of something you want built or changed, a photo — is sent whole, because looking at it is what it was pasted for. Nothing else in your workspace sends its rows while you are simply talking.

The assistant also answers ordinary questions — the news, a price, how something works — and looks them up on the web when the answer depends on something current. When it does, the words of that question go to a search engine through the AI provider. Nothing from your own data, apps or records goes with it.

When you ask a question about your records, a sample of those records is sent, because that is what the answer is drawn from — at most 200 rows from each of up to four sources. If your app saves its own records, those can include the email address of whoever saved each one, since questions are often about who did what.

Your choice moves both of those. Whichever country you pick, the same rules apply: nothing is sent from another organisation, the provider is not permitted to use your data for its own purposes, and we do not send your password or card details anywhere.

Voice notes are handled by a separate provider and are not affected by this choice. Recordings are never kept.

If you work inside an organisation, its administrator can switch a country off for everybody in it. When that happens your own preference is kept, and used again if it is ever switched back on.

If you hold other people’s information here

If you run an organisation on this platform, most of what you put in is not about you at all — it is about the people you serve, and they never agreed anything with us.

POPIA has a name for each side of that, and the split is what makes it allowed. You are the responsible party: it is your information to hold, you had a reason to collect it, and you answer to the people it belongs to. We are the operator: we hold it on your behalf and do only what you tell us to. Sections 20 and 21 of the Act are the parts that set out what that second role may and may not do.

What being the operator means in practice:

  • We process it only to run your workspace. It is not sold, not shared with anybody you did not send it to, not used for advertising, and not used to improve anything of ours.
  • It never reaches another organisation. One rule in one place decides every read on this platform, and an organisation is the boundary it draws — there is no screen anywhere that could show one business another business's records.
  • Your own clients see only their own rows. When you publish an app to the people you serve, the filtering happens on our servers before anything is sent to their phone — never in the page, where somebody could look behind it.
  • You can take it back at any time. Remove a data source or an app and everything we stored for it goes immediately, with no archived copy — and where you connected a Google Sheet, we never held a copy at all, because we read it as we need it and can only ever read it.
  • A request from one of your clients — show me what you hold, correct it, delete it — is yours to answer. We act on your instruction; we do not answer for you and we do not decide.
  • If we ever had reason to think somebody had got at it, we would tell you straight away. The law requires that of an operator, and we would do it anyway.
  • The AI is the one place any of it leaves us, and you control that too. Rows are only ever sent when somebody asks a question in words — and if your organisation has to keep client information in one country, an administrator switches the other one off for everybody in it.
  • The arrangement between us is in writing, which is what section 21 asks for. Our terms say we may store and process what you put here only so far as we need to in order to run the service for you, and nothing wider. If your own compliance file needs that as a separate signed agreement, we keep one ready with our half already filled in — print it, add your details and sign, and we counter-sign. If you have your own version, send it and we will sign that instead.

If you run an exam centre

Everything above applies to an exam centre too: your candidates' details are your centre's, and we hold them on your behalf. Exams get their own section because the stakes are higher — most candidates are children, an entry carries their identity documents, and a concession can include a medical report, which the Act treats as special personal information.

What that means in practice:

  • What a family types on your entry form is held for your centre. Your own signed-in staff read it, and it is sent out only to the family it belongs to — their receipt, their timetable, their check-your-details message.
  • The public form never shows stored details back. A returning family is told only which boxes they can leave blank — never a name, a birth date or a phone number.
  • The receipt after a payment never carries an identity number or a date of birth, because receipts get forwarded and printed.
  • Documents uploaded for a candidate — the birth certificate, the photo, a medical report — go into your centre's own exam file. They are never listed anywhere public, and a medical report is asked for only where a concession needs one.
  • Exam records are used to run your series and for nothing of ours — not advertising, not training, nothing.

What stays yours to do

Being the responsible party is not something we can take off you, and you should be wary of anybody who says they can. Three things stay with you: telling the people you serve what you hold about them and why, having a lawful reason to hold it in the first place, and appointing an information officer with the Information Regulator — which every South African organisation has to do, whatever software it uses.

We can hold that information properly on your behalf, keep it away from everybody else, and hand it back or destroy it the day you say so. We cannot be the one who asked for it.

If your compliance file needs that arrangement as a separate signed document, ours is ready with our half already filled in — print it, add your details and sign, and we counter-sign.

Open the operator agreement

This is part of our privacy policy, which covers everything else we hold: Read the full privacy policy.