Who we are and what this covers
This Privacy Policy explains how Southern Global Technologies, Inc. (“TheWriter”, “we”, “us”) handles personal data when you visit our website, create an account, or use the TheWriter Retrieval API (the “Service”).
Two different roles. We act as a controller for data about our own customers and website visitors — your account, billing and usage of the Service. We act as a processor for the content you connect to the Service, which may contain personal data about your own users, employees or customers. For that content, you are the controller and we process it on your instructions.
This policy describes our practices in both roles. Where we act as a processor, the agreement with our customer, including any data processing agreement, takes precedence over this policy.
Personal data we collect
Information you give us
- Account data — name, work email address, password or federated identity, company name, and role.
- Billing data — billing contact, billing address, tax identifiers and subscription details. Card details are collected and stored by our payment processor, not by us.
- Communications — messages you send to support or sales, and their contents.
Information we collect automatically
- Usage data — API calls, query volume, endpoints used, timestamps, error rates and performance metrics.
- Device and log data — IP address, browser and operating system, referring pages, and pages viewed.
- Cookies and similar technologies — as described in the cookies section below.
Information from third parties
- Identity providers — if you sign in with Google, we receive your name, email address and profile identifier from Google. We do not receive your Google password.
- Connected sources — when you connect a third-party source such as a document store, wiki or ticketing system, we receive content and metadata from it, which is treated as customer content (see below).
Customer content
The sources you connect and the queries you submit may contain personal data about third parties. We process that content on your behalf, as a processor, solely to index it and return retrieval results to you. We do not control what you choose to connect, and you are responsible for having a lawful basis to provide it.
How we use personal data
| Purpose | Data used |
|---|---|
| Provide, operate and maintain the Service | Account, usage, customer content |
| Authenticate you and secure accounts | Account, device and log data |
| Process payments and manage subscriptions | Billing, account |
| Provide support and respond to enquiries | Account, communications, usage |
| Monitor reliability, debug and improve the Service | Usage, device and log data, aggregated data |
| Detect, prevent and investigate abuse, fraud and security incidents | Account, usage, device and log data |
| Send service and, where permitted, marketing communications | Account, communications |
| Comply with legal obligations and enforce our terms | As required |
We do not train generally available machine learning models on your customer content, and we do not sell personal data. Content you connect is indexed to serve your retrieval requests. We may use aggregated, de-identified data — from which no individual or customer can be identified and your content cannot be reconstructed — to operate and improve the Service.
Legal bases for processing
Where the EU or UK GDPR applies and we act as a controller, we rely on:
- Performance of a contract — to provide the Service, manage your account and process payments.
- Legitimate interests — to secure and improve the Service, prevent abuse, and market to business contacts, balanced against your rights.
- Consent — for non-essential cookies and certain marketing, which you may withdraw at any time.
- Legal obligation — to meet accounting, tax and other legal requirements.
Where we act as a processor, our customer determines the legal basis for processing the content it connects.
International transfers
We and our service providers may process personal data in countries other than your own, including in countries that may not provide the same level of protection as your jurisdiction.
Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on an appropriate safeguard — typically the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable — and we carry out transfer risk assessments where required. You can request a copy of the relevant safeguards at [privacy contact email].
How long we keep personal data
We keep personal data only as long as necessary for the purposes described in this policy.
- Account data — for the life of your account, and for a limited period afterwards to handle disputes and meet legal obligations.
- Customer content — for as long as you keep it connected. When you disconnect a source or close your account, we delete or de-identify it within a reasonable period, subject to routine backup cycles.
- Billing records — for the period required by tax and accounting law.
- Logs and usage data — typically for a rolling period sufficient for security, debugging and capacity planning, after which they are deleted or aggregated.
Backups are overwritten on a rolling schedule; data removed from the live Service may persist briefly in backups before being cycled out.
Security
We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit, encryption at rest, access controls and least-privilege administrative access, logging and monitoring, and review of changes to production systems.
No system is perfectly secure. If we become aware of a personal data breach affecting your data, we will notify you without undue delay and as required by applicable law. Report a suspected vulnerability or incident to [security contact email].
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and receive a copy;
- correct inaccurate or incomplete data;
- delete your data in certain circumstances;
- restrict or object to processing, including objecting to direct marketing at any time;
- receive your data in a portable, machine-readable format;
- withdraw consent where we rely on it, without affecting prior processing;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these, contact [privacy contact email]. We will respond within the period required by applicable law and may need to verify your identity. We will not discriminate against you for exercising your rights.
If your personal data is contained in content connected by one of our customers, we act as a processor. Please direct your request to that customer; if you contact us, we will refer you to them or assist them in responding.
If you are in the EEA, the UK or Switzerland, you may also lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concerns first.
Children
The Service is a business product and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact [privacy contact email] and we will delete it.
Changes to this policy
We may update this policy as the Service and the law evolve. The effective date at the top of this page shows when it last changed.
If we make a material change, we will give reasonable notice — for example by email to your account address or a notice in the Service — before it takes effect.
Contact us
For privacy questions or to exercise your rights, contact [privacy contact email].
For security reports, contact [security contact email].
You can also write to us at:
Southern Global Technologies, Inc.
[registered address]