How we handle your documents
Effective October 1, 2026 · For professionals and companies who study confidential material with RepSavi
You may upload contracts, price lists, proposals and internal notes. This page says plainly what happens to them. It describes what the app actually does today; where something depends on a provider's own terms we say so and link the source. It is not a certification: RepSavi is not itself SOC 2 or ISO 27001 certified, and it relies on the providers below for hosting and AI.
The short version
- Your documents are private to your account. Nobody else using the app can see them, and we do not read or review them.
- They are not used to train AI models, ours or anyone else's. The AI providers we use state that data sent through their business APIs is not used for training.
- Only two outside companies ever see document content, and only to do what you asked: Anthropic (questions, marking, explanations, answers, summaries, reading PDFs and photos) and OpenAI (only if you use voice dictation).
- You can delete everything: one document, a subject, or your whole account. You can also choose not to store original files at all.
- We keep content out of our logs and error reports.
Where a document goes
- You paste or upload it. It travels over an encrypted connection to our server (Railway).
- The text (and, unless you switch it off, the original file) is stored for your account in our database and file storage (Supabase), encrypted at rest.
- When you take a test, ask a question, or request a summary, the relevant text is sent to Anthropic for that one task, and the answer comes back. For a long document only the parts needed are sent.
- Nothing is sent anywhere else. There are no advertising or analytics services in the app; we only keep a simple first-party log of when you open the app and which features you use, never any content.
Who processes your data
| Provider | What for | What they see | How long they keep it |
|---|
| Anthropic (Claude) | Writing questions, marking, explaining, answering, summarising, reading PDFs and photos | The text or file for the task | Deleted from their systems within 30 days by default; not used for training. Zero data retention is available to business customers by agreement. Source |
| OpenAI | Voice dictation only | Your voice while you dictate | Up to 30 days for abuse monitoring; not used for training. Source |
| Supabase | Database, file storage, sign-in | Everything stored for your account (encrypted) | Until you delete it; encrypted backups expire after a limited period. SOC 2 Type 2 and ISO 27001. Source |
| Railway | Runs the application server | Data in transit through the server | Not stored by the server |
| Sentry (error reports) | Finding bugs | Technical error details only, never content | Per Sentry's settings |
Security measures
- Encrypted connections between the app, our server and every provider; stored data is encrypted at rest by our database provider.
- Every request is tied to a signed-in account and the server checks that the document belongs to it, so one learner cannot reach another's documents.
- Logs and error reports never contain document text or answers: request bodies, headers and database query values are removed before anything is written or sent.
- Limits on how fast an account can upload and use AI, to prevent abuse.
- Passwords are handled by our sign-in provider; we never see them.
Your controls
- Report a problem on any question or mark. We then keep that question, the passage it rests on and your answer, never the rest of the document; reports are deleted with your account.
- Delete a document from its card, a subject with everything in it, or your account (Settings) which removes all your content and uploaded files.
- Keep original files: off (Settings) keeps only the text of what you upload; the file itself is never stored.
- Export all your data at any time (Settings).
What we do not do
- We do not sell or share your documents, and we do not use them for advertising.
- We do not train models on your documents.
- We do not read your documents. Technical access to the database is limited to the people who run the service and is used only to keep it working, to help with a problem you report, or where the law requires it.
Please note
- Do not upload material you are not allowed to share with a processing service, or regulated health information, unless you have agreed this with us in writing.
- Temporary copies: while a long PDF is being read, or your next test is being prepared, a working copy (the text read, or the prepared questions) is held in our database for a few hours at most, and is removed with your account if you delete it.
- Backups: deleted data can remain in our database provider's encrypted backups for a limited period before they expire.
- Hosting regions and the provider terms above can change; we will update this page and the Privacy Policy when they do.
For companies
If your organisation needs a signed data processing agreement, a list of sub-processors with their locations, zero-data-retention processing with the AI provider, or a security questionnaire answered, write to support@repsavi.com. We will respond with the documents and, where your requirements need it, arrange them with the providers.
See also the Privacy Policy and the Terms of Service.