Privacy and POPIA
What happens to the email you forward?
We use it to investigate it for you and, with your address and name removed, to improve our screening models. The email and its attachments are deleted after 30 days; the pictures and text we derive from it stay with the case. The service providers that help us are named below, and Meta's models are called with store: false.
Rizonetech (Pty) Ltd · Last updated 31 Oct 2026 · By Derick Payne, Rizonetech. I read the code that does each of these things on 31 October 2026 before writing this page.
Who is responsible for your information?
Rizonetech (Pty) Ltd in George runs IsItLegit and is the responsible party under the Protection of Personal Information Act (POPIA). Our Information Officer is Derick Payne, reachable at hello@isitlegit.co.za.
What do we process, and why?
- Mail you forward or upload, with its attachments, links and any voice note: to investigate it and give you a verdict.
- Your account: your name, work email, organisation and role, so you can sign in and see your cases.
- Feedback when you tell us a verdict was wrong, to measure and improve accuracy.
- Sign-in and security records, to keep accounts safe.
We accept mail only from members' verified addresses and domains.
Forwarded mail may be kept and used to improve IsItLegit's screening models. Your address and name are removed, and other genuine mail is redacted. It is never sold or published. That training copy is not deleted after 30 days, and closing your account does not remove it; we have not set a fixed period for it. Loupe, the model that screens lookalike websites, is also trained on public web pages.
When Loupe screens a website for you, it receives that public page only.
How long do we keep it?
| Information | Kept for |
|---|---|
| The email and its attachments | 30 days, then deleted automatically |
| The pictures and text we derive from a message, such as rendered email and PDF pages | Kept with the case, not deleted at 30 days |
| Report links in our replies | Expire after 7 days |
| Sign-in and security records | 365 days |
Who helps us process it?
| Provider | What they do for us | What they receive |
|---|---|---|
| Cloudflare | Hosting, storage, mail intake and the sealed browser | All case data, stored in our account |
| Meta Model API | Muse Spark, Muse Wonder, SAM 3.1 and Muse Voice Transcribe | Rendered pages, extracted text and audio. Standard model IDs only, store: false on every call |
| SMTP2GO | Sending our replies and alerts | Your address and the verdict summary |
| Google Web Risk | Checking links against Google's list of unsafe sites | Links with the query string removed |
| Fireworks AI | Running Loupe to screen lookalike websites, and to train it | Public web pages when screening a site; in training, public web pages and forwarded mail with your address and name removed and other genuine mail redacted |
Fireworks states in its published data handling terms that it does not log or store prompt or generation data for open models unless a customer opts in.
Some of these providers process information outside South Africa. Section 72 of POPIA sets the conditions for sending personal information abroad (Information Regulator, POPIA). We are still confirming which condition covers each provider; ask us at hello@isitlegit.co.zaand we will tell you what we have confirmed so far.
What happens to a protected business's details?
A protected business's registered bank account is never shown to anyone who checks mail. A checker only learns whether an invoice matches or does not match the registered account, and checks are rate-limited so the details cannot be guessed.
What are your rights?
You may ask what we hold about you (POPIA section 23), ask us to correct or delete it (section 24), and object to how we use it (section 11(3)). Write to hello@isitlegit.co.za and we will answer. If you are not satisfied, you may complain to the Information Regulator.