Privacy Policy

Raitu is provided by Emitserv Pty Ltd (“Emitserv”, “we”, “us”), a South African company, together with its subsidiary Raitu. For anything in this policy, you can reach us at support@raitu.tech or by post at73 Zenith Drive, Umhlanga Ridge, KwaZulu-Natal, South Africa.

We collect information in three ways: what you give us, what you create with us, and what we observe about how you use Raitu.

Account information. When you sign in with Google or your email, we receive the details your provider shares with us: typically your email address, and sometimes your display name. We store a profile in your name, including your plan (such as the free trial or Plus) and when you joined.

Session content. Everything you teach yourself with Raitu is yours: the topics you ask about, your typed and spoken questions, the session plans and figures the tutor draws for you, your answers to understanding checks, and your replay/scrub positions. This content is stored in your account so your history follows you across devices.

Voice recordings. When you speak a question out loud, Raitu records your speech to transcribe it and understand what you asked. Transcripts become part of your session. We do not use your voice to train models unless you consent separately.

Payment information. When you buy a plan or a session pack, your card or instant EFT payment is handled entirely by our payment provider, Paystack. We never receive or store your full card details. We may store limited details needed for receipts and refunds, such as the last four digits of your card, the payment method used, and the transaction reference.

Usage data. We collect basic technical information needed to run and improve the service, such as the content of your session requests, response quality signals, error reports, and standard device/browser information (for example browser type, rough location at country level, and IP address, used for security and abuse prevention).

Product analytics and session replay. On our live site we use PostHog to understand how Raitu is used and where people get stuck. PostHog collects page views, clicks on key buttons (such as starting a session or buying a plan), and basic device/browser information. For about 1 in 10 visits it also records a screen replay: mouse moves, clicks, scrolls, and pages viewed. It does not record your camera or microphone. Text you type is masked by default, and we do not record passwords, payment details, or content inside cross-site frames. Local and preview visits are never recorded.

Local device data. Raitu keeps your sessions in your account (they sync across your devices). We use a small amount of browser storage (localStorage) to remember your preferred voice and mute setting, and a cookie to remember that an anonymous visitor has already used their one free session.

You can attach your own study material to a session: PDFs, photos of your notes, and Word and PowerPoint files on Plus. Raitu reads what you attach once, in order to build a structured summary of its content (the digest), and everything you then ask for, a narrated session, an exam teach-through, a question walkthrough, a practice quiz, a revision sheet or a set of flashcards, is generated from that digest. Nothing in this section changes the rest of the policy; it explains what this one feature does with your material.

Your file itself is not kept. The uploaded file is sent to Google Gemini, our model provider, which receives its content in order to read it (the same provider that plans and narrates your sessions, see section 5). It is held in a private storage bucket at our hosting provider only until the digest has been saved, and is then deleted: what remains is the extracted content and the artifacts it produced, never the original file. Google Gemini is a third-party processor acting on our instructions, and this is one of the cross-border transfers described in section 12. We do not send your uploads to any other provider, and we do not use their content for advertising.

Retention. Uploaded documents behave exactly like the rest of your session content. If you are signed in, the digest and everything made from it stay in your account until you delete them, and you can delete them at any time (below). If you are not signed in, nothing survives the visit: an anonymous upload is available for that visit only, expires after about 2 hours, and is then deleted automatically together with everything it produced. Section 7 lists retention for the rest of your data.

Deleting a document. Every document card carries a Delete action. Using it removes the digest, every quiz, summary and flashcard set made from it, any stored file objects still associated with it, and the card itself. Deleting your whole account removes your documents with it, as section 8 describes.

Please upload with care. Only upload material you are entitled to use, and avoid attaching documents that contain somebody else’s personal information. Raitu reads an upload in order to teach it back to you; it is not a place to store documents, and the extracted content exists so your session can be replayed and regenerated later.

• To generate, narrate, and illustrate the sessions you request, including voices for narration and figures the tutor draws.
• To understand your spoken questions and answer them mid-session.
• To keep your sessions synced across devices so they are available whenever you sign in.
• To phrase understanding checks and re-explanations based on your answers.
• To keep the service secure: authenticate you, prevent abuse, and enforce the Terms of Use.
• To respond to you when you contact us, and to improve Raitu.

Raitu is an AI-assisted product. To teach, narrate, and illustrate, certain parts of your session are sent to third-party processing services:

• LLM providers (such as Google Gemini via our server) receive your topic, questions on the topic, session context, and the extracted content of any document you upload, in order to plan and generate sessions.
• Speech services (Google Gemini, Fish Audio and/or ElevenLabs for narration; OpenAI for transcribing your spoken questions) receive the relevant text or audio.
• Image generation services (Google Gemini image models, OpenRouter image models, and/or ElevenLabs when ElevenLabs image generation is enabled) receive figure descriptions to create illustrations, which are then stored on Cloudinary.
• Cloudinary stores images of the figures the tutor draws (served via secure URLs embedded in your sessions).
• Supabase hosts your account and tutoring session data. Google provides sign-in if you choose it.
• Paystack processes card and instant EFT payments when you buy a plan or a session pack.
• PostHog provides product analytics and session replay on our live site, as described in section 2. PostHog processes usage data on our behalf and may process it in other countries (see section 12).

These providers process data on our behalf and under their own privacy terms, and only as needed to render the service you asked for. Our own server code does not send your contacts, passwords, or other unrelated personal data to them. We do not sell your personal information to anyone, and we do not use the content of your sessions for advertising.

Data is encrypted in transit (TLS) and at rest on our hosting providers. Access to your tutoring session data is restricted by row-level security to the account that owns it. We review our practices as we grow. No system is perfectly secure, so we ask that you don’t share personal or sensitive information in your sessions that you’d rather not have stored.

If a security compromise ever affects your personal information, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible, as section 22 of POPIA requires: telling you what happened, what we are doing about it, and what you can do to protect yourself. Where the GDPR applies to you (for example, if you are in the EU or UK), we will also notify the relevant supervisory authority within 72 hours, as the GDPR requires; for POPIA, 72 hours is our internal target, never the legal deadline.

• Tutoring sessions and history: kept while your account exists, so you can replay and resume them.
• Uploaded documents (signed in): the extracted content and everything made from it are kept with your account until you delete them from the document card.
• Uploaded documents (not signed in): available for the visit only; deleted automatically, with everything they produced, after about 2 hours (section 3).
• Account profiles: kept while you have an account.
• Voice recordings: kept with the session they belong to; you can delete any session at any time.
• Usage and error logs: kept for up to 12 months, then deleted or aggregated.
• Product analytics and session replay: kept for a limited time to debug and improve the service, then deleted or aggregated.
• If we ever process personal data under a longer legal obligation, we’ll keep it as required by law.

Depending on where you live, in South Africa under the Protection of Personal Information Act (POPIA) and elsewhere under applicable law (including the GDPR and CCPA), you may have the right to:

• Access a copy of your personal information.
• Correct information that is inaccurate.
• Delete your account, sessions, or voice recordings.
• Object to, or restrict, processing of your personal information.
• Withdraw consent, where processing is based on consent.
• Receive your data in a portable format.
• Complain to your supervisory authority. In South Africa, that is the Information Regulator.

How to exercise these rights. Many of them are self-service: delete individual sessions from the sidebar at any time, delete an uploaded document (with everything made from it) from its card, and use your account settings to download a copy of your account data (access and portability), or to delete your whole account with a typed confirmation. Deleting your account removes your profile and age declaration, sessions, uploaded documents and everything made from them, packs, spend history, results, streaks and consent records, and clears your cached session audio where possible. Generated figure images are stored by image content (not by account) and may remain in our image cache. We keep only records the law requires us to keep, such as billing records for accounting, and limited operational logs as described in section 6.

For correction of information that is inaccurate, objection, restriction, withdrawing consent, or anything you’d rather we did for you, contact our Information Officer at support@raitu.tech or by post at 73 Zenith Drive, Umhlanga Ridge, KwaZulu-Natal, South Africa. We’ll respond within 30 days, and if POPIA lets us keep processing something you’ve objected to, we’ll tell you why.

Under POPIA, our Information Officer is responsible for how Raitu processes personal information and for handling requests, questions, and complaints about it. You can reach our Information Officer at support@raitu.tech or by post at 73 Zenith Drive, Umhlanga Ridge, KwaZulu-Natal, South Africa.

POPIA registrations for Information Officers, breach notifications, and complaints all run through the Information Regulator (South Africa)’s POPIA portal at inforegulator.org.za. The Regulator can also be reached at enquiries@inforegulator.org.za or 010 023 5200, or by post at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. If you believe we have processed your personal information unlawfully, raise it with us first; you can also complain to the Regulator at any time.

Raitu is only for people aged 13 and older. We don’t knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us and we’ll delete it promptly.

Raitu stores your tutoring session history in your account on our servers, synced across your devices. We use a small amount of browser local storage (localStorage) to remember preferences like your narration voice and mute setting, and a cookie to track that an anonymous visitor has used their one free session. Our analytics provider PostHog also sets its own cookies and storage on our live site to remember your device and whether your visit was sampled for session replay. We don’t use third-party advertising cookies, and we don’t track you across other sites. You can block analytics and replay with a tracker-blocking browser (such as Brave) or an ad-blocker; tutoring still works.

Raitu is built in South Africa and hosted with providers who may process data in other countries (including the United States and the European Union) to deliver sessions. We take steps to protect data transferred internationally, in line with POPIA and applicable data protection law.

We may update this policy as Raitu grows. Significant changes will be announced here, on this page, with a new “last updated” date. Keep using Raitu after a change and you accept the updated policy.

Questions, requests, or concerns about privacy? Email support@raitu.tech, or use our contact page.