Privacy notice
Last updated 7 November 2026.
Who is responsible
Allocatur, Cape Town, South Africa, operates Allocatur. For your account, your invitation request and your payments, we are the responsible party under the Protection of Personal Information Act. For the matter documents you upload and the personal information in them, your firm is the responsible party and we act as its operator: we process them only to draw the bill or objections you ask for, and on these terms.
What we collect
When you request an invitation: your email address, firm, role and any note you add. When you use Allocatur: your account email, your firm details for the bill heading, the matters you open, the documents you upload, and the bills, items and objections you create. When you pay: the payment reference and amount; card details are handled by Paystack and never reach us.
Where it is stored
In a Supabase project in the European Union (Ireland), with backups kept by Supabase for a short rolling period. Uploaded files sit in private storage. The application lets each account read only its own matters and files; it has no view for staff to browse them. Our administrators can access the database and storage to operate the service, investigate a fault or respond to a request from you, and do not otherwise open matter files. Invitation requests are read by administrators, who action them.
Who processes it
To draw a bill or draft objections, the documents you select are sent to Anthropic’s API, which runs the model. Anthropic does not use API inputs or outputs to train its models. Payments are processed by Paystack. Hosting is on Vercel, and transactional email is sent through Supabase. Anthropic’s API is served from outside South Africa; the transfer rests on Anthropic’s contractual commitments on confidentiality and data use. We do not sell your data or share it with anyone else.
How long we keep it
Matters, documents, bills and objections are kept for as long as the matter exists in your account. Deleting a matter removes its documents, bills and items from the live database and storage; copies fall out of backups within the backup retention period. Documents sent to Anthropic’s API are retained by Anthropic only for the period its API terms allow for abuse monitoring. Invitation requests are kept until actioned, or deleted on request. Payment records are kept for five years for accounting and tax.
Your rights
You may ask what we hold about you, ask for it to be corrected or deleted, and object to processing. Reply to any email from Allocatur and we will respond. We answer within a month. You may also complain to the Information Regulator of South Africa.