Privacy Policy
Effective 19 August 2026. Version 1.0.
This policy explains what CrossExamine stores about you, why, who else touches it, and how to get all of it back or destroyed. It is written to the South African Protection of Personal Information Act 4 of 2013 (POPIA) and to the EU and UK General Data Protection Regulation.
The short version. We store your account, what you write, and what you ask. We use it to run the app for you and for nothing else. We do not sell it, we do not advertise against it, we run no analytics or tracking on this website, and we do not train AI models on it. You can delete all of it from your account settings, or by sending one email.
1. Who is responsible for your data
The responsible party under POPIA, and the data controller under the GDPR, is Shamah Muteme, a sole proprietor trading as Agape Labs, in the Republic of South Africa. Shamah Muteme is also the designated Information Officer for POPIA purposes.
Contact: support@agape-labs.co.za. Postal address available on request.
2. What we collect
Data you give us directly
| Category | Examples |
|---|---|
| Account | Email address, username, display name, and an authentication identifier issued by our login provider. |
| Profile and preferences | Chosen mode, language, Bible translation preference, and any worldview you choose to declare at signup. |
| Study content | Notes, saved objections and their review schedule, verse tags, highlights, reading-plan progress, study streaks. |
| What you ask | Questions to Sage, Field Mode queries, claims submitted for checking, practice-conversation transcripts, dialogue sessions, drills, and the answers produced for them. |
| Personal and pastoral writing | Prayer requests, reflections, and anything written in Seeker mode, including a Seeker letter if you choose to write one. |
| Group activity | Study-circle membership, and anything you deliberately post into a circle. |
| Correspondence | Emails you send us and our replies. |
Data generated by your use
- Counts of how many times you used each metered feature today, so allowances can be enforced.
- Technical logs of AI calls — which feature, when, how many tokens — used to control cost and detect faults.
- Records of which source channels contributed to answers you received. These are what a future creator revenue share would be calculated from.
- Ordinary server logs, including IP address, for security and diagnosis.
- Account timestamps, such as when you were last active.
Payment data
We never see or store your card number. Payments are handled by Paddle.com Market Ltd as Merchant of Record. We receive from Paddle only what we need to run your subscription: which plan you are on, whether it is active, the billing term, renewal dates, and a transaction reference.
3. Religious belief: the sensitive category, handled explicitly
A great deal of what CrossExamine holds reveals religious or philosophical belief. That is special personal information under POPIA section 26 and a special category of personal data under GDPR Article 9. We are stating this plainly rather than burying it, because it is the most sensitive thing this application holds.
This includes, at minimum:
- any worldview or faith position you declare;
- prayer requests and pastoral writing;
- anything written in Seeker mode, which by design is often written by someone in doubt about their faith;
- verse tags, which record how you personally respond to a passage of scripture;
- the questions you ask, which reveal what you are wrestling with.
Our legal basis for processing it is your explicit consent, given when you provide it. You may withdraw that consent at any time by deleting the content or your account. Withdrawal does not affect processing already carried out.
Three consequences we hold ourselves to:
- No route in the application lets one user read another user’s private study data. Sharing happens only where you deliberately post into a shared space, and only for the items you individually mark as shareable.
- Verse tags use a fixed vocabulary and have no free-text field. That is a deliberate design decision to limit how much sensitive detail can accumulate against a scripture reference.
- None of it is used for advertising, profiling for third parties, or model training.
4. Why we process it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account | Performance of our contract with you |
| Answering your questions and saving your work | Performance of our contract |
| Storing religious or pastoral content | Your explicit consent (POPIA s27(1)(a) / GDPR Art 9(2)(a)) |
| Taking payment and managing subscriptions | Performance of our contract; legal obligation for tax records |
| Enforcing usage allowances | Performance of our contract |
| Security, fraud and abuse prevention | Our legitimate interest in a service that is not abused |
| Diagnosing faults and improving the product | Our legitimate interest, using the least identifying data that works |
| Service emails you cannot opt out of (billing, security, material changes) | Performance of our contract |
| Early-access and product emails | Your consent, withdrawable in one reply |
| Keeping accounting records | Legal obligation |
We do not carry out automated decision-making that produces legal or similarly significant effects on you.
5. How AI processing works
When you use a feature that produces a written answer, the text of your question — together with source passages retrieved from our index — is sent to a third-party AI provider, which returns generated text. We then store the question and answer in your account so you can read them again later.
- Your content is not used to train the provider’s models. We use these providers under terms that exclude training on submitted data.
- We do not train any model of our own on your content.
- Requests are associated with your account internally so allowances and costs can be attributed, but we do not send the provider your name or email address.
- Some features work entirely without an AI call — reading, searching, translation comparison, lexicon lookup, and re-reading answers you already have. Those involve no third-party AI processing at all.
6. Who else processes your data
We use a small number of operators (POPIA) / processors (GDPR). We do not sell personal information to anyone, and we do not share it for anyone else’s marketing.
| Who | What for | Where |
|---|---|---|
| Google (Firebase Authentication) | Sign-in and account identity | EU / USA |
| Groq, Inc. | AI inference for generated answers | USA |
| Microsoft (Azure) | Hosting, database and AI inference (being introduced) | EU / USA |
| Contabo GmbH | Server hosting | Germany |
| Cloudflare, Inc. | Website hosting and delivery | Global edge network |
| Paddle.com Market Ltd | Payments, invoicing and sales tax, as Merchant of Record | United Kingdom |
This list is kept current. Ask us at support@agape-labs.co.za for the version in force on a given date.
We may also disclose data where the law requires it, to establish or defend a legal claim, or to protect someone’s safety. If the business is ever sold or transferred, your data may move with it, and this policy continues to apply until you are told otherwise.
7. Where your data is held
Your data is processed in South Africa, the European Union, the United Kingdom and the United States, depending on the provider. Transfers out of South Africa are made under POPIA section 72, and transfers out of the EU or UK under Standard Contractual Clauses or an equivalent lawful mechanism.
8. How long we keep it
| What | Kept for |
|---|---|
| Account and study content | While your account exists |
| After you delete your account | Erased from live systems within 30 days |
| Encrypted backups | Aged out within 90 days of deletion |
| Server and security logs | Up to 90 days |
| Invoices and accounting records | As long as tax law requires, typically 5 years |
| Aggregate usage counts with no identifier | Indefinitely; these are no longer personal data |
9. Your rights, and how to use them
You have the right to:
- Know whether we hold data about you and get a copy;
- Correct anything inaccurate;
- Delete your data;
- Object to processing based on legitimate interests;
- Restrict processing while a dispute is resolved;
- Portability — receive your content in a machine-readable format;
- Withdraw consent at any time, including for the religious and pastoral content described in section 3;
- Complain to a regulator (section 16).
Email support@agape-labs.co.za. We reply within 30 days. There is no charge unless a request is clearly excessive or repetitive, and we will say so before charging anything.
10. Deleting your account
You can delete your account from your account settings, or by emailing us. Deletion removes your profile, notes, saved objections, verse tags, questions and answers, prayer and Seeker-mode writing, and your study-circle memberships.
Two things survive, and we would rather say so than surprise you:
- Invoices and payment records, which tax law requires us to keep.
- Content you deliberately posted into a shared study circle, which may remain visible to that circle. Tell us if you want it removed and we will remove it.
11. Security
- Traffic is encrypted in transit with TLS.
- Authentication is delegated to Firebase Authentication; we never handle your password.
- Card details never reach our systems.
- Administrative functions are restricted to an explicit allowlist of accounts and fail closed — if the list is empty, nobody has access.
- Access to production data is limited to those who need it to operate the Service.
No system is perfectly secure. If a breach occurs that is likely to harm you, we will notify you and the South African Information Regulator as POPIA section 22 requires, and any other regulator the law requires.
12. Cookies and local storage
This website sets no cookies and runs no analytics, advertising or tracking of any kind. There is nothing here to consent to, which is why you have not been shown a banner.
The application itself stores a small amount of data in your browser or device — a sign-in token so you are not logged out constantly, and preferences such as your chosen language and mode. This is necessary for the app to function and is not used to track you across other websites.
If you join the early-access list, we store the email address you give us and use it once, to tell you the product has opened. Reply to any message and we delete it.
13. Children
CrossExamine is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal information, write to us and we will delete it.
14. Creators and third-party recordings
Separately from user data, our search index is built from apologetics recordings that their authors published publicly. Where such material identifies a speaker, that is personal information about them, and this section is addressed to them.
- Material is stored and shown as an attributed quotation, linked to the original recording.
- The Service does not generate new statements in a named person’s voice or style.
- If you want your material removed, write to support@agape-labs.co.za and it is removed. Removal deletes the stored transcripts and everything derived from them, not merely the visible quotations. There is no form and no negotiation step.
15. Changes to this policy
We may update this policy. Material changes are notified by email to registered users at least 30 days before they take effect. The effective date and version at the top of this page always reflect the current text.
16. Contact and complaints
Shamah Muteme (Information Officer), trading as Agape Labs
Republic of South Africa
support@agape-labs.co.za
Please raise a complaint with us first. If you are not satisfied, you may complain to the Information Regulator (South Africa) at inforegulator.org.za. If you are in the EU or UK you may instead complain to your national data protection authority, or to the Information Commissioner’s Office at ico.org.uk.