Privacy Policy

This Privacy Policy explains how Workcyte Digital Academy (SSM Registration No. 202603071928), operating the Thesis-It service, collects, uses, discloses and protects your personal data. This Policy is issued in accordance with the Malaysian Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA"). It is also informed by internationally recognised data protection principles, including the EU General Data Protection Regulation ("GDPR"), for users outside Malaysia. We act as the "data controller" for the personal data described in this Policy.

The thesis template or guideline you use for your structure, and the model theses you add, up to three, are read inside your browser. The file itself is never uploaded to Thesis-It: only the headings, rules and text the app extracted from it, and the structure you adopted, are stored in your account. When you choose to read your university's file or a model thesis with your own AI, you attach the file in your own AI chat, under your own account, and Thesis-It sends nothing. The app checks the reply you paste against the text it read in your browser, and stores none of the reply, only what you accept into your structure. When you ask your own AI how a model thesis argues, you attach it in your own AI chat in the same way, and Thesis-It sends nothing. The app keeps the findings it checked, each with your AI's short reason, as suggestions for you to accept or leave out. They describe the model's patterns, such as how its review groups earlier studies, never its wording, data or findings. A finding you leave out, or leave waiting, is deleted after thirty days, and only the ones you accept guide your drafts, in Thesis-It's own words, while you follow that model thesis. They are deleted thirty days after you stop following it. Your AI's reasons are never put in a prompt. You are responsible for your rights to the files you add. For each model thesis, the app also stores its writing style, measured as numbers such as how long its sentences and paragraphs run, never its words, and a keyed fingerprint of its wording: a one-way code for each run of eight words, computed with a key our server derives for your thesis and never stores, so someone who reads our database cannot read the words back from the codes. Each fingerprint is used only on our server, to check your thesis for passages that may repeat that model thesis: AI drafts and Polish suggestions before you keep them, and every passage of your thesis, the words you wrote yourself included, when the app checks your thesis. It is never sent to an AI service. A PDF you add to your source library is read the same way: its text is indexed and stored so the app can search it and check your citations against it, and the PDF file itself is not stored. If you use your own Gemini API key instead of the included AI, the key stays on your device and never reaches our servers. When you import a statistical results table, the table you paste or the results file you choose is read on your device. Only the title, the labels, the group and column names and the numbers you approve are stored in your account, with what the table and your answers say about how they were computed, any limits you chose to keep them with, the program you choose and the version and export date you give. When you analyse a data file, the file is read and analysed inside your browser, in a part of the page that cannot reach the network. The file and its file name are never uploaded, and no row or cell of it is uploaded as such: what is uploaded are the numbers you approve at Keep, such as counts, means, a minimum or a maximum. When you draw a chart of a kept result from your file, such as a histogram, a box plot, a scatterplot or a residual plot, the chart is drawn on your device and only the picture you approve is uploaded, as a figure of your thesis. A box plot, a scatterplot, a Q–Q plot or a residual plot can show single values from your file as points, as such charts in a thesis do. With the picture, the app stores which result and chart you chose and your settings, never a value from the file. A title or label you approve can start as the name of a column in the file: it is stored as you keep it, changed or not, and the file's other column names stay on your device. Only the results you keep are stored in your account: the title, the labels and the numbers you approve, the counts behind them, such as how many cases each correlation used and a chi-square's expected counts, and marks for some of the cautions shown with them, such as an improper solution, a weak loading or a low AVE, and the reasons a check was not run. They are stored with a record of how they were computed: which analysis ran, its options (for a bootstrap, its seed, its number of samples, its random number settings and how many samples were drawn again) (for parallel analysis, its seed, its number of random datasets and its random number settings), the columns it used, by their position in the file and never by their names, how many categories each column has, how many groups the grouping variable has, where each kept number sits in the analysis's output, the file's format, the values you declared as no answer, such as 99, and the positions of the columns each applies to, the items you reverse-scored with the lowest and highest answer you typed, and the scores you made with their items, the mean or the sum and the items a row must answer, by their position in the file and never by name, and the versions of the analysis software. The record also holds a one-way code of those settings, a one-way code computed from the file's bytes (its SHA-256) and a name you give the file, so you can tell which results came from the same data. The results you keep, their labels included, can appear in the documents you export and in the prompts the app prepares when you write about them. For group comparisons, only the group names you type are stored. The values in your file that identify the groups are shown on your device while you name them and are never uploaded. For a table of frequencies, the labels are the names its variables and their categories have when you keep it: each variable's name starts as its column's name in the file and each category's as a numbered name, such as Category 1, and you can change any of them. The numbers are the counts and shares of the rows in them. The values in your file that make up the categories are shown on your device while you name them and are never uploaded. For a chi-square test, you approve the two variable names in its summary and the row and column category names in its contingency table before keeping them. The table stores its counts, expected counts, percentages and residuals with those approved names. The category values and labels from your file show on your device only unless you choose them as an approved name.

When you add your ethics committee's application form, the form is read inside your browser and the file is kept in your browser's own storage, so the app can fill it in for you there. The file is never uploaded. Only its questions and answer areas as the app read them, its file name and a one-way code computed from its bytes (its SHA-256) are stored in your account, with the answers and details you give. Your committee's guidelines are read the same way, and only their file names, their one-way codes and the sentences that bear on an application are stored. A filled form, and your response to the committee, are made inside your browser. When a form asks for your identity card, passport or phone number, the number is kept only in your browser's storage and filled into the form there. It is never sent to Thesis-It or to any AI service. The app also takes the numbers your browser holds, and any identity card number, out of the prompts it prepares and the committee letters you add. A committee's letter is read on your device, and only its date, its comments, the decision you confirm and a one-way code of the letter are stored, not the letter's file or its file name. When you record a submission, its date, the committee's reference and your answers as they stood are kept, with a one-way code of each form filled in your browser, not the filled file.

Account and authentication data: your email address (required, for signing in by emailed link), your name if you give it, session cookies and sign-in tokens. Content: your thesis text and structure, the extracted text and rules from the templates, guidelines and model theses you use, the measured writing style and the keyed fingerprint of the wording of each model thesis you follow, up to three, your source library and the indexed text of your sources, the figures and tables you add, the charts you draw from your data files, as pictures, the statistical results you keep (for an imported table, with what the table and your answers say about how they were computed, any limits you keep them with, the program you choose and the version and export date you give; for results computed on your device, with the counts behind them, marks for some of their cautions and a record of how they were computed: the analysis and its options, for a bootstrap also its random number settings and how many samples were drawn again, for parallel analysis also its seed, its number of random datasets and its random number settings, the columns it used by their position in the file and never by their names, how many categories each column has, how many groups the grouping variable has, where each kept number sits in the analysis's output, the file's format, the values you declared as no answer, such as 99, and the positions of the columns each applies to, the items you reverse-scored with the lowest and highest answer you typed, and the scores you made with their items, the mean or the sum and the items a row must answer, by their position in the file and never by name, the versions of the analysis software, one-way codes of the settings and of the file, and the name you gave the file), your ethics application (your committee's forms as the app read them, the answers and details you give, the sentences kept from your committee's guidelines, the submissions you record, and your committee's comments with your replies), your notes, meeting records, checklists and progress records, and the documents you export. Collaboration data: the email addresses of the supervisors and readers you invite, the role you give them, and the comments and sign-offs they leave on your thesis. AI drafting and writing-refinement records: frozen draft packages, original and proposed text, candidate replies, accepted-draft provenance, review decisions and check results, kept for resumption, review and recovery. A Word file selected for writing refinement stays on your device. Only eligible extracted text is sent, and the other package contents are not uploaded. AI usage data: token and weighted-credit counts, their cost, timing and the provider and model used, kept to apply your allowance and to keep the services we pay for within their monthly budget. Free trial data: if you start the free trial, when it started and when it ends, its AI allowance and its use, a keyed one-way hash of your email address (a code computed from the address with a secret key, not the address itself) so that each address can start one trial, and keyed one-way codes computed in the same way from your account name and from the thesis titles you name during the trial. Billing data: subscription status and renewal history, and payment metadata such as transaction references and amounts. We do not store your card or bank details; those are held by our payment processor, CHIP. Technical data: IP address (for security and abuse prevention), user agent, access logs and an audit trail of account and billing actions.

We process your personal data to sign you in and provide the Service; to run the drafting and checking steps you start and any automatic checks you explicitly enable, which for the included AI means sending the relevant text to the Google Gemini API, OpenAI API and Anthropic API on your behalf; to share your thesis with the people you invite; to process your subscription payments and send billing emails; to communicate with you about the Service (transactional emails only, no marketing without your consent); to prevent, detect and investigate abuse, fraud and security incidents; to improve the Service in aggregated, non-identifying form; and to comply with our legal obligations.

When a supervisor or co-supervisor you share your thesis with comments on it or signs off a chapter, we email you at the address you sign in with, at most once every six hours for each thesis. The email names them, by the name on their account or by their email address, says what they did and where in your thesis, and gives your thesis's title with a link to open it. It never includes the words of a comment. You can turn these emails off in Settings at any time, or with the link in an email for 60 days after it is sent.

We process your personal data under contract performance (to provide the Service you subscribed to); legitimate interest (to secure the Service, prevent abuse and improve reliability); consent (where you have given it, for example when you invite a supervisor); and legal obligation (where required by applicable law).

We do not sell your personal data. We share your data only with the following categories of recipients. Infrastructure sub-processors necessary to operate the Service: Vercel Inc. (United States) for web application hosting and for Vercel Blob storage of the figures you add (stored in the Singapore region); Neon (Singapore, ap-southeast-1) for the PostgreSQL database; Fly.io (Singapore) for rendering document previews; Resend (Tokyo, ap-northeast-1) for transactional email; Sentry (European Union) for application error monitoring. Payment processor: CHIP In (Malaysia) for subscriptions in Malaysian Ringgit. AI processing: Google LLC (United States), Gemini API, OpenAI (United States), API, Anthropic (United States), API, receiving the text of the included-AI steps you start and automatic checks you enable. Draft packages and replies may be retained in your account for resumption and review. Accepted text keeps its AI-origin records. Your provider preference in Settings can restrict these requests to a subset of the disclosed providers. OpenAI API requests use store:false to avoid retaining Responses application state. Standard abuse-monitoring logs may still be retained for up to 30 days unless separate account controls apply. We do not claim zero provider retention. Adding another provider requires updating this disclosure before it can receive content. Academic metadata services queried on your behalf when you search for or verify a source, or check the papers behind a research gap you tick: Crossref (United States) and OpenAlex, operated by OurResearch (United States). People you invite: a supervisor or reader you share your thesis with sees your thesis text, your name and the email you signed in with. Legal and compliance: government authorities or courts where required by law.

Some of our sub-processors are located outside Malaysia. We transfer personal data to these locations in accordance with the PDPA and the Personal Data Protection Guidelines No. 03/2025 on Cross-Border Personal Data Transfer, relying on one or more of: performance of your subscription contract (PDPA Section 129(3)(b)); your consent, given by accepting this Privacy Policy (PDPA Section 129(3)(a)); or substantially similar law or adequate protection where destinations such as Singapore (under its PDPA 2012) and Japan (under its APPI) provide protection assessed by us as at least equivalent to the Malaysian PDPA (PDPA Section 129(2)). We conduct Transfer Impact Assessments as required by law before onboarding new sub-processors handling personal data.

We retain your personal data for as long as your Account is active. After your subscription ends, your Account becomes read-only and we keep your Content so you can read it, export it and, if you resubscribe, continue it, unless you ask us to delete it. Upon written request to security@thesisit.app, we delete your Account and Content within 30 days, subject to legal retention obligations (for example, billing records for tax purposes, retained for 7 years under Malaysian tax law). Deleted data may persist in encrypted backups for up to 30 days after deletion, after which it is permanently removed. A draft an AI step produced that you rejected is kept for 30 days so you can recover it, then removed. A results page you paste to find the gaps in your field is removed 30 days after you paste it. A submission you record is kept as you recorded it and cannot be changed. It is removed only with its thesis or your Account.

If you started the free trial, the keyed hash of your email address and the codes from your account name and thesis titles are kept with the trial record after your Account and Content are deleted. They let us keep to one trial for each address and notice a repeated trial under another address. When a new trial's codes match an earlier trial's, we email our developer the two trial records' identifiers and what matched, never your thesis content. A match alone changes nothing on either account.

Under the PDPA and, where applicable, the GDPR, you have the right of access (to obtain confirmation of whether we process your personal data and receive a copy); the right of correction (to correct inaccurate or incomplete personal data); the right to withdraw consent; the right to data portability (to receive your personal data in a structured, machine-readable format and, where technically feasible, have it transmitted directly to another controller, per PDPA Section 43A; your thesis can be exported as a Word document or as Markdown at any time from inside the app); the right to erasure (to request deletion, subject to our legal retention obligations); and the right to object (to processing based on legitimate interest, in specific circumstances). To exercise any of these rights, email security@thesisit.app. We will respond within 21 days as required by the PDPA. If you believe our processing of your personal data violates the PDPA, you may file a complaint with the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, JPDP) at pdp.gov.my.

In the event of a personal data breach that is likely to cause significant harm to you, we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours where feasible, as required by Section 12B of the PDPA; notify you directly, without unnecessary delay; and provide guidance on protective steps you can take.

We use only strictly necessary cookies: a session cookie to keep you signed in, and a CSRF token cookie to protect against cross-site request forgery. We do not use marketing cookies, advertising trackers, cross-site tracking or third-party analytics. Your thesis is also kept in your browser's own storage so you can keep working when the connection drops; that copy stays on your device and syncs to your account when you are back online.

The Service is intended for users aged 18 and older. We do not knowingly collect personal data from children under 18. If you believe we have collected data from a child, contact security@thesisit.app and we will delete it.

We implement technical and organisational measures to protect your personal data, including encryption in transit (TLS); encryption at rest for the platform AI credential (AES-256-GCM); access rules that let only you, and the people you invite, read your thesis; audit logging of account and billing actions; regular security reviews and updates; and sub-processor security assessments.

We may update this Policy from time to time. We will notify you of material changes by email at least 14 days before the changes take effect.

Data Controller: Workcyte Digital Academy (SSM Registration No. 202603071928), Malaysia. Privacy and data protection matters: security@thesisit.app. General support: support@thesisit.app.