Privacy Policy

We collect the following categories of personal data:

• Account data: your name, work email address, company name, and authentication details, collected when you sign up.
• Support ticket data: your name, email, and the content of any support ticket you raise, including replies.
• AI-assisted intake data: if you use "Upload documentation instead" during AI-system intake, the document you provide is sent to our AI provider, Anthropic, to pre-fill the intake questionnaire. For a PDF this is the file itself (including any images in it); for a Word or text file, or pasted text, it is the text. We do not store the document ourselves — it is processed in memory and discarded. We keep only a dated record that a read took place, tied to your organisation, so we can apply the usage limit described in our Terms of Service — see Section 4.
• Billing data: if you buy a One-Off Review, your billing details (name, email, card details) are collected and held by our payment processor, Stripe. We do not store full card numbers ourselves.
• AI-inventory and compliance data: the AI systems you inventory, the questionnaire answers you provide, generated disclosure wording, and your compliance register entries are stored on our servers, tied to your organisation, and accessible only to members of your team and, where needed for support or account administration, ComplyMark staff.
• IP address logs: we log your IP address against certain requests (for example, submitting a support ticket or starting checkout) purely to prevent abuse. These logs are short-lived and are automatically deleted on a rolling basis; we do not keep them for longer than we need to prevent abuse.

Under UK GDPR (and, for customers in the EEA, EU GDPR — see Section 8), we rely on the following legal bases to process your personal data:

• Performance of a contract — to provide the Service, including account access, the admin console (for our own staff), billing, and support.
• Legitimate interests — to maintain and secure the Service, monitor for abuse, and respond to support requests, provided this does not override your rights and interests.
• Legal obligation — where we must retain or disclose data to comply with the law, including our own accounting obligations.

We do not currently send marketing communications; if that changes, we will rely on your consent and give you a clear way to opt out.

If you use the Service to track AI systems belonging to your own clients, or if any information you provide about colleagues, employees, or clients in the course of using the Service constitutes their personal data, you are the data controller for that data and we act as your data processor. This data — including AI-system inventories, classification answers, generated disclosures, and register entries — is stored on our servers as described in Section 1. Our Data Processing Addendum sets out this processor arrangement in detail.

The "Upload documentation instead" feature sends the document you provide (for a PDF, the file itself; otherwise its text) to Anthropic, our AI provider, to extract answers to the intake questionnaire. This data is processed only to generate the output you requested and is subject to Anthropic's own data-handling terms, which restrict their use of your data to providing that processing to us. We do not use this data to train any AI model. The classification of your AI system's regulatory role and obligations (provider/deployer/etc., and which Article 50 obligations apply) is generated by our own rule-based logic from your questionnaire answers — it is not AI-generated, and does not depend on the AI intake feature at all if you fill in the questionnaire manually.

Payments for the One-Off Review are handled by Stripe, Inc., which acts as an independent data controller for payment data it processes. Please refer to Stripe's own privacy policy for details of how it handles your payment information.

We only use cookies that are strictly necessary for authentication (your sign-in session, via Supabase Auth). We do not currently use analytics, performance-monitoring, or advertising cookies, and we do not track you across other websites. If that changes, we will update this section and our Cookie Policy and seek your consent first where required by law (in the UK, under PECR; in the EEA, under the ePrivacy rules).

Where personal data is transferred outside the UK — for example, to service providers located in the United States (see Section 11) — we rely on appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Addendum, an adequacy decision, or reliance on the EU-US Data Privacy Framework where the recipient is self-certified under it, to ensure your data continues to receive an appropriate level of protection. The same applies to data we receive from customers located in the EEA or elsewhere.

Where you are located in the EEA, EU GDPR applies to our processing of your personal data in addition to UK GDPR, and you have the same set of rights described in Section 12 under EU GDPR. In accordance with Article 27 of the UK and EU GDPR, we have appointed Euverify Ltd as our GDPR representative in both the United Kingdom and the European Union. If you are a data subject or a supervisory authority and wish to contact our representative directly regarding matters covered by the GDPR, you can reach them at:

• UK Representative — Euverify Ltd, 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.
• EU Representative — Euverify Ltd, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland.
• Email: gdpr@euverify.com
• Verification: https://gdpr.euverify.com/verify/b513809d-d660-4f36-bba7-4a7afd3e8e50

You may also use the contact details in Section 18 for any EU or UK GDPR request, and we will handle it directly.

Depending on your state of residence, you may have rights under US state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and similar laws in other states. In plain terms:

• We do not sell or share your personal information for cross-context behavioural advertising, and we have not done so in the preceding 12 months.
• You have the right to know, access, correct, and delete your personal information, and not to be discriminated against for exercising these rights — see Section 12.
• If your browser sends a Global Privacy Control (GPC) signal, we treat that as a valid opt-out request, though as above we have no sale or sharing to opt out of.
• Under California's "Shine the Light" law, you may ask once a year whether we've disclosed personal information to third parties for their own direct marketing — we have not.

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) gives you broadly similar rights to access, correct, and request deletion of your personal information, and to complain to the Office of the Privacy Commissioner of Canada — the self-service tools and contact details in Section 12 cover these too.

If you are located somewhere not specifically addressed above, we still process your personal data in line with the principles in this policy — lawful basis for processing, data minimisation, security, and your ability to access, correct, or delete your data — and nothing in this policy limits any rights you have that cannot be waived under the law of your own country.

We use the following sub-processors to provide the Service. We do not sell your data to any of them.

• Supabase — database hosting and authentication.
• Stripe — payment processing (see Section 5).
• Anthropic — AI-assisted document intake (see Section 4).
• Resend — transactional email delivery (account and support-ticket emails).
• Vercel — application hosting.
• Euverify Ltd — our EU/UK GDPR Article 27 representative (see Section 8); receives GDPR enquiries forwarded to us but does not otherwise process your personal data.

You have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request erasure of your data, subject to the process and limited legal-retention exceptions in Section 13;
• Request that we restrict or object to certain processing;
• Receive your data in a portable format;
• If you are in the US, confirm that we do not sell or share your personal information (see Section 9);
• Complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in the EEA, your local data protection authority.

The fastest way to exercise access and export rights, and to delete your account, is the Account page inside the dashboard once signed in, which lets you download a copy of your account and support-ticket data and delete your account immediately — Section 13 explains exactly what deleting your account does and does not remove. For correction, restriction, or objection requests, for erasure of data that account deletion does not remove, or anything else, contact us at privacy@complymark.io — we aim to respond within one month, extendable by a further two months for complex requests, as GDPR permits.

We retain personal data for as long as your account is active. When you delete your account from the Account page:

• Your sign-in is deleted immediately, and you will not be able to sign in again.
• Your name and email address are replaced with a placeholder straight away. The underlying user record is kept, marked as removed, because the compliance register entries you created refer to it; it no longer identifies you.
• Support tickets tied to your email are anonymised (your name and email are replaced with a placeholder) rather than deleted, so we can keep a record of past support issues without keeping your personal details attached to them. Because these records no longer identify you once anonymised, we retain them indefinitely as evidence of past support and compliance work.
• Your organisation's AI-inventory, classification, disclosure, and register data is not deleted when an individual user deletes their account. It belongs to the organisation and is kept as compliance evidence. If you were the last active person on your organisation, we replace the organisation's name with a placeholder, but the client-business records, AI systems, and register entries themselves are kept. If you want that data erased as well, email us at privacy@complymark.io and we will handle the request as described in Section 12.
• Financial and accounting records are retained for six years, as required under the Companies Act 2006. Full billing history itself is retained by Stripe under its own practices, not on our servers.

We use technical and organisational measures appropriate to the risk, including encryption in transit and role-based access controls for our own staff, to protect your personal data. No system is completely secure, and we cannot guarantee absolute security.

As explained in Section 4, the classification of your AI system's regulatory role and obligations is generated by rule-based logic applied to your own questionnaire answers, not by an AI model, and not by profiling you as an individual — it classifies the AI system you describe, not you. It does not produce a legal or similarly significant effect on its own: no automated decision restricts your account access, and you are always free to disregard or edit the generated classification and disclosure wording before you rely on or publish it.

The Service is a business compliance tool intended for use by adults in a professional capacity and is not directed at children. We do not knowingly collect personal data from children. Signup requires an explicit confirmation that you are at least 18 years old and, where you are signing up on behalf of a business, that you are authorised to bind it to our Terms of Service.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you before they take effect. The "Last updated" date at the top of this document shows when it was last revised.

For any questions about this Privacy Policy or how we handle your data, contact us at privacy@complymark.io or our registered office address above.