Privacy Policy

1.1 Information you provide

• Name, email, organisation, and account details
• Uploaded documents, messages, and compliance materials
• Billing and payment information
• Support requests or communication logs

1.2 Automatically collected data

• Device information, browser type, session logs
• Usage analytics, IP address, authentication events

1.3 Cookies

We use cookies for functionality, security, analytics, and session management.

We process your data to:

• Deliver the Service and generate AI-based analysis
• Improve accuracy, reliability, and performance
• Personalise your user experience
• Provide customer support
• Ensure platform security and fraud prevention
• Manage billing and account administration
• Comply with legal obligations

We do not sell personal data.

We process data under the following lawful bases:

• Contractual necessity — to provide the Service
• Legitimate interest — security, platform improvement, fraud prevention
• Consent — marketing communications
• Legal compliance — financial or regulatory obligations

Comply AI uses bank-grade technical and organisational measures, including:

• AES-256 encryption at rest, TLS 1.3 encryption in transit
• Zero-trust architecture, network isolation
• Role-based access control (RBAC)
• Logging and audit trails, regular penetration testing
• Secure cloud infrastructure, GDPR-compliant hosting regions

Financial institutions may request an enhanced security overview or due-diligence pack.

We retain data for the duration of your use of the Service unless:

• You request deletion
• Retention is required by law
• Aggregated anonymised data is retained for model improvement

Uploaded content may be automatically deleted after a defined period for compliance best practice (configurable).

We may share data with:

• Cloud hosting providers (GDPR-compliant)
• Payment processors, security partners
• Approved subprocessors (listed on our website)

We will never sell, rent, or share your data for advertising. We do not share user documents with any foundation model provider for training purposes.

Data may be stored in the UK or EU. If transferred outside these regions, we use Standard Contractual Clauses (SCCs), adequacy decisions, and additional encryption safeguards.

Under GDPR, you have the right to access your data, rectify inaccurate data, request deletion, restrict processing, port your data, object to processing, and withdraw consent.

Requests can be sent to privacy@complyai.co.

Comply AI is not intended for individuals under 18. We do not knowingly collect data from minors.

We may update this Policy periodically. Continued use of the Service constitutes acceptance of the updated terms.

For privacy questions or concerns: