We collect as little personal data as we can. Product documents you upload are used only to run your analysis and are never used to train AI models.
1. Who is responsible
The controller for personal data processed through ComplianceTwin is ComplianceTwin. You can reach us at hello@example.com for any privacy question or request.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: name, company name, email address, password (stored hashed) | Creating and securing your account, signing you in, service emails | Art. 6(1)(b) — performance of the contract |
| Content you provide: uploaded documents, links, market and company answers, answers to follow-up questions, questions asked to the assistant | Running and storing your analyses, showing results and history | Art. 6(1)(b) — performance of the contract |
| Technical data: IP address, browser, timestamps, error and security logs | Operating the Service securely, preventing abuse, fixing faults | Art. 6(1)(f) — legitimate interest in a secure, working service |
| Correspondence you send us | Answering your requests | Art. 6(1)(b) or (f) |
Product documents usually contain little personal data. Please do not upload documents containing personal data that is not necessary for the analysis, and never special categories of personal data.
3. Document analysis and AI
To extract facts from your documents and to phrase explanations, we send the document content (or the relevant analysis data) to an AI model provider acting as our processor. The provider may not use this data to train its models. Whether a regulation applies is decided by our own rule engine, not by the AI model. No decision with legal or similarly significant effect on you as a person is made solely by automated means.
4. Service providers
We use carefully selected processors bound by data processing agreements under Art. 28 GDPR:
- Hosting and infrastructure provider — runs the application, database and file storage;
- OpenAI — document fact extraction and plain-language explanations;
- Email delivery provider — account and service emails.
The official regulation texts are retrieved from the EU Publications Office; no personal data is shared with it.
5. International transfers
Some providers, including OpenAI, may process data outside the European Economic Area. Where this happens we rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses together with supplementary measures.
6. How long we keep data
- Account data and analyses: for as long as your account exists. Deleting your account deletes them.
- Uploaded documents and extraction results: kept with the analysis so you can re-run it, and deleted with it or with your account.
- Technical logs: rotated regularly and kept only as long as needed to operate and secure the Service, or to investigate a security incident.
- Data we must keep by law (for example invoices): for the statutory retention period.
7. Cookies
We only use cookies that are strictly necessary to run the Service: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. We do not use advertising or analytics cookies, so no consent banner is needed.
8. Security
Data is transmitted over encrypted connections (TLS), passwords are stored as salted hashes, and every analysis is only accessible to the account that created it. Access to production systems is restricted to the people who operate the Service.
9. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16) and data erased (Art. 17);
- restrict processing (Art. 18) and receive your data in a portable format (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.
You can update your profile or delete your account at any time in Settings. For any other request, email hello@example.com. We answer within one month.
10. Changes
We will update this policy when our processing changes and show the date of the latest version at the top. Material changes will be announced by email or in the Service.