Privacy Policy

1. Introduction

CompliTraceAI Ltd ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our compliance management platform.

We are registered in England and Wales. Our registered office is in London, UK. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

Information you provide:

• Account registration details (name, email, company name, phone number)
• Compliance data and documentation you upload to the platform
• Customer complaint records and consumer outcome assessments
• Communication preferences and support inquiries
• Billing information (processed securely via Stripe — we never store payment card details)

Information collected automatically:

• Usage data (pages visited, features used, session duration)
• Device and browser information
• IP address and approximate location

3. How We Use Your Data

• To provide and maintain our compliance management platform
• To process AI analysis and generate compliance reports
• To communicate with you about your account, billing, and platform updates
• To improve our platform based on usage patterns
• To comply with legal and regulatory obligations
• To detect and prevent fraud or misuse of the platform

4. Data Storage & Security

All data is hosted exclusively in the United Kingdom on secure AWS infrastructure (eu-west-2, London region). We implement the following security measures:

• AES-256 encryption at rest for all stored data
• TLS 1.3 encryption in transit for all communications
• Regular security audits and penetration testing
• Access controls with role-based permissions
• Automated backup with point-in-time recovery

5. Data Retention

We retain your data for as long as your account is active or as needed to provide our services. Upon account cancellation, we retain your data for 6 months to allow for data export, after which it is securely deleted.

Compliance records may need to be retained longer where required by FCA regulations (typically 5-6 years). We will notify you before any data deletion.

6. Your Rights

Under UK GDPR, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data (subject to regulatory retention requirements)
• Right to restrict processing — limit how we use your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@complitraceai.com.

7. Data Sharing

We do not sell your personal data. We may share data with:

• Service providers — AWS (UK hosting), Stripe (payment processing), DeepSeek (AI analysis — only anonymous, complaint text at your direction)
• Regulatory bodies — where required by law or FCA regulation
• Professional advisors — legal and compliance advisors bound by confidentiality

8. Cookies

We use essential cookies for authentication and platform functionality. We also use analytics cookies to understand platform usage. You can control cookie preferences through your browser settings. Essential cookies cannot be disabled as they are necessary for platform operation.

9. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

Email: privacy@complitraceai.com
Address: London, United Kingdom
Data Protection Officer: privacy@complitraceai.com