Privacy Policy

CompliAgency is operated by COMPLIAGENCY LLP, Hyderabad, Telangana, India (full address in our Terms of Service). Contact us at hello@compliagency.com.

We are the controller (data fiduciary) for personal data about our own customers and website visitors: agency account holders, their billing details, and people who browse compliagency.com.

We are a processor (service provider) for personal data that agencies put into the Service or collect through it, such as their clients’ contact details, privacy requests submitted by their clients’ customers, and cookie-consent records from their clients’ websites. For that data we act only on the agency’s instructions under our Data Processing Addendum. If you submitted a privacy request or consent choice on a business’s website, that business (and its agency) decides how your data is used. Please contact them first; we will pass on any request we receive.

• Account data: your name, email address, password (stored hashed by our authentication provider) or Google sign-in identity, and agency profile details such as agency name, address, logo, and role.
• Customer Content: the client, vendor, and compliance information agencies enter to run the Service and generate documents, including client contact names and emails.
• Data from clients’ websites: names, email addresses, and messages submitted through privacy-center request forms; cookie-consent choices with a timestamp and browser user-agent string.
• Billing data: handled by Paddle, our Merchant of Record. We receive limited details (such as plan, subscription status, and country) but never full card numbers.
• Usage and device data: log data, IP address, browser type, and actions taken in the app, used to operate and secure the Service.

• to provide, maintain, secure, and improve the Service;
• to process subscriptions and billing through Paddle;
• to generate the documents, reports, and outputs you request;
• to send service, security, and account emails, and notification emails you can turn off in Settings (such as new privacy requests, weekly digests, and regulatory alerts);
• to detect, prevent, and address fraud, abuse, or technical issues; and
• to comply with legal obligations and enforce our Terms.

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We do not use Customer Content to train AI models.

Where the GDPR or UK GDPR applies to data we control, we rely on performance of a contract (to provide the Service), legitimate interests (to secure, support, and improve the Service), consent (where required), and legal obligation.

We use these providers to run the Service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Paddle — payments, tax, and invoicing (Merchant of Record).
• Resend — sending notification and account emails.
• OpenAI — classifying regulatory news and drafting client update messages. Drafts send the client’s business name and mapped vendor names; we do not send contact details or privacy-request data.
• Google — optional “Sign in with Google”.

These providers process data on our behalf under written agreements and appropriate safeguards. We will update this list before adding a new provider that processes Customer Content.

Our website and app use essential cookies needed for sign-in, security, and checkout. We do not currently use analytics or advertising cookies on compliagency.com. If that changes, we will ask for consent where required and update this policy.

The cookie banner we provide for agencies’ clients stores the visitor’s choice in their browser and sends it to us so the agency has a record of consent.

• Account data and Customer Content: for as long as the account is open.
• When an account is closed, we wait 14 days so the closure can be reversed, then delete Customer Content. Copies in backups expire on their normal backup schedule.
• Billing records: kept by Paddle and by us for as long as tax and accounting laws require.
• Security and server logs: kept for a short period, then deleted or anonymized.

Agencies decide how long to keep privacy requests and consent records for their clients and can delete them, or the client, at any time.

We are based in India, and our providers may process data in the United States, the European Union, and other countries. Where required, we and our providers rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK Addendum, for international transfers.

Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA, or India’s Digital Personal Data Protection Act), you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, to withdraw consent, and to appoint a nominee. We will not discriminate against you for using these rights.

To use them, email hello@compliagency.com. We may need to verify your identity. If your data was submitted to a business that uses CompliAgency, we will forward your request to that business. You may also complain to your local data protection authority.

For complaints about how we handle personal data, contact our Grievance Officer at hello@compliagency.com with the subject line “Grievance”. We aim to respond within 30 days.

We use industry-standard measures, including encryption in transit, access controls, and provider-managed encryption at rest, to protect personal data. No system is completely secure. If a breach affects personal data we hold, we will notify affected customers and authorities as the law requires, and agencies as set out in our Data Processing Addendum.

The Service is intended for businesses and is not directed to children under 18.

We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, for material changes, notify account holders by email or in the app.