Draft: pending solicitor review
Legal
Privacy policy
How we handle personal data on this website and in the Complian adviser service.
Who we are
Complian is a product of TLG Systems Ltd, a company registered in England and Wales(Company No. 17181330), registered office 12 Elms Road, Wokingham, England, RG40 2AA. We are registered with the Information Commissioner's Office under registration number ZC207113. Contact us at hello@complianai.com.
Our two roles
We are the controller for personal data about visitors to this website, people who contact us, and the advisers who hold Complian accounts.
We are a processorfor the documents and client information that an adviser uploads to Complian. The adviser (the HR consultancy or law firm) is the controller of that data and decides why it is processed. We process it only on the adviser's documented instructions, under a data processing agreement with the adviser. If you are an employee of an adviser's client and want to exercise your rights over a document that mentions you, please contact the adviser or your employer; we will help them respond.
What we process
- Adviser accounts: name, work email address, firm name, sign-in records, and the reviewer name and time recorded against each review decision.
- Client workspaces: the client organisation's name, sector, headcount, the nations where it employs people, and the answers to the applicability questions.
- Uploaded documents: staff handbooks, contracts, payslip templates, leave records and similar documents, and the text we extract from them. These may contain personal data about the client's employees, for example names, pay or leave details.
- Reports: findings, quoted excerpts from the documents, the adviser's review decisions and notes, and exported Word reports.
- Website and email: we do not run analytics or advertising trackers on this website. Our host, Vercel, processes requests to serve it. If you email us, we keep your message and contact details.
- Prospects: if we contact you about Complian, we hold your name, role, firm and business contact details, taken from your firm's public website or professional profiles.
Please do not upload special category data (for example health records) unless it is necessary for the review and you have a lawful basis to share it with us.
How the AI analysis works
To draft each finding, Complian sends Anthropic's API the text of the legislation being assessed and short excerpts from the adviser's uploaded documents that relate to it. Anthropic processes this under its commercial terms and data processing addendum: Anthropic commercial terms and data processing addendum. Anthropic's current terms govern how long it retains API data and whether it is used for training; please read them there rather than relying on a summary from us.
We use OpenAI only to index publicly available legislation text. We do not send customer documents or any personal data to OpenAI.
Every draft finding is reviewed by the adviser before any report can be exported. Complian does not make decisions about individuals.
Sub-processors
| Provider | Purpose | Data | Terms |
|---|---|---|---|
| Anthropic | Analyses excerpts of the documents an adviser uploads, to draft each finding | Excerpts of uploaded client documents, the legislation text being assessed | Terms |
| Supabase | Database, user accounts and file storage for the adviser service | Adviser account details, client workspace data, uploaded documents and extracted text, reports, review decisions | Terms |
| Railway | Hosts the Complian application server | All data the application processes, in transit and in memory | Terms |
| Vercel | Hosts this website and the adviser interface | Website requests | Terms |
| Google Workspace | Email for complianai.com, including hello@complianai.com | Emails you send us and our replies, and prospect contact details | Terms |
The regions where the application database, files and server are hosted will be confirmed and listed here before the pilot service opens. Some providers are based outside the UK. Where personal data is transferred outside the UK, we rely on a transfer mechanism recognised under UK data protection law.
We will update this list before adding or replacing a sub-processor, and notify adviser customers as our data processing agreement requires.
Our lawful bases
For adviser accounts we rely on performing our contract with the adviser's firm and on our legitimate interest in running and securing the service. For correspondence and contacting prospects we rely on our legitimate interests.
How long we keep data
Draft, subject to solicitor review.
| Data | Retention |
|---|---|
| Adviser account data | While the account is active; deleted within 30 days of closure |
| Uploaded client documents and their extracted text | Deleted on request, or within 90 days of the engagement ending |
| Generated reports and exported Word reports | While the account is active; deleted on request |
| Review and audit history | While the account is active; then exported to the adviser and deleted within 90 days of closure |
| Backups | Rolling 30 days |
| Server logs | 30 days, with document text redacted |
| Prospect contact details | 12 months from our last contact |
Advisers can delete a document or a whole client at any time. What deletion removes today is set out on our trust page.
Your rights
Under UK data protection law you can ask for access to your personal data, and ask us to correct, erase or restrict it, to object to our processing, or to provide it in a portable form. Some rights apply only in certain circumstances. Contact hello@complianai.com. Where we act as a processor, we will pass your request to the adviser who controls the data.
You can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.
Security
The controls we have built and tested, and the limits of what we claim, are described on our trust page.
Changes
We will post any change to this policy here and update the version and date above.