Privacy Policy
Last updated: February 2026
1. Introduction
ComplyPilot ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our compliance management platform. We are based in the European Union and comply with the General Data Protection Regulation (GDPR).
2. Data Controller
ComplyPilot is the data controller responsible for your personal data. For any data protection inquiries, please contact us at info@comply-pilot.com.
3. Information We Collect
We collect the following types of information:
- Account Information: Name, email address, company name, and password when you register.
- Usage Data: Information about how you interact with our platform, including pages visited, features used, and timestamps.
- Compliance Data: Data you input into the platform such as risk assessments, controls, policies, and evidence items.
- Payment Information: Billing details processed securely through our payment provider (Stripe). We do not store credit card numbers.
- Technical Data: IP address, browser type, device information, and cookies (see our Cookie Policy).
4. Legal Basis for Processing
We process your personal data on the following legal bases:
- Contract Performance: Processing necessary to provide our services.
- Legitimate Interest: Improving our platform, security, and customer support.
- Consent: For marketing communications and non-essential cookies.
- Legal Obligation: Compliance with applicable laws and regulations.
5. How We Use Your Information
- Provide and maintain our compliance management platform
- Process transactions and manage your subscription
- Send administrative communications (account updates, security alerts)
- Improve and optimize our services
- Respond to support requests
- Comply with legal obligations
6. Data Sharing and Transfers
We do not sell your personal data. We may share data with:
- Service Providers: Cloud hosting, payment processing, and email delivery services that process data on our behalf under strict contractual obligations.
- Legal Requirements: When required by law, regulation, or legal process.
All data is primarily stored and processed within the European Union. Where transfers outside the EU occur, we ensure adequate safeguards are in place (e.g., Standard Contractual Clauses).
7. Data Retention
We retain your personal data for as long as your account is active or as needed to provide our services. Upon account deletion, we will delete or anonymize your data within 30 days, unless we are required to retain it for legal or regulatory purposes.
8. Your Rights
Under GDPR, you have the following rights:
- Access: Request a copy of your personal data.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Request deletion of your personal data ("right to be forgotten").
- Restriction: Restrict processing of your data in certain circumstances.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interest.
- Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, contact us at info@comply-pilot.com.
9. Security
We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS) and at rest, access controls, and regular security assessments.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date.
11. Contact & Supervisory Authority
For privacy-related questions, contact info@comply-pilot.com.
You also have the right to lodge a complaint with your local data protection supervisory authority.