Privacy Policy
Last updated: 11 June 2026
1. Who we are
ComplyMap is a software-as-a-service tool that helps businesses understand their obligations under European Union regulations. We are the data controller for personal data collected through this platform.
Contact: privacy@complymap.io
2. What data we collect
We collect only what is necessary to provide the service:
- Account data: email address, full name, company name, country of incorporation
- Compliance data: business structure, entity descriptions, role assignments, compliance status, notes, and task assignments you enter into the platform
- Evidence documents: files you upload to attach to regulatory articles
- Usage data: standard server logs (IP address, browser, pages visited) for security and performance
We do not sell, share, or rent your data to any third party.
3. How we use your data
- To provide and operate the ComplyMap service
- To generate AI-assisted compliance analysis using your business configuration
- To send transactional emails (account verification, password reset)
- To improve the service based on aggregated, anonymised usage patterns
4. AI processing
When you request an impact analysis, data about your business structure and role assignments is sent to Anthropic's API (Claude) to generate the analysis. This data is processed in accordance with Anthropic's data processing terms. We do not send personally identifiable information (names, emails) to the AI — only your organisational configuration.
5. Data storage and security
- All data is stored in EU data centres via Supabase (Frankfurt region)
- Evidence documents are stored in a private, encrypted storage bucket
- Row-level security ensures your data is isolated from other organisations at the database level
- All data in transit is encrypted via TLS
6. Data retention and deletion
We retain your data for as long as your account is active. When you close your account:
- All compliance data, notes, tasks, and role assignments are permanently deleted
- All evidence documents are deleted from storage
- Your user account and authentication record are deleted
You may request deletion at any time by contacting privacy@complymap.io. We will complete deletion within 30 days.
7. Your rights (GDPR)
Under GDPR, you have the right to: access your data, correct inaccurate data, request deletion, restrict processing, and data portability. To exercise any right, contact privacy@complymap.io.
8. Cookies
We use only essential session cookies required for authentication. We do not use advertising, tracking, or analytics cookies.
9. Changes to this policy
We may update this policy as the service evolves. We will notify you by email of material changes and update the date above. Continued use of the service constitutes acceptance.