Privacy Policy
Last Updated: December 22, 2025 · Effective: December 22, 2025
1. Introduction
ComplySphere ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our ComplySphere application (the "App"). By using the App, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Information You Provide Directly
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Incident Descriptions | Document workplace incidents | Legitimate interest / Contract |
| Employment Information | Jurisdiction-appropriate guidance | Legitimate interest / Contract |
| Protected Characteristics | Identify discrimination issues | Explicit consent |
| Contract/Job Documents | Compliance analysis | Legitimate interest / Contract |
| Profile Information | Personalise experience | Contract |
2.2 Information Collected Automatically
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Device Identifier | Link credits, prevent fraud | Legitimate interest |
| App Version | Support and compatibility | Legitimate interest |
| Usage Analytics | Improve functionality | Consent |
| Crash Reports | Fix bugs and stability | Legitimate interest |
2.3 Information We Do NOT Collect
- We do NOT collect your real name (unless provided in incidents)
- We do NOT collect location data
- We do NOT collect contacts or call logs
- We do NOT sell your data to third parties
3. How We Use Your Information
- Provide Core Services: Analyse incidents, match laws, generate reports
- Process Payments: Manage credits and subscriptions via Stripe
- Improve the App: Analyse usage patterns to enhance features
- Provide Support: Respond to inquiries and technical issues
- Ensure Security: Detect fraud and prevent unauthorised access
- Legal Compliance: Comply with applicable laws and regulations
4. Data Storage and Security
Most data is stored locally on your device in an SQLite database with optional SQLCipher encryption. If you enable cloud sync, limited data is stored in Microsoft Azure (Cosmos DB with encryption at rest).
Third-Party Services
| Service | Purpose | Data Shared |
|---|---|---|
| Microsoft Azure | Cloud backend | Device ID, usage events |
| Anthropic Claude | AI analysis | Incident text (anonymised) |
| Azure Translator | Translation | Document text |
| Stripe | Payments | Transaction IDs only |
5. Data Retention
| Data Type | Retention |
|---|---|
| Local incident data | Until you delete it |
| Cloud account | Until account deletion request |
| Usage analytics | 90 days (auto-deleted) |
| Crash reports | 30 days (anonymised) |
| Credit transactions | 2 years (financial compliance) |
6. Your Rights (GDPR/CCPA)
- Right to Access (Article 15 GDPR) — Export your data via Settings → Privacy → Export My Data
- Right to Rectification (Article 16) — Edit your data directly in the App
- Right to Erasure (Article 17) — Delete all data via Settings → Privacy → Delete All My Data
- Right to Data Portability (Article 20) — Export in JSON format
- Right to Object (Article 21) — Disable analytics in Settings → Privacy
- Right to Withdraw Consent — Manage in Settings at any time
California residents (CCPA): We do NOT sell personal information. You have the right to know, access, delete, and opt out.
7. International Data Transfers
Data may be processed in the United States (Anthropic AI) and European Union (Azure West Europe). We use Standard Contractual Clauses and Data Processing Agreements with all vendors.
8. Children's Privacy
ComplySphere is not intended for children under 16. We do not knowingly collect information from children.
9. Changes to This Policy
We may update this policy. Changes are communicated via the "Last Updated" date, in-app notifications for material changes, and 30-day notice when feasible.
10. Contact Us
Privacy inquiries: privacy@complysphereapp.com
Data Protection Officer: dpo@complysphereapp.com