← ComplianceCN

1. Operator identity / 运营方身份

ComplianceCN is currently edited and operated by Liam Thomas, London, United Kingdom, as the operator of the ComplianceCN beta service. The operating jurisdiction is England and Wales unless a later incorporated entity and terms page say otherwise.

ComplianceCN 当前由 Liam Thomas（英国伦敦）编辑运营。除非后续公司实体与正式条款另有说明，运营司法辖区按英格兰和威尔士处理。

• Production contact to configure on the custom domain: trust [at] compliancecn [dot] com
• Public correction channel: GitHub issues

2. What the service does / 服务范围

The service should output “missing evidence”, “ready for review by our team”, “evidence package appears complete for review”, or “needs specialist review” — not “compliant”.

3. Verification statuses / 核验状态

Every record, decision rule and timeline milestone carries a review_status. Agents and humans should read it before relying on an answer.

Status	Meaning	How to use it
source_checked	Reviewed against the cited primary source, with a dated review note.	Can be used for market-access readiness screening, still not legal advice or product approval.
partially_checked	Some claims or sources were checked; the review note says what remains uncertain.	Disclose the uncertainty and route important decisions to review by our team.
unverified_demo	Model-drafted or editorially incomplete material that has not yet been reviewed against primary sources.	Do not rely on it as verified. Treat it as a prompt for source review.

Current publication status: all 16 category-market modules, including their current conditional rules, are source_checked. Evidence-check counts vary by category and market because the applicable obligations differ. The live coverage_matrix publishes the evidence-check, conditional-rule, claim and source counts for every module.

4. Review cadence and source changes / 复核频率与来源变更

• Official-source URL availability is checked by scheduled automation.
• Substantive legal or policy changes are not auto-published by the monitor; they require editorial review before the affected record/rule is updated.
• When a material source change is confirmed, the affected record/rule should receive an updated review note/date and an entry in the public changelog.
• OpenAPI/MCP schema deprecations should keep the previous schema available for at least 60 days where practical.

5. What automation can and cannot decide / 自动化边界

Can help with

• Summarising declared product facts and checklist status.
• Prioritising missing evidence and red flags from available case data, upload categories, seller-supplied document metadata, automatic extracted text from supported file types, opt-in image vision OCR where enabled, and optional OCR/key-text snippets.
• Drafting supplier questions and cautious report wording.
• Flagging when a point should move to review by our team.

Cannot decide

• Whether an original document is authentic.
• Whether a certificate or test report truly covers the exact SKU, model, factory, batch, accessories or supplied charger. Filename, metadata, automatic extraction, vision OCR and OCR snippets are treated as clues, not authenticated evidence.
• Final legal interpretation, certification, lab/notified-body decisions, customs/marketplace acceptance, or final report sign-off.
• Whether a product is “compliant”.

6. When review by our team is required / 何时必须由我们的团队复核

• Product facts are missing, contradictory or materially change the regulatory route.
• Evidence is missing, rejected, only requested, or the seller’s evidence inventory is incomplete.
• The trust envelope is not fully verified for the answer being used.
• Uploaded documents need authenticity, exact-SKU coverage, lab accreditation, signature, date, model-number or scope review.
• The case needs legal/professional judgement, marketplace submission strategy, customs risk assessment or final sign-off.

7. Privacy, document handling and security / 隐私、文件与安全

• Public telemetry stores request classification data such as path, user-agent class, referrer/origin if sent, language header, coarse hosting-provider geo headers if available, MCP client/tool names when sent, safe MCP argument summaries such as category/markets, result status, and paid key prefix when used. Raw IP addresses are not stored; if available, a short salted IP hash may be stored only to understand whether the same client returned.
• The public conversational check processes attached files temporarily and does not retain the raw files. When private conversation logging is enabled, conversation messages, interpreted product facts, result status and upload metadata (filename, type and size) may be retained privately for up to 90 days for debugging and service improvement. Raw file bytes and extracted document contents are excluded from those logs.
• A product-change alert subscription stores the consenting email address, a minimized product/category/market profile, relevant check identifiers, Stripe customer/subscription identifiers and delivery history. It does not copy uploaded supplier documents or extracted document text into the watch. Alert consent is used for matching product-change emails and subscription administration, not as consent to unrelated marketing. A seller can disable emails and schedule cancellation from the signed management link, or manage billing in Stripe's customer portal.
• Uploaded supplier documents sent through a final-review private upload link are different: they are handled through private server-side storage for the requested review. Supported text/data, DOCX, XLSX and selectable-text PDF files receive a private automatic text preview for reviewer triage. If the owner explicitly enables image vision OCR, uploaded image files may be sent to the configured LLM/OCR provider for a private OCR preview; otherwise images remain manual-review items. Uploaders can add document category, model/SKU, issuer/lab, date, language, claim summary and optional OCR/key text to help triage. We do not store uploaded document contents or extracted previews in public logs, public datasets, telemetry rows, GitHub, Hugging Face or ModelScope snapshots.
• Do not paste certificates, test reports, identity documents, addresses or unredacted supplier files into agent chat or the public handoff endpoint. Use the private upload link.
• Admin access is protected by an owner-controlled bearer token; Supabase service-role credentials are used only server-side.
• Telemetry rows are retained for up to 12 months. During beta, lead/contact records and uploaded evidence are retained only as long as needed for the case, dispute handling, corrections or legal/accounting needs, and can be deleted on reasonable request unless retention is legally required.

8. Corrections process / 纠错流程

Report errors with the record ID, claim ID, rule ID or case reference where possible. Confirmed data errors are corrected in the source dataset, re-dated in the review note where applicable, and logged in the changelog. The target is to acknowledge correction requests within 5 working days.

请尽量附上记录ID、声明ID、规则ID或案件编号。确认后的数据错误会在源数据中更正，并在适用时更新复核说明与changelog。目标5个工作日内确认收到纠错请求。

9. Data licence / 数据许可

During beta, the public API, OpenAPI contract, Coze import and MCP discovery surface can be queried, cited and evaluated by humans and AI agents with attribution to ComplianceCN and the underlying primary sources. MCP describe_coverage remains open. MCP product assessment is free and unlimited; the first human-reviewed pack is free per confirmed seller email.

10. Liability limits / 责任边界

ComplianceCN is a beta market-access readiness service. It is not a law firm, notified body, certification body, testing laboratory, customs authority, insurer, marketplace or authorised representative. Outputs are provided for preparation and triage, without warranty, and must be checked against the cited primary sources and qualified professional advice before commercial decisions are made.

ComplianceCN 是测试版证据准备度服务，不是律师事务所、公告机构、认证机构、测试实验室、海关、保险机构、平台或授权代表。输出仅用于准备与分流，不作担保；商业决策前必须核对官方来源并寻求合格专业意见。

Product-change alerts are sent only for reviewed changes that ComplianceCN has published and marked as relevant to the saved product profile. They are not exhaustive legal monitoring, and absence of an alert does not mean that no relevant law, standard, enforcement practice or marketplace policy has changed.