Privacy Policy

Effective date: 13 August 2026

1. Information processed

• Service telemetry: request time, route, method, status, user-agent classification, agent or MCP client name when supplied, tool name, safe product-category and market summaries, language, referrer/origin when supplied, and coarse hosting-provider location headers when available.
• Security identifiers: raw IP addresses are not stored in public telemetry. A short salted hash may be stored to identify repeat use without retaining the address.
• Product cases: product descriptions, interpreted product facts, target markets, workflow state, evidence-checklist status and opaque case identifiers.
• Human review: an email address and consent record, review messages, evidence metadata and files that the seller deliberately submits through a private review link.
• Regulatory alerts: the consenting email, minimized product/market profile, relevant requirement identifiers, Stripe subscription identifiers and delivery history.

2. How information is used

Information is used to answer market-access readiness requests, preserve a case between calls, protect the service from abuse, measure reliability and discovery channels, arrange requested human review, send requested service emails, administer subscriptions, investigate errors and improve source-linked coverage.

3. Evidence files and AI-assisted triage

The public website does not retain raw files used for an initial conversational check. Files deliberately submitted through a private final-review link are stored privately for the requested review. Supported files may receive server-side text extraction and private machine-assisted triage. Image OCR is used only when the operator has explicitly enabled it. Automated notes do not authenticate documents or replace reviewer judgement.

Do not submit identity documents, passwords, payment-card data or unrelated personal information. Do not place confidential evidence in a public GitHub issue.

4. Service providers

ComplianceCN uses service providers for hosting, private database/storage, transactional email, payment administration and optional private machine-assisted document triage. These providers process data only for the relevant service function and under their own security and data-processing terms. Stripe receives payment information directly; ComplianceCN does not receive complete payment-card details.

5. Retention

• Telemetry is retained for up to 12 months.
• Optional private conversation logs are retained for up to 90 days and exclude raw file bytes and extracted document contents.
• Case, contact, uploaded-evidence and subscription records are retained only as long as reasonably needed for the requested service, corrections, security, disputes, and legal or accounting obligations.

6. Choices and requests

Email and alert consent is not inferred. A person can decline human review, avoid uploading files, unsubscribe from alerts, cancel a subscription through its signed management link, or request access, correction or deletion where applicable. Use the support page for a privacy request; do not include private documents in the initial message.

7. International processing and security

Cloud providers may process information in countries other than the user’s own. ComplianceCN uses private server-side credentials, access-controlled storage, signed case links, minimized telemetry and purpose-limited disclosure. No internet service can guarantee absolute security.

8. Changes

Material changes will be dated on this page. Continued use after a change is subject to the updated policy, but new uses of consent-based information require an appropriate consent or other lawful basis.