ComplyLayer privacy & data

For website visitor data and your account data, ComplyLayer is the data controller

When you register, we collect your name, work email address and company name.

browser type, operating system, and IP address

pages visited, features used, session duration

Your card details are collected and stored by Stripe, never by us

you enter information about your AI systems, including system names, descriptions, risk classifications, and associated documentation

If you contact us by email, we retain records of that correspondence

Provide, operate, and maintain the ComplyLayer platform

Process your subscription and manage billing

Detect, prevent, and investigate security incidents and fraud

Analyse aggregate usage patterns to improve product features

We retain your account and AI system data for as long as your account is active.

Billing records are retained for 7 years to comply with applicable tax, accounting, and financial reporting obligations.

we delete it without undue delay (and in any event within 30 days of the request)

Anonymised usage analytics are retained indefinitely.

All data is stored in AWS EU (Frankfurt, Germany — eu-central-1) data centres.

we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) together with additional safeguards.

A Data Processing Agreement (DPA) covering this processing, including our subprocessor list, is available on request

A Data Processing Agreement (DPA) covering this processing, including our subprocessor list, is available on request

When you delete your account, or ask us in writing to delete your organisation's data, we delete it without undue delay

Access: Request a copy of the personal data we hold about you

Rectification: Request correction of inaccurate or incomplete data

Erasure: Request deletion of your personal data

Portability: Receive your data in a structured, machine-readable format

Restriction: Request that we restrict processing of your data in certain circumstances

Objection: Object to processing based on legitimate interests

We do not sell your personal data.