Privacy Policy

1. Who we are

ComplyPost is a registered office mail automation platform operated from London, United Kingdom. If you have questions about this policy, contact us at [email protected].

2. What data we collect

• Account data: Name, email address, company name, and role when you create an account.
• Uploaded documents: PDF files you upload for processing, including the text extracted during processing.
• Client data: Client names, company numbers, email addresses, and other details you add to manage your clients.
• Usage data: Pages visited, features used, actions taken within the application (audit trail).
• Analytics data: Anonymous usage statistics collected via Google Analytics 4 with IP anonymisation enabled.
• Payment data: Billing information processed by Stripe. We do not store card numbers directly.

3. Why we collect it

• To provide and improve the ComplyPost service
• To process your uploaded documents and manage client correspondence
• To handle billing and subscription management
• To send transactional emails (delivery confirmations, account notifications)
• To understand how the product is used and improve it
• To comply with legal obligations

4. Legal basis for processing

• Contract performance: Processing your data is necessary to provide the service you signed up for.
• Legitimate interest: Usage analytics and product improvement, provided they do not override your rights.
• Consent: Marketing communications — you can unsubscribe at any time.
• Legal obligation: Retaining records where required by UK law.

5. How we store your data

Documents and account data are stored on servers hosted in London, UK. Documents are encrypted at rest using bank-grade (AES-256) encryption. Access is controlled per user, per role, per organisation. All connections are encrypted in transit. Document reading and analysis is performed via secure API calls to GDPR-compliant service providers within the EU/UK region — see Section 6 for details.

6. Who we share data with

We share data only with the following sub-processors, each of which has their own GDPR-compliant data processing agreements:

• Google Cloud APIs — Document reading and analysis. API calls processed in the EU/UK region. No data stored by Google.
• Stripe — Payment processing. PCI DSS Level 1 compliant.
• Resend — Transactional email delivery. EU data processing.

We do not sell, rent, or share your data with advertisers or third-party marketing companies.

7. Data retention

Document retention periods vary by plan:

• Free plan: 30 days from upload
• Pro plan: 5 years from upload
• Enterprise: 7 years or as agreed

Account data is retained while your account is active and for 30 days after cancellation, during which you can export your data. After 30 days, data is permanently and irreversibly deleted.

8. Your rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate personal data
• Erase your personal data ("right to be forgotten")
• Data portability — export your data in a machine-readable format
• Object to processing based on legitimate interest
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. Cookies

We use essential cookies for authentication and session management, and Google Analytics 4 for anonymous usage statistics with IP anonymisation enabled. We do not use advertising cookies or third-party tracking. See our Cookie Policy for full details.

10. Changes to this policy

We may update this policy from time to time. Significant changes will be communicated via email to account holders. The "last updated" date at the top of this page reflects the most recent revision.

11. Contact

For data protection queries, contact us at [email protected].

ComplyPost
London, United Kingdom