Privacy Policy

1. Introduction

Welcome to ComplianceKit. We are committed to protecting your personal data and respecting your privacy rights in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

This Privacy Policy explains how ComplianceKit ("we", "us", or "our") collects, uses, shares, and protects your personal information when you use our GDPR compliance platform and services.

Controller: Nyrvex Digital (Pty) Ltd, trading as ComplianceKit, is the data controller responsible for your personal data.

2. Data We Collect

2.1 Information You Provide

• Account Information: Name, email address, password (encrypted), company name
• Website Information: Website URLs, company details for policy generation (company address, DPO contact information)
• Payment Information: Billing details processed through Paddle (we do not store credit card numbers)
• Communication: Messages you send us through support or contact forms

2.2 Information We Collect Automatically

• Usage Data: Pages visited, features used, time spent, interaction data
• Device Information: IP address, browser type, device type, operating system
• Cookies: Authentication cookies, preference cookies (see Cookie Policy)
• Log Data: Access times, error logs, security events

2.3 Information from Third Parties

• OAuth Providers: If you sign in with Google, we receive your name, email, and profile picture
• Payment Processor: Paddle provides transaction confirmation and payment status

3. How We Use Your Data

We process your personal data for the following purposes:

3.1 Service Provision (Legal Basis: Contract)

• Create and manage your account
• Provide access to our GDPR compliance tools
• Scan websites for cookies and tracking scripts
• Generate privacy policies and cookie policies
• Process and manage DSAR (Data Subject Access Requests)
• Display compliance analytics and reports

3.2 Billing & Payments (Legal Basis: Contract)

• Process subscription payments
• Generate invoices
• Manage billing inquiries and refunds

3.3 Communication (Legal Basis: Contract & Legitimate Interest)

• Send service-related notifications (downtime, updates, security alerts)
• Respond to support requests
• Send important account information

3.4 Improvement & Analytics (Legal Basis: Legitimate Interest)

• Analyze platform usage to improve features
• Monitor system performance and errors
• Conduct internal research and development

3.5 Security (Legal Basis: Legitimate Interest & Legal Obligation)

• Prevent fraud and unauthorized access
• Detect and respond to security incidents
• Enforce our Terms of Service
• Comply with legal requirements

3.6 Marketing (Legal Basis: Consent)

• Send promotional emails about new features (only with your consent)
• You can opt-out at any time

4. Data Sharing & Disclosure

We do not sell your personal data. We only share your data in these circumstances:

4.1 Service Providers

• Hosting: Railway (EU - Netherlands) - Application hosting
• Database: Supabase/PostgreSQL (EU - Ireland) - Data storage
• Payment Processing: Paddle (United Kingdom) - Payment transactions
• Authentication: Google OAuth (United States, if you use Google sign-in)
• Email: Resend (United States) - Transactional emails
• Error Monitoring: Sentry (United States) - Application error tracking
• AI Policy Generation: Anthropic (United States) - AI provider (Claude Haiku) for policy generation and scan analysis

All service providers are contractually required to protect your data and only use it for specified purposes.

We do not use data sent to Anthropic to train its AI models — Anthropic's commercial API does not use customer inputs or outputs for model training by default, and we have not enabled any account-level override. Our AI features (policy generation, scan analysis) produce informational output for you to review; we do not use AI to make automated decisions producing legal or similarly significant effects about anyone (Article 22 GDPR).

4.2 Legal Requirements

We may disclose your data if required by law, court order, or government request.

4.3 Business Transfers

If ComplianceKit is involved in a merger, acquisition, or sale, your data may be transferred. You will be notified of any such change.

5. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Account Data: Retained while your account is active, plus 30 days after deletion
• Website Visitor Consent Records: Retained on a plan-tiered schedule — Free 7 days, Starter 30 days, Professional 90 days, Enterprise 365 days. See our Data Processing Agreement (Section 12) for full detail
• Website Scan Data: No automatic time limit — kept until you delete the website or your account. Scan results are not visitor personal data (they describe your website, not its visitors), so we treat them as evidence you may want to keep, not data we time-box
• DSAR Records: Completed or rejected requests are purged after 24 months (legal requirement); active requests are kept until resolved
• Billing Records: Kept for at least 7 years, in line with South African statutory recordkeeping requirements (Companies Act, 2008; tax legislation); we have not yet automated deletion beyond that period
• Security & Audit Logs: Audit trail entries (who did what) are retained for 24 months; login-attempt and rate-limit records are retained for 30 days once inactive
• Backup Data: Backup copies are retained on our infrastructure providers' standard backup-retention schedules and are not indefinitely kept

6. Your Rights Under GDPR

You have the following rights regarding your personal data:

6.1 Right of Access

You can request a copy of all personal data we hold about you.

6.2 Right to Rectification

You can update or correct your personal data at any time through your account settings.

6.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your account and all associated data. Use the account deletion feature in your settings.

6.4 Right to Data Portability

You can export all your data in a machine-readable format (JSON) at any time.

6.5 Right to Restriction of Processing

You can request that we stop processing your data in certain circumstances.

6.6 Right to Object

You can object to processing based on legitimate interests or direct marketing.

6.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw consent at any time.

6.8 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority:

• South Africa: the Information Regulator — inforegulator.org.za, enquiries@inforegulator.org.za
• EU/EEA: your national Data Protection Authority — a full list is published by the European Data Protection Board at edpb.europa.eu
• United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest
• Password Security: Passwords are hashed using bcrypt with salt
• Access Control: Strict authentication and authorization mechanisms
• Security Monitoring: Continuous monitoring for suspicious activity
• Regular Audits: Periodic security assessments and updates
• Account Lockout: Protection against brute force attacks
• Rate Limiting: Protection against DDoS and abuse

See our Security Documentation for more details.

8. International Data Transfers

Your core data is hosted within the European Economic Area (EEA) - our database (Supabase, Ireland) and application hosting (Railway, Netherlands). Some data is transferred outside the EEA: transactional email delivery (Resend), error monitoring (Sentry), and AI policy generation (Anthropic) are processed in the United States, and Google OAuth (if used) is operated by Google in the United States. Paddle (payment processing) operates from the United Kingdom, which the EU recognises as providing an adequate level of data protection.

We ensure adequate protection for these transfers through:

• EU Standard Contractual Clauses, incorporated in the data processing agreements of Resend, Sentry, Railway and Anthropic (Modules 2 & 3)
• EU-US Data Privacy Framework self-certification by Resend, Sentry and Google
• Reliance on the United Kingdom adequacy decision for Paddle
• Additional security measures beyond legal requirements

8.1 POPIA (South Africa) Cross-Border Transfers

ComplianceKit is operated by NYRVEX DIGITAL (Pty) Ltd, a South African company, which acts as a "responsible party" under the Protection of Personal Information Act 4 of 2013 ("POPIA"). Where we transfer personal information to a service provider located outside South Africa, section 72 of POPIA requires that one of the following applies:

• the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA's conditions, including similar restrictions on onward transfer;
• the data subject has consented to the transfer;
• the transfer is necessary for the performance of a contract with the data subject, or for pre-contractual measures taken at their request;
• the transfer is necessary for a contract concluded in the data subject's interest between us and a third party; or
• the transfer is for the data subject's benefit, obtaining consent is not reasonably practicable, and consent would likely be given if it were.

We rely on the first ground above: our service providers outside South Africa (Resend, Sentry, Railway and Anthropic in the United States; Google, where used) are each bound by a data processing agreement incorporating the EU Standard Contractual Clauses, and Paddle (United Kingdom) is bound by its own data protection addendum incorporating the equivalent UK-approved clauses. We consider these binding agreements to provide a level of protection substantially similar to POPIA's conditions for lawful processing, including restrictions on further transfer.

9. Cookies

We use cookies to provide and improve our services. For detailed information about the cookies we use, please see our Cookie Policy.

Essential Cookies: Required for authentication and security (cannot be disabled)

Optional Cookies: Analytics and preferences (you can manage these in cookie settings)

10. Children's Privacy

ComplianceKit is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Updating the "Last Updated" date at the top of this policy
• Sending an email notification for material changes
• Displaying a prominent notice on our platform

Your continued use of ComplianceKit after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

13. Data Processing Agreement

If you are a ComplianceKit customer and we process personal data on your behalf (as a data processor), our Data Processing Agreement applies automatically and is accepted at account registration — no separate signature is required. You can review its full terms at any time at the link above.