Privacy Policy

1. Data Controller and Representatives

Simple Use Software, LLC d/b/a AI COMPLY HQ™ ("we", "us", "our") is the data controller for personal data processed through the AI Comply HQ platform at aicomplyhq.com.

Contact: privacy@aicomplyhq.com

Postal address: Simple Use Software, LLC, 1314 E Las Olas Blvd, #2085, Fort Lauderdale, FL 33301, United States.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• United Kingdom (UK) — UK GDPR Article 27: Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom.
• European Union (EU) — GDPR Article 27: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit app.prighter.com/portal/12051303668 or write to the representative addresses above.

Data Protection Officer: We have assessed our processing and are not currently required to appoint a Data Protection Officer under GDPR Article 37. You may direct all privacy questions to privacy@aicomplyhq.com.

2. What Personal Data We Collect

2.1 Account Data

When you create an account, we collect:

• Email address (required for authentication)
• Full name (if provided)
• Organization name

2.2 Interview Data

When you use our compliance interview, we collect:

• Your responses to interview questions
• AI-generated follow-up questions and analysis
• Specificity scores for your answers
• Auto-filled form field values extracted by AI from your responses
• Your edits and approvals of auto-filled fields
• Interview session metadata (start time, completion time, mode, sections completed)

2.3 Voice Data (Voice Mode Only)

If you use voice mode, we additionally process:

• Audio recordings of your speech (processed in real-time for transcription)
• Transcriptions of your spoken responses

Important: Voice audio is processed by Cartesia (our speech processing provider) for transcription and text-to-speech. Audio is processed in real time and is never retained by AI Comply HQ after transcription. Cartesia's own handling of audio is governed by its service terms, and Cartesia has told us it does not operate a set retention period. See Sections 5 and 6 for details. Please do not speak special categories of personal data (such as health information) during a voice interview, as it is not required for the assessment.

2.4 Payment Data

Payment information (credit card numbers, billing address) is collected and processed directly by Stripe, our payment processor. We do not store your payment card details. From Stripe we receive: your purchase email, billing country (for tax purposes), subscription status, plan tier, and a Stripe customer identifier.

2.5 Analytics Data (With Your Consent)

If you accept analytics cookies, we collect anonymized usage data via Google Analytics, including: pages visited, features used, session duration, and general geographic region. Analytics data is only collected after you explicitly consent via our cookie banner.

2.6 Automatically Collected Data

• Authentication session tokens (strictly necessary cookies)
• Audit logs of significant actions (for security and compliance)

2.7 Document Scanning (Optional)

If you upload a business document to help pre-fill an interview, the file is processed in memory and deleted immediately. The document itself is never stored, and we do not use your documents to train AI models. Only the field values you review and confirm are saved to your assessment. For each upload our system recognizes, we keep a verification record (the document type, the filename, a cryptographic fingerprint, and the date) so you have evidence the document was checked. This record contains no document content and cannot be used to reconstruct your document.

2.8 Onboarding Assistant (Concierge)

We are introducing an AI onboarding assistant (Concierge) that will help you get set up. When it becomes available to you, you will see a clear notice that you are interacting with AI before it begins. When you use it, we collect:

• The messages you send the assistant (typed or spoken)
• The details extracted from that conversation, such as the type of AI system you want to make compliant, your role, company size, and timeline
• Conversation metadata (start time and completion status)

We use these details to personalize your onboarding, guide you to the right next step, and pre-fill parts of your compliance interview so you are not asked the same thing twice. AI-written content is marked as AI-generated, and we do not use your onboarding conversations to train AI models. The assistant carries out a setup and routing task; it does not make automated decisions that produce legal or similarly significant effects.

2.9 Free Risk Snapshot

Our free Risk Snapshot is a short multiple-choice questionnaire. When you finish it on aicomplyhq.com, we collect:

• Your answers and the result we calculate from them
• Your IP address, which we use to limit how many snapshots one network can create in an hour, to prevent abuse
• The address of the page you took it on, including any campaign tags in that address (such as utm_source), so we know how visitors find it

We collect your email address only if you ask for your result by email:

• "Email me my snapshot": we store your email address with your snapshot and send you a copy through Resend.
• "Send me the PDF + start trial": we store your email address and result in our lead list and email you the PDF through Resend. The form also has a box, empty until you tick it, labelled "Send me 4 follow-up emails over the next few weeks. They cover my result, key EU AI Act dates, and how AI Comply HQ can help. I can unsubscribe at any time." We send follow-up emails only if you tick it, and we record whether you did and the wording you saw. If you tick it, we first email you a link to confirm your address. Once you confirm, we may send you up to four follow-up emails over about two and a half weeks. Each one has an unsubscribe link. If you leave the box empty, we send you only the PDF.

When you use either email form, we also record your IP address and email address in a rate-limit log to stop the forms being abused. The optional helper that suggests an answer from a sentence you type is described in Section 4.

We offer the Risk Snapshot on aicomplyhq.com only.

How long we keep it. We delete this data automatically. A job runs once a day and deletes each item at its first run after the period below ends:

• Snapshots without an email address: 30 days after you create them, when the link to the result stops working.
• Snapshots with an email address, "Send me the PDF + start trial" requests, and our log of the follow-up emails we sent: 24 months after our last recorded contact with that email address. That is the latest of: when you last sent the "Send me the PDF + start trial" form, when we last sent you a follow-up email, when the link to a snapshot with that address on it stopped working, and when you joined our waitlist, if you did.
• IP addresses and the rate-limit log (which also holds email addresses): 24 hours after we record them. On a snapshot we clear only the IP address; the rest of the snapshot follows the rules above.

The link to your snapshot result stops working 30 days after you create it, and no email address can be added to it after that. Until then, you can delete the snapshot yourself: in the "Delete this snapshot" section of the result page, choose "Delete snapshot" and confirm. That removes your answers, your result and any email address saved with that snapshot, and the link stops working. It does not remove a "Send me the PDF + start trial" request, which we keep separately. You can ask us to delete your snapshot and email address at any time by writing to privacy@aicomplyhq.com.

3. How We Use Your Data

4. AI System Disclosure (EU AI Act Article 50)

AI Comply HQ™ uses artificial intelligence to process your interview responses and generate compliance assessments. Specifically:

• Interview responses are processed by Anthropic's Claude AI model to generate follow-up questions, evaluate answer specificity, and extract structured compliance data.
• Interview answers, chat messages and system descriptions are also sent to TypeSafe's Jev model. Jev is a judgment model: it returns scores and labels, not written text. We use it to rate how specific an answer is, to fill in yes/no and multiple-choice fields from your answer, to route chat messages (including screening them for prompt-injection attempts), to decide whether a section needs follow-up questions, to help classify a system's risk tier, to recognize the type of an uploaded document from its opening text, and to check that a reworded answer adds no new facts.
• Onboarding conversations with our setup assistant (Concierge), a feature we are introducing, are processed by Anthropic's Claude AI to understand your goals and personalize your setup.
• Voice audio (voice mode only) is processed by Cartesia's speech AI for transcription (speech-to-text) and spoken responses (text-to-speech).
• Risk classifications and auto-filled form fields are AI-generated outputs that should be reviewed by a qualified professional before use in any regulatory submission.

Free Risk Snapshot. If you use the optional helper in our free Risk Snapshot and type a sentence describing your AI system, that sentence is sent to TypeSafe's Jev model to suggest an answer to one survey question. We do not store it. TypeSafe handles it as described in Section 5.

No solely automated decisions with legal effect. Our AI outputs are advisory. You review, edit, and approve them, so they are not automated decisions that produce legal or similarly significant effects under GDPR Article 22. You may request meaningful information about the logic involved by contacting us.

5. How AI Providers Use Your Data (Model Training)

We do not use your interview responses, voice data, uploaded documents, or generated outputs to train our own AI models. Our providers differ, so we state their positions separately. Anthropic, which processes interview text, does not use data submitted through its API to train its foundation models under its commercial terms. Cartesia, which processes voice audio, is different: its standard service terms permit it to retain content submitted through its API and use it to improve its models unless an enterprise zero-data-retention arrangement or a training opt-out applies. We have switched off model training for our Cartesia account. On retention, Cartesia confirmed to us on 29 July 2026 that it does not operate a set retention period and handles deletion per customer, and its zero-data-retention option is available only on enterprise plans, which we do not hold. So assume that voice audio and transcripts sent to Cartesia may be retained by Cartesia under its terms. Voice mode is optional and consent-based, and every interview can be completed in text mode instead. TypeSafe, which scores and classifies interview text, states in its privacy policy that it will not train or fine-tune AI models on the content we send it. Its customer agreement does let it use our requests and its answers, with no time limit, to generate "Telemetry" (such as technical logs, hashes, summary statistics and classifications, metrics, and learnings related to our use of its service) and to process that Telemetry "without restriction", including to improve its services and other products. Its Data Processing Addendum says personal data is kept "for as long as necessary taking into account the purpose of the Processing", without a fixed period. So assume that text sent to TypeSafe may be retained by TypeSafe under its terms. If any of this changes, we will update this policy and, where required, ask for your consent.

6. Third-Party Data Processors

We share personal data with the following processors, each under a Data Processing Agreement. We remain responsible for personal data we entrust to them.

We may add or replace processors as the Service evolves. We will update this list, and business customers may subscribe to advance notice of sub-processor changes by emailing privacy@aicomplyhq.com.

7. International Data Transfers

Some of our processors are located outside the European Economic Area (EEA). For transfers to the United States and other third countries, we rely on:

• The EU-US Data Privacy Framework (and its UK and Swiss extensions) where the processor is certified, and
• European Commission-approved Standard Contractual Clauses (SCCs) as a fallback and additional safeguard, together with
• Supplementary technical and organizational measures, consistent with the CJEU Schrems II ruling.

Transfers to TypeSafe rely on the Standard Contractual Clauses, and for UK data the UK Addendum to those clauses, in TypeSafe's Data Processing Addendum.

You may request information about the safeguards applied to a specific transfer by contacting us.

8. Data Retention

• Account data: Retained for the duration of your account. Deleted within 30 days of account deletion request.
• Interview data (answers, auto-filled forms, generated documents, feedback, AI-interaction logs): Retained per your organization's configured retention period (180 days by default) from creation, after which it is hidden from the app and permanently deleted 12 months later. You may request earlier deletion at any time.
• Onboarding assistant (Concierge) data: Conversation transcripts and extracted fields are retained for 180 days (or your organization's configured retention period), then deleted. You may request earlier deletion at any time.
• Voice recordings: Processed in real-time. Audio is not stored by AI Comply HQ after transcription; transcribed text follows the interview data retention above. Cartesia's retention of the audio it receives is governed by its own terms (see Section 5).
• Payment data: Retained by Stripe per their data retention policy.
• Free Risk Snapshot and waitlist: Deleted automatically by a job that runs once a day. Snapshots without an email address are deleted 30 days after you create them, when the result link stops working. Snapshots with an email address, "Send me the PDF + start trial" requests with their follow-up email log, and waitlist entries are deleted 24 months after our last recorded contact with that email address. IP addresses, the browser details (user agent) stored with waitlist entries, and rate-limit records are deleted or cleared 24 hours after we record them. Until the result link stops working, you can delete a snapshot yourself from its result page; you can also ask us to delete yours at any time (see Section 2.9).
• Analytics data: Retained by Google Analytics for 2 months (event data). User-level data is retained for 14 months from your most recent visit, so it is deleted 14 months after you stop visiting rather than 14 months after your first visit. Analytics only runs if you accept analytics cookies. On aicomplyhq.com and app.aicomplyhq.com it also never runs if your browser sends a Global Privacy Control signal; authority.aicomplyhq.com does not yet check for that signal.
• Audit logs (append-only, keyed to a user ID): Kept as a tamper-evident security and accountability record for the life of your organization's account, and deleted when the organization is erased. We retain them despite an individual erasure request only to the extent GDPR Article 17(3) permits (for example, to establish or defend legal claims), and we delete or anonymize them where no such exception applies.

We may retain limited information for longer where necessary to comply with legal obligations, resolve disputes, or enforce our agreements. Backups are overwritten on a rolling basis.

9. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data.
• Right to restriction (Art. 18): Request that we limit processing of your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right regarding automated decisions (Art. 22): Our AI outputs are advisory and subject to human review, not automated decision-making with legal effects. You may request meaningful information about the logic involved.
• Right to withdraw consent: Where processing is based on consent, you may withdraw at any time.

To exercise any of these rights, contact us at privacy@aicomplyhq.com. We may need to verify your identity before responding, and we will respond within 30 days. There is no fee unless your request is manifestly unfounded or excessive.

10. Your U.S. State Privacy Rights

If you are a resident of California or another U.S. state with a comprehensive privacy law (such as Virginia, Colorado, or Connecticut), you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, the "sale" or "sharing" of personal information, and certain profiling.

• No sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under California law.
• Opt-out preference signals. Where applicable, we honor recognized browser-based opt-out signals, such as Global Privacy Control (GPC), on aicomplyhq.com and app.aicomplyhq.com. authority.aicomplyhq.com does not yet read GPC; decline analytics cookies in its cookie banner instead.
• How to exercise. Email privacy@aicomplyhq.com. We will not discriminate against you for exercising your rights.
• Appeals. If we deny your request, you may appeal by replying to our decision; we will respond within the timeframe required by your state's law.

11. Cookies

• Strictly necessary cookies: Authentication session tokens managed by Supabase. Cannot be disabled.
• Analytics cookies: Google Analytics cookies, loaded only after explicit consent via our cookie banner.

You can change or withdraw your cookie choices at any time through the cookie banner. Where required, we treat a recognized opt-out signal such as Global Privacy Control as a request to decline non-essential cookies on aicomplyhq.com and app.aicomplyhq.com (authority.aicomplyhq.com does not yet read it).

12. Data Security

We implement appropriate technical and organizational measures including:

• Encryption in transit (TLS/HTTPS on all connections)
• Encryption at rest (Supabase database encryption)
• Row-Level Security (RLS) ensuring organization-level data isolation
• Secure authentication via Supabase Auth
• Stripe webhook signature verification
• Append-only audit logging

No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data using measures appropriate to the risk.

13. Data Breach Notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will also notify affected users without undue delay.

14. Business Transfers and Legal Disclosures

We may disclose personal data where we believe in good faith that doing so is necessary to comply with a legal obligation, respond to lawful requests from public authorities, enforce our agreements, or protect the rights, safety, or property of our users or others. If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to this Privacy Policy or a policy at least as protective, and we will notify you of any material change in how your data is handled.

15. Children

AI Comply HQ™ is a business-to-business service. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us immediately.

16. Changes to This Policy

We may update this Privacy Policy at any time to reflect changes in our data practices, technology, or legal requirements. When we make changes, we will update the "Last updated" date above, and for material changes we will notify you by email or a prominent notice on our platform before they take effect. We encourage you to review this page periodically. Your continued use of the Service after an update takes effect means you acknowledge the revised policy.

17. Complaints

If you are unsatisfied with how we handle your personal data, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU/EEA supervisory authorities is available at edpb.europa.eu. UK users may complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concerns first.

18. Contact

For privacy inquiries or data subject requests:
Email: privacy@aicomplyhq.com
General: hello@aicomplyhq.com