Privacy Policy

Last updated: July 11, 2026

ComplyKeep ("we", "us", "our") operates complykeep.com (the "Service"). This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

Information We Collect

Information You Provide

• Email address: When you submit a scan, we collect your email to send you scan results and notifications.
• Website URL: The URL you submit for accessibility scanning.
• Payment information: When you purchase a paid plan, payment is processed by Stripe. We do not store your credit card details — Stripe handles all payment data securely.

Information We Collect Automatically

• Usage data: Pages visited, time spent, IP address, browser type, and device information via Google Analytics.
• Scan data: The results of accessibility scans we perform on submitted URLs, including violation counts and issue details.
• Cookies: We use essential cookies for the Service to function and analytics cookies to understand usage patterns.

How We Use Your Information

• To provide accessibility scanning services and deliver reports
• To send email notifications about scan results
• To process payments and manage subscriptions
• To improve our Service, including the accuracy of accessibility scans
• To detect and prevent fraud or abuse of the Service
• To provide customer support
• To send service updates (only if you've opted in)

Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data on the following legal bases:

• Contract: Processing is necessary to provide the scanning service you requested.
• Legitimate interest: To improve our service, prevent fraud, and ensure security.
• Consent: For marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation: To comply with applicable laws and regulations.

Data Storage and Retention

Scan data is stored securely in Supabase (PostgreSQL database hosted in the EU). We retain scan results for 12 months after the last scan. Payment records are retained for 7 years as required by tax law. You can request deletion of your data at any time by emailing support@complykeep.com.

Data Sharing

We do not sell your data. We share data only with the following service providers who process data on our behalf:

• Stripe: Payment processing (PCI-DSS compliant)
• Supabase: Database hosting (EU-based)
• Vercel: Web application hosting
• Netlify: Static file hosting and CDN
• Google Analytics: Anonymous usage analytics
• Resend: Email delivery for scan notifications

We may disclose data if required by law or to protect our legal rights.

Cookies

We use the following cookies:

• Essential cookies: Required for the Service to function (session management, rate limiting).
• Analytics cookies: Google Analytics cookies (_ga, _gid) to understand how visitors use the site.

You can control cookies through your browser settings. Disabling analytics cookies does not affect the functionality of the Service.

Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Restriction: Request we limit processing of your data.
• Portability: Receive your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Withdraw consent for processing at any time.

To exercise these rights, email support@complykeep.com. We respond within 30 days.

Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit
• Secure database with row-level security policies
• Payment processing via PCI-DSS compliant Stripe
• Access controls and regular security reviews

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but we take reasonable steps to protect your data.

International Transfers

Your data may be processed in countries outside the EU/EEA (e.g., US-based Vercel and Google). We only transfer data to providers with adequate safeguards, including Standard Contractual Clauses where required.

Children's Privacy

ComplyKeep is not intended for users under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service. Continued use after changes constitutes acceptance.

Contact