Privacy policy

Who we are

ComplianceOfficer is built and operated by ComplianceOfficer. For anything in this policy, write to support@complianceofficer.ai.

What we collect, and when

Account signup. If you create an account we store your email address, the moment you confirmed it, the page the request came from, marketing parameters in the address bar (utm tags and referrer), and the IP address of the confirming request. We use this to run your account, measure which pages convert, and email you about your workspace. Nothing else is done with it and it is never sold. Advertisers never receive it: the ad tags described under Advertising measurement report that a signup happened, not who signed up.

The compliance scan. The industry, framework and region selections you make in the demo are used to generate your result and are not stored: they are not written to a database and not recorded in application logs (failure logs carry counts only). Generating the result sends your selections, never your identity, to our AI model provider, which processes them only to return the result and under contractual terms that bar other use. Results render in your browser and are gone when you close the page.

Analytics. We use aggregate, page-level analytics to see what gets read. The advertising tags we use to measure our own campaigns are described in the next section.

Advertising measurement

We advertise on Google Ads and Microsoft Advertising (Bing). When you arrive from one of our ads, the link carries an ad click identifier (gclid, gbraid or wbraid from Google, msclkid from Microsoft) and campaign parameters (utm_source, utm_medium, utm_campaign and utm_term). We keep these, together with the page you landed on, in a first-party cookie named co_acq for up to 90 days, and we store them with your signup and your account, so we know which ads lead to signups and purchases.

Pages of this site, the account pages included, load the Google Ads tag and the Microsoft Advertising UET tag, which set their own cookies and tell Google and Microsoft when a signup is confirmed or a plan is bought, with the plan price for a purchase. The purpose is conversion measurement for our own campaigns, nothing else. We send them no names, email addresses, company details, compliance data or payment details, we do not sell your data, and we never load these tags on pages whose address carries a sign-in link, a payment session or an unsubscribe link. You can block or delete these cookies in your browser settings, and you can manage ad personalization in your Google and Microsoft account settings.

What we do not do

• No selling or renting of personal data, to anyone, ever.
• No advertising profiles built from your usage, and no selling of data to advertisers.
• No storage of demo inputs, as described above.
• No card data on our servers: card details are entered on our payment processor's secure page.

Your rights

Email support@complianceofficer.ai and we will show you what we hold about you, correct it, or delete it, including closing your account, within 30 days. If you are in the EU/UK, GDPR gives you these rights formally; we honor them for everyone.

Retention and security

Account data is kept while your account is active plus twelve months, or until you ask us to delete it, whichever comes first. It lives on access-controlled infrastructure in the EU, transmitted only over TLS.

Changes

If this policy changes materially, every account holder gets the diff by email, in plain language.