Privacy Policy

1. Information We Collect

1.1 Personal Information You Provide

We collect information that you voluntarily provide to us when you:

• Register for an account: Name, email address, company name, phone number, job title
• Subscribe to our Service: Billing information (processed securely through Stripe), payment history
• Contact us: Name, email address, message content, phone number
• Join our waitlist: Email address, company information, use case details

1.2 Information Automatically Collected

When you access the Service, we may automatically collect:

• Usage Data: Pages visited, time spent, clicks, navigation paths, feature usage
• Device Information: IP address, browser type and version, operating system, device identifiers
• Location Data: Approximate geographic location based on IP address
• Cookies and Similar Technologies: See our Cookie Policy for details

1.3 Conversation Data

If you use our AI assistant features, we collect:

• Customer conversation transcripts and messages
• Customer information shared during conversations (with your permission)
• Conversation metadata (timestamps, duration, outcomes)
• Agent performance metrics (answer quality, human handovers)

2. How We Use Your Information

We use the collected data for the following purposes:

• Service Delivery: To provide, maintain, and improve our Service
• Account Management: To manage your account and provide customer support
• Agent quality: To review flagged answers and propose improvements to the knowledge base of your own workspace. We do not train AI models on your conversations, yours or any customer's.
• Communication: To send you updates, newsletters, and marketing materials (with your consent)
• Analytics: To understand how users interact with our Service and optimize performance
• Security: To detect, prevent, and address technical issues and fraudulent activity
• Legal Compliance: To comply with legal obligations and enforce our Terms of Service

3. Legal Basis for Processing (GDPR)

If you are from the European Economic Area (EEA), our legal basis for collecting and using your personal information depends on the data and the context:

• Contract Performance: Processing necessary to provide the Service you requested
• Consent: You have given explicit consent for specific purposes (e.g., marketing emails, analytics cookies)
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., fraud prevention, service improvement)
• Legal Obligation: Processing required to comply with legal obligations

4. How We Share Your Information

We may share your information in the following situations:

4.1 Service Providers

We employ third-party companies to facilitate our Service:

• Google Cloud (Belgium, europe-west1): Application and database hosting. This is where your data lives.
• Vercel: Website and dashboard hosting
• OpenAI and Anthropic (United States): Agent answer generation. They receive conversation content at the moment of answering.
• Google (Gemini / Vertex AI): Agent answer generation, only for businesses that enable it.
• Stripe: Payment processing
• Resend (United States, standard contractual clauses): Delivery of the Service's emails (account verification, alerts, billing and notifications). It receives the recipient address and the content of the email.
• Google Analytics: Website usage analytics (only with your consent)
• Sentry (Germany): Error monitoring. It receives the technical failure and the screen it happened on. In the dashboard it also records the seconds before an error, with the text masked, so the failure can be reproduced. It receives no IP addresses, and on the public website it receives nothing beyond the error itself.

These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

4.2 Business Transfers

If Komplian is involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your information is transferred and becomes subject to a different Privacy Policy.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

5. Data We Process on Behalf of Our Customers

Businesses that use Komplian install our agent on their website and connect it to their channels (WhatsApp, Instagram, Messenger, Telegram, Slack, email). When you, as a customer or visitor of one of those businesses, write to the agent, that business decides what your data is used for: it is the data controller, and its privacy policy is the one that applies to you. Komplian acts as a data processor on the business's behalf under the Data Processing Agreement it signs with us. This section explains exactly what we do with that data, so the business can cite it in its policy and you can know it.

5.1 What we store

• The conversation: the messages you write and the replies from the agent or the business's team, with date and channel.
• What you provide: name, email, phone or other details you give the agent or enter in a chat form, so the business can get back to you.
• Minimal technical data: an anonymous visitor identifier on the website, the page you write from and your browser language. On messaging channels, the identifier the platform hands us (for example, your WhatsApp number).

Before your first message the agent tells you that you are talking to a virtual agent and links the business's privacy policy. We recommend not sharing especially sensitive data (health, full banking details, identity documents) in a chat.

5.2 What for

Solely to provide the service to the business: generating the agent's reply, showing the conversation to the business's team in its inbox, and recording the contact in its CRM if the business has that enabled. We do not use your conversations to train models or for Komplian's own purposes.

5.3 For how long

• Conversations with no activity for 30 days are archived automatically, and those that remain archived and inactive for another 30 days are removed from the business's inbox.
• The business can delete a conversation or a contact at any time from its dashboard.
• All data is permanently deleted when the business deletes its Komplian account (30 days after requesting it) or when it asks us to.

5.4 Who else is involved (subprocessors)

• Google Cloud (Belgium, europe-west1): hosting of the application and of the database where the conversation lives.
• OpenAI and Anthropic (United States, standard contractual clauses): generation of the agent's reply. They receive the conversation content at the moment of answering; under our API agreements they do not retain it to train their models.
• Google (Gemini / Vertex AI): reply generation, only for businesses that enable it.
• Vercel: hosting of the dashboard from which the business's team reads the conversation.
• Resend (United States, standard contractual clauses): delivery of the emails the service generates, such as alerting the business to a new message or form response. It receives the recipient address and the content of that email.
• Sentry (Germany): error monitoring. If the dashboard fails while a conversation is on screen, it receives the technical failure and a recording of the seconds before it, with the text masked.

The platform of the channel you write through (Meta for WhatsApp, Instagram and Messenger; Telegram; Slack; Discord) is not our subprocessor: it is the service you and the business chose, and it processes your data under its own terms. We receive and send messages through it.

5.5 Your rights

You can exercise your rights of access, rectification, erasure and the others the GDPR grants you with the business you talked to, which is the controller. If you write to us at team@komplian.com, we will forward your request to the business and help it respond.

6. Your Data Protection Rights

6.1 GDPR Rights (EU/EEA Users)

If you are a resident of the European Economic Area (EEA), you have the following data protection rights:

• Right to Access: You can request copies of your personal data
• Right to Rectification: You can request correction of inaccurate or incomplete data
• Right to Erasure: You can request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: You can request that we limit how we use your data
• Right to Data Portability: You can request transfer of your data to another organization
• Right to Object: You can object to our processing of your personal data
• Right to Withdraw Consent: You can withdraw consent at any time where we relied on consent

6.2 CCPA Rights (California Residents)

If you are a California resident, you have the following rights under the CCPA:

• Right to Know: You can request information about the personal information we collect, use, and disclose
• Right to Delete: You can request deletion of your personal information
• Right to Opt-Out: You can opt-out of the sale of your personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights

6.3 How to delete your data or opt out

• Delete your account and its data: write to team@komplian.com from your account address, with “Data deletion” as the subject. We verify your identity, delete your workspace and its conversations, and confirm in writing once it is done.
• Data that arrived through WhatsApp, Instagram or Messenger: tell us in that same email which phone number or account you wrote from. We delete the messages and the contact record attached to them. You can also remove Komplian’s permission from your Meta account settings.
• Marketing emails: use the unsubscribe link in any of our emails, or ask us by email. Unsubscribing is immediate and does not affect service notices about your account.
• Analytics and marketing cookies: change them at any time from the cookie manager on this site, explained in the Cookie Policy.

We keep only what the law requires us to keep, such as billing records, for the period set out in the data retention section.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption: Data in transit is encrypted using TLS/SSL protocols
• Secure Storage: Data at rest is encrypted and stored on secure servers
• Access Controls: Limited access to personal data on a need-to-know basis
• Regular Audits: Security practices are regularly reviewed and updated
• Employee Training: Staff are trained on data protection and privacy practices

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained while your account is active and for up to 2 years after account deletion
• Conversation Data: Retained for up to 1 year or as configured in your account settings
• Payment Data: Retained as required by tax and accounting regulations (typically 7 years)
• Analytics Data: Retained for up to 14 months (Google Analytics default)

9. International Data Transfers

Your data is hosted in the European Union. The Komplian application and database run on Google Cloud, region europe-west1 (Belgium). Your account and your conversations do not leave the EEA to be stored.

There are two transfers out of the EEA. The first is answer generation: when the agent replies, that conversation's content is sent to OpenAI and Anthropic (and to Google, for businesses that enable Gemini), whose infrastructure may be in the United States. It is sent to answer at that moment, not to train models. The second is delivery of the Service's emails through Resend, in the United States.

Those transfers rely on Standard Contractual Clauses approved by the European Commission, alongside the technical measures described in our Security Policy.

10. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us. If we become aware that we have collected personal information from children without verification of parental consent, we will take steps to remove that information from our servers.

11. Third-Party Links

Our Service may contain links to third-party websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date at the top of this Privacy Policy
• Sending you an email notification (for material changes)

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us:

14. Supervisory Authority

If you are located in the EEA and believe we have not adequately resolved your privacy concerns, you have the right to lodge a complaint with your local data protection authority.

For users in Spain, the supervisory authority is the Spanish Data Protection Agency (AEPD): www.aepd.es