Privacy Policy

Last updated: August 10, 2026

Compliagence Solutions Inc. (“Company”, “we”, “our”, or “us”) respect your privacy and are committed to protecting it through our compliance with this policy. This policy describes how we collect, process, retain, and disclose personal data about you when providing services to you through our websites, applications, products, and services that link to this policy (our “Services”) and our practices for using, maintaining, protecting, and disclosing that information.

This policy applies only to information we collect:

Through the Services.
In communications, including email, text, chat, and other electronic messages, between you and the Services.

It does not apply to information collected by:

Us through any other means, including on any other website operated by Company or any third party that does not link to this policy; or
Any third party, including through any application or content (including advertising) that may link to or be accessible from or through the Services.

We may provide additional or different privacy policies that are specific to certain features, services, or activities.

Please read this policy carefully to understand our policies and practices regarding your information and how we treat it. This policy applies to personal data processed through the Services wherever the Services are offered, except where a separate or supplemental privacy notice applies. Certain provisions below apply only to individuals in particular jurisdictions. This policy also explains the rights and choices that may be available to you under applicable law in those jurisdictions. Where we rely on your consent for a particular processing activity, we will request that consent separately as required by applicable law. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Services after we make changes as described here is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Children’s and Minors’ Data

Our Services are not intended for, and we do not knowingly collect any personal data from, children under the age of 18. If we learn we have collected or received personal data from a child under 18 years old without verification of parental consent, we will delete that information.

Our Role as Controller or Processor

Our role in processing personal data depends on the context.

Customer Data

When an organization uses the Services to collect, upload, store, analyze, manage, or otherwise process personal data relating to its personnel, contractors, customers, vendors, or other individuals (“Customer Data”), that organization generally determines the purposes and means of the processing. In that context, the organization acts as the controller or business, and we act as its processor or service provider. We process Customer Data on the organization’s documented instructions and in accordance with our agreement with that organization.

If your personal data was submitted to the Services by or on behalf of an organization that is one of our customers, you should ordinarily direct questions and requests concerning that data to the relevant organization. We will assist the organization in responding as required by applicable law and our agreement with that organization.

Data We Process as a Controller or Business

We act as a controller or business when we determine the purposes and means of processing, including for administration of customer and user accounts, billing, security, fraud prevention, service operations, product analytics, communications, marketing, and management of our websites and business relationships.

In some circumstances, the allocation of roles may differ. The applicable agreement or supplemental notice will control to the extent it describes a particular processing activity more specifically.

The Personal Data That We Collect or Process

“Personal data” is information that identifies, relates to, describes, directly or indirectly, or can reasonably be linked to an identified or identifiable individual. Depending on applicable law, equivalent terms may include “personal information” or “personally identifiable information.” Personal data may include, for example, name, email address, telephone number, home address, payment information, device identifiers, and professional and employment related data.

The types and categories of personal data we collect or process include:

Customer Data, such as training and certification records, risk or control information, reports, supporting documentation, and other data submitted through the Services.
Account and contact information, including name, work email address, phone number, username, and other contact information you provide us.
Transaction and subscription data, such as subscription plan, invoices, payment status, and transaction history. Payment card information may be processed directly by our payment processor partner rather than processed by us.
Location information, including general geographic location such as country, state or province, or city.
Device information, including your IP address, device identifiers, operating system and version, preferred language, hardware identifiers, browser type and settings, and other device information.
Sensitive personal data, as described below, but only where necessary for the Services, permitted by applicable law, and subject to appropriate safeguards.
Other content and information you elect to provide as part of your profile or in any reviews you make through the Services or emails, chats, or other communications sent to us.

We also collect:

Statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific Services feature.
Technical information. Technical information includes information about your internet connection and usage details about your interactions with the Services, such as clickstream information to, through, and from our Services (including date and time), products that you view or search for; page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal information.

Sensitive Personal Data

Some information processed through the Services may be considered sensitive personal data, special-category data, or similarly protected information under applicable law. Depending on how a customer configures and uses the Services, this may include information concerning health, disability, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, sexual orientation, biometric identifiers, government identification numbers, account credentials, precise geolocation, criminal allegations or convictions, or other information subject to heightened protection.

We ask users not to provide sensitive personal data unless it is necessary for an authorized use of the Services and permitted by the relevant customer.

Where we process sensitive personal data as a processor, we do so on the relevant customer’s documented instructions. The customer is responsible for identifying an appropriate legal basis and satisfying any additional conditions applicable to the processing.

Where we process sensitive personal data as a controller, we do so only where permitted by applicable law, including where necessary to comply with legal obligations, establish or defend legal claims, protect vital interests, prevent security incidents or fraud, or based on explicit consent when required. We use reasonable measures designed to limit access, use, disclosure, and retention of sensitive personal data to what is necessary for the relevant purpose.

We do not use or disclose sensitive personal data for purposes of inferring characteristics about individuals except as disclosed at collection and permitted by applicable law.

How We Collect Your Personal and Other Data

You Provide Information to Us

We collect information about you when you interact with our Services, such as when you create or update an account, or create, upload, or post data to the Services.

Automatically Through Our Services

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal data. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies, web beacons, and other tracking technologies including details of your interactions with our Services, such as traffic data, location data, logs, and other communication data, and which resources and Services features that you access and use.

Using automatic collection technologies helps us to improve our Services and to deliver a better and more personalized experience.

The technologies we use for this automatic data collection may include:

Cookies. A cookie is a small file placed on your device when you interact with the Services. You may refuse to accept or disable cookies by activating the appropriate setting on your browser or device. However, if you select this setting, you may be unable to access certain features of the Services.
Web Beacons. Some parts of the Services may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those parts and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).

To the extent any of these automated technologies are considered a personal data sale, targeted advertising, or profiling, under applicable laws, depending on where you live, you may opt out from use of these automated technologies for such uses by emailing your request to privacy@compliagence.ai. Please note that some Services features may be unavailable as a result.

From Business Partners and Service Providers

We may receive personal data about you from other sources and combine that with information we collect directly from you. For example, we may obtain information about you from service providers that we engage to perform services on our behalf, such as email platform providers, payment processors, and analytics, security and anti-fraud services.

Legal Bases for Collecting and Processing Personal Data

If the GDPR or UK GDPR applies to processing for which we act as controller, we rely on one or more of the legal bases identified in the table below. Where we rely on legitimate interests, we consider whether those interests are overridden by the interests or fundamental rights and freedoms of affected individuals. Where we rely on consent, you may withdraw consent at any time, without affecting processing conducted before withdrawal.

If we need personal data to perform a contract or comply with a legal obligation, we will identify when provision of the data is required and the possible consequences of not providing it.

Processing purpose	Typical dat	Legal basis
Provide accounts and requested Services	Contact, account, authentication, subscription and usage data	Performance of a contract or steps requested before entering a contract
Operate, secure and troubleshoot the Services	Device, log, usage, account and security data	Legitimate interests in operating and securing the Services; legal obligations where applicable
Billing and financial administration	Contact, subscription, transaction and tax data	Performance of a contract and compliance with legal obligations
Customer support	Account, communications and diagnostic data	Performance of a contract and legitimate interests in supporting users
Improve and develop the Services	Usage, diagnostic and feedback data	Legitimate interests, subject to balancing and safeguards; consent where required
Send marketing communications	Contact, preference and engagement data	Consent where required; otherwise legitimate interests as permitted by law
Establish or defend legal claims and enforce agreements	Relevant account, transaction, communication and usage data	Legitimate interests and legal obligations
Optional cookies or similar technologies	Device, cookie and usage data	Consent where required
Customer Data	Data selected and submitted by the customer	Determined by the customer as controller; processed by us as a processor under the customer’s instructions

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data, to:

Provide you with the Services and any contents, features, information, products, or services that we make available through the Services.
Fulfill and manage subscriptions and orders.
Fulfill any other purpose for which you provide it.
Provide you with notices about your account, including expiration and renewal notices.
Carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
Notify you when Services updates are available and about changes to any products or services we offer or provide though them.
In any other way we may describe when you provide the information.
For any other purpose with your consent.

The usage information we collect, whether connected to your personal data or not, helps us improve our Services and deliver a better and more personalized experience by enabling us to:

Estimate our audience sizes and usage patterns.
Store information about your preferences, allowing us to customize the Services according to your individual needs and interests.
Speed up your searches.
Recognize you when you return to our Services.

We may also use your information to contact you about goods and services that may be of interest to you. If you do not want us to use your information in this way, please [check the relevant box located on the form on which we collect your data (the [order form/registration form])/adjust your user preferences in your account profile. For more information, see Your Rights and Choices About Your Information.

Artificial Intelligence and Automated Features

Certain Services features may use machine learning, generative artificial intelligence, or large language models to summarize information, classify content, identify possible compliance issues, generate draft materials, or provide recommendations.

When a customer invokes these features, information submitted to the feature, related Customer Data, and the resulting output may be processed by us and by AI service providers acting on our behalf. We require those providers to process the information only to provide the contracted services and subject to applicable confidentiality, security, retention, and data-protection obligations.

We do not use Customer Data or personal data contained in user prompts or outputs to train generalized AI or large language models, and we do not permit our AI service providers to do so, unless the relevant customer or user has expressly authorized that use.

AI-generated outputs may be incomplete, inaccurate, or inappropriate for a particular purpose. Users are responsible for reviewing outputs before relying on them. Unless expressly stated otherwise, the Services do not make decisions producing legal or similarly significant effects about individuals solely through automated processing.

Who We Disclose Your Information To

We may use and disclose information that has been aggregated or deidentified so that it does not reasonably identify an individual, subject to applicable law. We will not attempt to reidentify deidentified data except as permitted by law.

We may also disclose personal data that we collect or you provide as described in this privacy policy:

To contractors, service providers, and other third parties we use to support our organization and who are bound by contractual obligations to keep personal data confidential and use it only for the purposes for which we disclose it to them.
To our professional advisers, and actual or potential investors, acquirers and sources of financing, and their respective professional advisers.
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Company’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by Company is among the assets transferred.
To fulfill the purpose for which you provide it.
For any other purpose disclosed by us when you provide the information.
With your consent.

We may also disclose your personal data:

To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
To enforce or apply our Terms of Service and other agreements, including for billing and collection purposes.
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, our customers, or others.

The categories of personal data we may disclose include:

Account and contact information.
Payment information.
Account history, including information about your subscription, account, transactions, purchases, order history, or discounts.
Device information.

Your Rights and Choices About Your Information

This section describes mechanisms you can use to control certain uses and disclosures of your information and rights you may have under applicable law, depending on where you live.

Advertising, marketing, cookies, and other tracking technologies choices:

Cookies and Other Tracking Technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. If you disable or refuse cookies or similar tracking files, some Services features may be inaccessible or not function properly. Some browsers include a “Do Not Track” (DNT) setting that can send a signal to the online services you visit indicating you do not wish to be tracked.

Your Privacy Rights

Depending on where you live, you may have certain rights related to your personal data, including:

Access and Data Portability. You may confirm whether we process your personal data and access a copy of the personal data we process. To the extent feasible and required by applicable law, data will be provided in a portable format. Depending on applicable law, you may have the right to receive additional information and it will be included in the response to your access request.
Correction. You may request that we correct inaccuracies in your personal data that we maintain, taking into account the information’s nature and processing purpose.
Deletion. You may request that we delete personal data about you that we maintain, subject to certain exception under applicable law.
Opt Out of Using Personal Data for Sales, Targeted Advertising, and Profiling for Certain Legal or Similarly Significant Decisions. You may request that we do not use your personal data for these purposes.
Withdraw Consent. Depending on applicable law, you may withdraw consent at any time, without affecting processing conducted before withdrawal.
Appeal. Depending on applicable law, you may have the right to appeal our refusal to act on a request.
Lodge a complaint. Depending on applicable law, you may have the right to lodge a complaint with a competent privacy or data-protection regulator.

Important: These rights are not absolute and the exact scope varies based on applicable law. There are also several exceptions where we may not have an obligation to fulfill your request.

If we process personal data on behalf of a customer, the customer is responsible for responding to requests concerning that data. Please submit the request directly to the organization that provided your data to the Services. If you submit the request to us, we may refer it to that customer.

You will not be discriminated against for exercising an applicable privacy right.

To exercise any of these rights, please contact us at privacy@compliagence.ai.

Please describe the right you wish to exercise and provide information reasonably sufficient for us to identify the relevant records. We may take reasonable steps to verify your identity and authority before acting on a request. We will use information provided for verification only for purposes of evaluating and responding to the request.

An authorized agent may submit a request where permitted by law. We may require evidence of the agent’s authority and may ask you to verify your identity directly.

We will respond within the period required by applicable law. If we need additional time, we will notify you as permitted by law. We generally do not charge a fee, but may charge a reasonable fee for identity verification or decline repetitive, excessive, or manifestly unfounded requests where permitted.

If we decline to take action regarding your request to exercise your privacy rights, you may appeal our decision by contacting us at privacy@compliagence.ai. You must submit your appeal within sixty (60) days after receiving our decision. Please include sufficient information for us to identify your original request and explain why you believe the denial was in error. We will review and respond to your appeal within forty-five (45) days after receipt of the appeal. If reasonably necessary, we may extend the response period once by an additional forty-five (45) days, in which case we will inform you of the extension and the reason for the delay. If we deny your appeal, we will provide you with a written explanation of the reasons for the decision. Where required by applicable law, our response will also include information regarding how you may contact your state Attorney General or other applicable regulatory authority to submit a complaint.

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing, including data “sales” as defined under certain laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

If you are a California resident, additional information applies to you. To learn more about California residents’ privacy rights, please see the Your California Privacy Rights section below.

Your California Privacy Rights

California law grants additional privacy rights to California residents. In particular, the California Consumer Privacy Act (“CCPA”) requires businesses to disclose, for the past 12 months, (i) the categories of personal information collected, (ii) the sources of the collected personal information, (iii) the purposes for which the collected personal information is used, (iv) the categories of personal information disclosed for a business purpose, and (v) the categories of any personal information sold. Company provides these disclosures in the following table. (Note that Company does not share or sell any personal information, even under the broad CCPA definition of “share” or “sale.”)

Category	Sources of Collection	Purposes of Collection	Disclosures for a Business Purpose
Identifiers	Website visits, creation of accounts, registration for Company products and services, and requests for information from Company in performing the Services	To enable Company to provide the Services, including to: create and manage user accounts; authenticate users; communicate with users about the Services; respond to inquiries and support requests; provide requested products, services, and information; maintain security and prevent fraud or unauthorized access; and administer customer relationships.	To Company service providers to assist in providing Company products and services
Personal information categories listed in the California Customer Records statute	Registration to receive Company products and services and requests for information from Company in performing the Services	To enable Company to provide the Services, including to: process registrations and service requests; manage customer and business relationships; provide customer support; process and maintain billing and transaction records, where applicable; communicate regarding accounts and Services; fulfill contractual obligations; and maintain business and compliance records.	To Company service providers to assist in providing Company products and services
Commercial information	Registration to receive Company products and services and requests for information from Company in performing the Services	To enable Company to provide the Services, including to: process and manage purchases and subscriptions; maintain records of products and services requested or used; administer customer accounts; provide customer support; understand customer use of and interest in our Services; improve and develop our products and services; and communicate about relevant Company offerings.	To Company service providers to assist in providing Company products and services
Internet or other electronic network activity	Your browsing and search history on our website and other interactions with our website	To improve the visitor experience on our website, diagnose server problems, and administer our website	To third-party analytics services providers for the purpose of maintaining and enhancing our website
Professional or employment-related information	Registration to receive Company products and services and requests for information from Company in performing the Services	To enable Company to provide the Services including user account registration and management	To Company service providers to assist in providing Company products and services

California residents also have the rights described below. We will not discriminate against any California resident who exercises these rights.

Right to access/know your information. You may request from us a list of (i) the personal information that we have collected about you, and (ii) the categories of third parties to whom we have disclosed your personal information. You have the right to up to two (2) access requests each twelve (12) months.

If we deny your request, we will record the denial and provide you with a written notice explaining the reasons for the denial. This notice will be sent promptly and will include information on how you can challenge the decision if you believe it was made in error.

Right to delete your information. You may request, at any time, that we delete your information and direct our service providers to delete your information from their records. We are not required to delete any information that is necessary to provide our Services you have requested, to detect security incidents, or to comply with a legal obligation, among other limited exceptions.

You may contact us to exercise these rights at privacy@compliagence.ai. To ensure the privacy and protection of individuals, we are required to verify your identity (or that of your authorized agent) or otherwise authenticate your request(s), which we will do in accordance with the CCPA regulations. Please note that, under the CCPA, we are not required to grant a request to access/know or a request to delete with respect to personal information obtained from you in your role as an employee, owner, director, officer or contractor of a company and within the context of Company providing its services to such company.

International Processing and Transfers

Company is a U.S.-based company and may process personal data in the United States and other countries where our service provider operates. Those countries may have data protection laws that differ from the laws of your country.

Where applicable law restricts international transfers of personal data, we use a recognized transfer mechanism. These mechanisms may include an adequacy decision, the European Commission’s Standard Contractual Clauses, the United Kingdom International Data Transfer Agreement or UK Addendum, or another legally recognized safeguard. Where required, we conduct transfer-risk assessments and implement supplementary contractual, technical, or organizational measures.

When we process Customer Data on behalf of a customer, the international-transfer mechanism applicable to that processing is addressed in our agreement with the customer.

You may contact us using the information below to request additional information about the safeguards applicable to your personal data. We may provide copies of relevant provisions of our customer agreements subject to appropriate redactions.

How We Protect Your Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal data transmitted to, through, using, or in connection with the Services. In particular, email, texts, and chats sent to or from the Services may not be secure, and you should carefully decide what information you send to us via such communications channels. Any transmission of personal data is at your own risk.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data against unauthorized use, disclosure, and access. If you believe your account has been compromised contact us at [privacy@compliagence.ai to request an account lock out or reset.

How We Retain Your Personal Data

We keep the categories of personal data described in this policy for as long as reasonably necessary to fulfill the purposes described or for as otherwise legally permitted or required, such as maintaining the Services, operating our organization, complying with our legal obligations, resolving disputes, and for safety, security, and fraud prevention. This means that we consider our legal and business obligations, potential risks of harm, and nature of the information when deciding how long to retain personal data. At the end of the retention period, personal data will be deleted, destroyed, or deidentified.

Changes to Our Privacy Policy

We may update this policy from time to time, and we will provide notice of any such changes to the policy as required by law. The date the privacy policy was last updated is identified at the top of the page. We will notify you of changes to this policy by updating the “last updated” date and posting the updated policy on the Services. We may email or otherwise communicate reminders about this policy, but you should check our Services periodically to see the current policy and any changes we have made to it.

Contact Information

To exercise your rights or ask questions or comment about this privacy policy or our privacy practices, contact us at: privacy@compliagence.ai.