Privacy notice

Effective 5 September 2026.

ComplianceSME operates compliancesme.com and is the controller of the personal data described in this notice. Write to us at toolkit@compliancesme.com, or through the contact page, including for any request about your rights.

When you visit the site. We count visits in totals only. No visitor is identified. Basis: our legitimate interest in knowing how the site is used.

When you use a free tool. The free assessment stores nothing unless you ask for your report by email, when we keep your email address and the obligation list. If you ask the EU AI Act checker to email you your duty card, we keep your email address, the result and the date, we send you the card, and we follow up once about the EU AI Act compliance system. You gave us the address in the course of your interest in what we sell, we told you at the time that we would follow up, and every message carries a way to opt out. Basis: consent for the emailed report, which you may withdraw at any time; legitimate interest for the card and the follow up.

When you open an account. We hold your email address, your business name, your assessment results, and a record of what you have bought and downloaded. We hold no passwords. You receive purchase confirmations, the files you have bought, and notice when a regulation behind a system you own changes. Basis: the contract between us.

When you buy. Your card details go to our payment processor and never reach our systems. We keep the purchase record and any membership record. Where a discount code or an introducer is involved, we record which one brought the sale. Basis: the contract between us, and our legitimate interest in running offers honestly and paying those who introduce customers.

When you connect your account to Claude. Connecting shares your account email address with us and nothing else. We keep a record of the sections you open and when, so that you can resume where you stopped. If you run the applicability assessment in Claude, we save the result and the business facts you gave for it. What you type to Claude is handled by Anthropic under its own privacy policy. We neither see it nor keep it. Removing the connector ends the connection. Basis: the contract between us.

When you use our panel in your Stripe Dashboard. The panel reads the business facts your Stripe account already holds, such as country, legal form, trade category and tax registrations, and shows which obligations such a business carries. It reads no payments, customers, payouts or card details, changes nothing on your Stripe account, and stores nothing about your business. If you link the panel to a ComplianceSME account, we keep your Stripe account reference and the date. Stripe is the controller for the data its own service holds about you. Uninstalling the app stops the panel. Basis: steps you asked us to take before entering a contract, and our legitimate interest in answering a business that asks what applies to it.

When you write to us. A message sent through the contact page, the press page or the report a problem form reaches our support mailbox and we keep the correspondence. Basis: our legitimate interest in answering correspondence.

Work you do in a system that runs in a dedicated Claude account stays in that conversation. We hold no copy. Our assessments are produced by rules, with no person reviewing each result, and you may ask us to look at any result by hand.

We do not sell your data and we do not share it for anyone else's marketing. We use a payment processor, an email delivery provider, a hosting provider, a provider of the verification box on our forms, and Anthropic where you use the connector. They process data on our instructions, except the payment processor and Anthropic, which are controllers in their own right for their own part. Anyone else receives your data only where the law requires it. We do not use your compliance work or your answers to train any AI model.

Some of these providers process data in the United States, so personal data is transferred outside the United Kingdom and the European Economic Area. Each transfer is made under the standard contractual clauses with the United Kingdom addendum.

Account and purchase records are kept while your account is active, then for as long as tax and consumer law require. Correspondence is kept for two years. A report or duty card requested by someone who never opens an account is deleted after one year. Server logs, which include IP addresses, are kept briefly for security. Ask us and we delete your account, and everything linked to it, within a month.

You have the right to see the data we hold about you, to have it corrected or erased, to receive it in a portable form, to restrict what we do with it, to object to processing based on legitimate interests, and to withdraw consent where consent is the basis. Write to us and we answer within one month.

One cookie is set, when you sign in, and it keeps you signed in for thirty days. It is strictly necessary, so it needs no consent. We set no analytics or advertising cookies and we do not track you across other websites. Our payment processor sets its own cookies at checkout, and the verification box on our forms may set one. The cookies page lists everything this site sets.

We send business to business email about EU and UK compliance to corporate addresses that are published or listed in business directories. Basis: our legitimate interest in reaching the businesses that carry those obligations. Every message carries a way to opt out, and one instruction is enough. Files and service notices that come with a purchase or a membership are not marketing.

What we sell is sold to businesses. This site is not directed at children and we do not knowingly collect personal data about anyone under 18.

If you are unhappy with how we handle your data, tell us and we will try to put it right. You may also complain to the Information Commissioner's Office at ico.org.uk.

The effective date at the top tells you which version you are reading. Where a change affects how we handle data you have already given us, we will tell account holders by email before it takes effect.