Your data
You work in security and compliance, so you’ll want to know where a document goes before you upload it. Here is the short version, with the section of our Privacy Policy behind each point.
The short version
- Nothing you submit trains an AI model. Answers come from Anthropic’s Claude models through Anthropic’s commercial API. By Anthropic’s published policy for commercial customers, API inputs and outputs are not used to train its models, and we have not opted in to anything that would change that (Privacy Policy 5.2).
- We don't keep your questions or documents. Your question and any file are sent to the AI model to produce the answer, then returned to you. We don’t store the content afterwards beyond what is briefly needed to process the request (Privacy Policy 9). Anthropic deletes API inputs and outputs within 30 days by default. The one exception: if Anthropic’s automated safety systems flag a request as a possible breach of its Usage Policy, Anthropic may keep it for up to 2 years (Privacy Policy 5.3).
- Only what's needed goes to the AI model. The model receives your question, the standard you picked and your file’s content. Never your email address, payment details or device data (Privacy Policy 5.1).
- Encrypted in transit, locked down at rest. Every connection uses HTTPS/TLS. Our database uses row-level security, so an account can only read its own records. Paid accounts must use multi-factor authentication (Privacy Policy 10).
Before you upload
Remove what the question doesn’t need: client names, people’s names and contact details, account numbers and anything else personal or confidential. A policy reviewed against PCI DSS or ISO 27001 reads the same with “[Client]” in place of the client’s name. You decide what you submit (Privacy Policy 3.2).
What we keep, and for how long
| What | How long |
|---|---|
| Your questions and uploaded documents | Not stored by us after the answer is returned. Anthropic: up to 30 days by default (up to 2 years if its safety systems flag a request). |
| Account details (email, plan, chosen standards) | While the account is active, then 24 months after it closes (billing and legal records). |
| Usage records (which standard, tokens, cost; not the content) | Same as account details. |
| Free question on the homepage | We don't keep the question or answer. A keyed hash of your IP address is kept 25 hours for the one-a-day limit. |
| Website visits | Counted in aggregate, without cookies or IP addresses. |
Full detail: Privacy Policy 3 and 9.
Who processes it, and where
| Provider | Role | Location |
|---|---|---|
| Anthropic | AI model that writes the answers | United States |
| Supabase | Database and sign-in | United States (East US, Ohio) |
| Vercel | Website and app hosting | United States |
| Resend | Sign-in and account emails | United States |
| Google Workspace | Our business email and forms | United States and other Google regions |
Each works under a data processing agreement with us (Privacy Policy 6.1). Payments are handled by Paddle, our merchant of record, as an independent controller; we never see your full card number (Privacy Policy 6.3).
Documents for your due diligence
- Privacy Policy: the full detail behind this page.
- Data Processing Agreement: request a copy by email, or read it before you sign up.
- Terms of Service: Section 11 covers the confidentiality of your data.
Questions about how we handle data: support@compliancecolleague.ai.
This page summarises our Privacy Policy and is not a contract; where they differ, the Privacy Policy applies. Last reviewed 13 October 2026.