Terms of Service

Compliance Colleague

Last Updated: September 22, 2026

1. Acceptance of Terms

These Terms of Service (“Terms”) form a binding agreement between you (“you” or “User”) and Compliance Colleague Limited Liability Company, an Arizona limited liability company doing business as “Compliance Colleague” (“Company,” “we,” “us,” or “our”), governing your access to and use of the Compliance Colleague website, application, and related services (collectively, the “Service”). By creating an account, subscribing to a plan, or otherwise accessing or using the Service, you agree to be bound by these Terms and by our Privacy Policy, which is incorporated by reference. If you do not agree, do not access or use the Service.

You may use the Service only if you are at least 18 years old (or the age of legal majority in your jurisdiction) and capable of forming a binding contract. The Service is intended for business and professional use and is not directed to consumers.

2. Description of the Service

Compliance Colleague is a chat-based software tool that uses artificial intelligence (including large language models) to help users research, study, and ask questions about information security compliance frameworks and standards (such as PCI DSS, ISO/IEC 27001, GDPR, and other standards made available in the Service from time to time). Features may include standard-specific question-and-answer, side-by-side comparison between two standards, and AI-assisted review of user-uploaded documents against a selected standard.

The Service, the standards it covers, and its features may change, be added to, or be removed at any time in our sole discretion, with or without notice, except as otherwise required by law.

3. Not Professional Advice; Reference and Research Use Only

This section limits our liability and describes important limits on what the Service is for. Please read it carefully. It applies regardless of who is using the Service or why, including use by credentialed professionals in the course of their work.

3.1 Reference and research tool only

The Service is a reference and research tool only. It is designed to help you study, explore, organize, and think through compliance concepts, and — for professional users — to serve as a productivity aid in your own work. Regardless of how the Service is used, including where it is used by a credentialed professional to help prepare for, plan, or carry out real-world work, the Service is not, and is not intended to be, a substitute for the professional judgment, independent work, and prescribed qualifications and experience of a qualified information security, privacy, legal, audit, compliance, or artificial intelligence governance professional. This includes, without limitation, anyone with the credentials required to conduct an information security audit, an AI audit or AI governance assessment, a compliance or security assessment, a gap analysis, or to provide trusted advisor or consulting feedback (each, a “Professional Engagement”).

3.2 No professional relationship

Your use of the Service does not create an attorney-client, auditor-client, advisory, consulting, or other professional services relationship between you and the Company or any of its personnel.

3.3 AI limitations

Responses are generated using artificial intelligence and may be incomplete, outdated, generalized, or simply incorrect. AI-generated output can misstate requirements, omit exceptions, misapply a standard to your specific facts, hallucinate a citation or requirement that does not exist, or reflect information that has since changed. You are solely responsible for independently verifying any output before relying on it, in a Professional Engagement or otherwise.

3.4 Does not satisfy assessment or certification requirements

Use of the Service does not satisfy, replace, or substitute for any requirement — regulatory, contractual, or otherwise — to engage a qualified assessor, auditor, attorney, or other credentialed professional, including any requirement to complete a formal assessment, audit, certification, or attestation (such as a PCI DSS Report on Compliance, an ISO/IEC 27001 certification audit, an AI governance or algorithmic-impact assessment, or a legal compliance opinion). Service output does not itself constitute, and must not be represented to any person as, a completed information security audit, AI audit, assessment, gap analysis, certification, attestation, opinion, or other professional deliverable.

3.5 Your responsibility

You are solely responsible for all decisions and actions you take (or do not take) based on your use of the Service, including any compliance, security, legal, audit, business, or risk-management decisions. Before making any such decision, you should consult a qualified professional licensed or credentialed in the relevant jurisdiction and field.

3.6 Use by qualified professionals in a Professional Engagement

We expect that many Authorized Users are themselves credentialed professionals who may use the Service to help them work faster — for example, while preparing for, planning, or conducting an audit, assessment, or gap analysis for a client or employer. If you use the Service in connection with a Professional Engagement, you acknowledge and agree that: (a) you, and not the Company, remain solely and fully responsible for that Professional Engagement and for satisfying any professional, licensing, certification, independence, due-care, or quality-control standard that applies to you; (b) Service output is one input among others that you must independently verify, corroborate, and apply your own professional judgment to before using it in any Professional Engagement; and (c) you will not state or imply to any client, employer, regulator, or other third party that the Company or the Service performed, conducted, reviewed, or certified any part of a Professional Engagement.

3.7 No reliance by third parties

The Service is provided to you, the Authorized User, only. No client, employer, regulator, auditor, investor, or other third party is entitled to rely on the Service or any output from it, and the Company owes no duty of care to any such third party. If you use Service output in connection with work you provide to a third party, you do so entirely at your own risk and remain solely responsible for that work and for that third party's reliance on it.

4. Eligibility; Accounts

4.1 Accurate information

You must provide accurate, current, and complete information when creating an account and must keep that information up to date.

4.2 One account per individual

Each account is issued to, and intended for use by, a single named individual (the “Authorized User”). Accounts may not be created for, or used on behalf of, a group, team, or multiple individuals, except under a separate Team/Organization agreement with the Company, where offered.

5. Account Security; Prohibition on Credential Sharing; Multi-Factor Authentication

5.1 Single-user license

Your subscription is a personal, non-transferable license to use the Service, limited to the Authorized User identified on the account. You may not share, lease, rent, sell, sublicense, or otherwise make your account, login credentials, session tokens, or access available to any other person, whether inside or outside your organization.

5.2 No shared logins

Logging in from a shared or generic login, or allowing coworkers, clients, contractors, or any other individual to use your credentials to access the Service (including to informally “split” the cost of a single subscription across multiple people), is a material breach of these Terms, regardless of intent.

5.3 Multi-factor authentication required

As a condition of continued access, Authorized Users are required to enroll in and use multi-factor authentication (“MFA”) on their account. We may restrict or suspend access for accounts that have not completed MFA enrollment within a reasonable grace period after being prompted to do so.

5.4 Session and device monitoring

We use technical safeguards — including MFA and monitoring of simultaneous active sessions from materially different devices, locations, or network addresses — to help detect and deter unauthorized account sharing. Where our monitoring indicates a pattern consistent with credential sharing or unauthorized multi-user access, we may, in our discretion and without liability to you: (a) flag the account for review; (b) require re-authentication or additional identity verification; (c) limit or terminate concurrent sessions; or (d) suspend or terminate the account.

5.5 Your responsibility for your credentials

You are responsible for maintaining the confidentiality of your login credentials and MFA device or method, and for all activity that occurs under your account, whether or not you authorized it. Notify us immediately at support@compliancecolleague.ai if you suspect unauthorized access to your account.

5.6 Team or multi-seat access

If you need multiple individuals within your organization to access the Service, contact us about a Team/Organization plan. Using a single individual subscription to provide access to multiple people is not permitted under any circumstances.

6. Subscription Plans; Billing; Payment

6.1 Plans

The Service is offered under subscription plans described on our pricing page, which may include a monthly allowance of usage and additional usage billed at the rate described at checkout. Plan features, allowances, and pricing may change prospectively upon notice.

6.2 Billing

Subscriptions are billed in advance, quarterly or annually as selected at checkout, through our reseller and merchant of record, Paddle.com Market Limited (“Paddle”). By subscribing, you authorize recurring charges to your chosen payment method at the start of each billing period until you cancel.

6.3 Overage / additional usage

If your plan includes optional additional usage beyond your monthly allowance, that usage is only charged if you have affirmatively opted in, at the rate disclosed to you before you opt in.

6.4 Taxes

Fees are exclusive of applicable taxes, which Paddle, as merchant of record, may collect and remit as required by law.

6.5 Refunds

You may request a full refund of any payment within fourteen (14) days of the date of that payment, whether it is your first payment or a renewal, and for any reason, by contacting us at support@compliancecolleague.ai or contacting Paddle. When a payment is refunded, access to the Service for the period it paid for ends. A payment for which no refund is requested within fourteen (14) days is non-refundable.

6.6 Cancellation

You may cancel your subscription at any time through your account settings. Cancellation is effective at the end of the then-current billing period, and you will retain access through that date.

6.7 Failed payment

If a payment fails, or your subscription status changes to past due, canceled, or paused, we may restrict or suspend your access to the Service until the issue is resolved.

7. Acceptable Use

You agree not to:

8. User Content and Uploaded Documents

8.1 Your content

You retain ownership of any documents, text, or other content you submit or upload to the Service (“User Content”). You grant us a limited license to process, store, and transmit User Content solely to provide and improve the Service to you, including sending it to our third-party AI model provider as described in our Privacy Policy.

8.2 Sensitive information

Do not upload User Content containing information you are not authorized to share (for example, another party's confidential information without permission) or unnecessary sensitive personal data (such as full payment card numbers, government identification numbers, or health information) — the Service is not designed, certified, or intended to store such data.

8.3 No warranty on AI review of User Content

Any AI-assisted “verdict,” summary, or assessment of your uploaded documents is provided for informational purposes only and is subject to the disclaimers in Section 3.

9. Intellectual Property

The Service — including its software, design, text, and the compiled reference materials used to ground responses, but excluding User Content and excluding the underlying published text of third-party standards, which remains the property of their respective standard-setting bodies — is owned by the Company or its licensors and is protected by intellectual property laws. We grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Service for your own internal business purposes in accordance with these Terms.

10. Third-Party Services; Service Availability

10.1 Providers we rely on

The Service relies on third-party providers, including Anthropic (AI model provider), Supabase (database and authentication), and Paddle (payments and merchant of record). Your use of the Service is also subject to the applicable terms of those providers where they apply to you. We are not responsible for the acts, omissions, or downtime of third-party providers. The Service depends on those providers, and an act, omission, failure, degradation, suspension, price change, or withdrawal of service by any of them is outside our control and is not a breach of these Terms by us.

10.2 No service level commitment

We do not offer a service level agreement. The Service carries no uptime target, availability percentage, performance level, response time, restoration time, maintenance window, or support response commitment, and nothing in these Terms, on our website, in our documentation, in our marketing, or in any other communication from us or from anyone acting for us creates one. The Service is supplied on an “as available” basis as stated in Section 12.

We may suspend, limit, degrade, or interrupt all or any part of the Service at any time — including for maintenance, upgrades, migration, security, abuse prevention, capacity management, cost management, or the failure, change, or withdrawal of a third-party provider — and we may do so without advance notice. We will give notice of a planned interruption where it is practical to do so, but giving it on one occasion does not oblige us to give it on another.

Where we work to prevent, shorten, or recover from an interruption, we do so as a matter of our own operational judgement. That effort is voluntary. It does not create a standard we are required to meet, is not a course of dealing or usage of trade, and does not entitle you to any service credit, refund, extension or renewal of a subscription period, discount, or other compensation, beyond the refund available under Section 6.5. To the maximum extent permitted by law, your sole and exclusive remedy if the Service is not available when you want it, or does not otherwise meet your requirements, is to stop using it and cancel under Section 15.

Nothing in this Section 10.2 limits any right you have under a law that cannot be waived by contract, including the consumer law of your own country. Section 13 governs our liability in all cases.

11. Confidentiality of Your Data

We do not use your User Content to train AI models. The Service uses Anthropic's commercial API to generate responses, and by Anthropic's own published policy for its commercial products (which include the Anthropic API): “By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.” We have not opted in to any Anthropic program that would change this. Anthropic's stated default policy is also to delete API inputs and outputs from its backend within 30 days of receipt or generation, subject to limited exceptions (such as an active Trust & Safety investigation). Our Privacy Policy (Section 5) describes this in more detail, including the specific Anthropic Privacy Center pages this statement is drawn from, and the two documents are intended to be read together.

12. Disclaimer of Warranties

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WITHOUT LIMITING THE FOREGOING, WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT ANY AI-GENERATED OUTPUT WILL BE ACCURATE, COMPLETE, OR SUITABLE FOR YOUR PARTICULAR COMPLIANCE, LEGAL, OR BUSINESS NEEDS.

WE FURTHER DO NOT WARRANT THAT THE SERVICE OR ANY OUTPUT FROM IT WILL RESULT IN A SUCCESSFUL AUDIT, ASSESSMENT, GAP ANALYSIS, CERTIFICATION, OR OTHER COMPLIANCE OUTCOME, OR THAT USE OF THE SERVICE WILL SATISFY ANY REGULATORY, CONTRACTUAL, OR PROFESSIONAL STANDARD OF CARE THAT APPLIES TO YOU — INCLUDING IN CONNECTION WITH ANY PROFESSIONAL ENGAGEMENT AS DEFINED IN SECTION 3.

13. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND REGARDLESS OF THE THEORY OF LIABILITY (WHETHER IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE), INCLUDING FOR ANY CLAIM ARISING FROM OR RELATING TO YOUR USE OF THE SERVICE IN CONNECTION WITH A PROFESSIONAL ENGAGEMENT: (A) THE COMPANY AND ITS OFFICERS, EMPLOYEES, AND SUPPLIERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, BUSINESS OPPORTUNITY, OR CLAIM BY A THIRD PARTY AGAINST YOU, ARISING OUT OF OR RELATED TO YOUR USE OF THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (B) THE COMPANY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF (I) THE AMOUNTS YOU PAID TO THE COMPANY FOR THE SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (II) ONE HUNDRED U.S. DOLLARS ($100).

Some jurisdictions do not allow certain limitations on liability, so some of the above limitations may not apply to you.

14. Indemnification

You agree to indemnify, defend, and hold harmless the Company and its officers, employees, and agents from any claims, damages, liabilities, and expenses (including reasonable attorneys' fees) arising out of: (a) your use of the Service in violation of these Terms; (b) any decision you make, or any work product or deliverable you produce or provide to any third party, in reliance on Service output without the independent professional verification contemplated in Section 3, including in connection with any Professional Engagement; (c) any representation by you to a client, employer, regulator, or other third party that the Company or the Service performed, conducted, reviewed, or certified any part of a Professional Engagement; or (d) your violation of any law or the rights of a third party.

15. Term; Termination

15.1 Term

These Terms remain in effect while you use the Service.

15.2 Termination by you

You may stop using the Service and cancel your subscription at any time as described in Section 6.

15.3 Termination by us

We may suspend or terminate your access, with or without notice, for breach of these Terms (including the account-sharing restrictions in Section 5), non-payment, suspected fraud or misuse, or if required by law.

15.4 Effect of termination

Upon termination, your right to access the Service ends immediately. Sections that by their nature should survive termination — including Sections 3, 5.5, 9, 12, 13, 14, 16, 17, and 18 — will survive.

16. Governing Law; Dispute Resolution

16.1 Governing law

These Terms are governed by the laws of the State of Arizona, without regard to conflict-of-laws principles.

16.2 Agreement to arbitrate

Except as set out in Section 16.5, you and the Company agree that any dispute, claim, or controversy arising out of or relating to these Terms or the Service will be resolved by binding, individual arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules (or, for accounts held by a business entity rather than an individual, its Commercial Arbitration Rules), rather than in court. The arbitrator, not any court, will have exclusive authority to resolve any dispute about the interpretation, applicability, enforceability, or formation of this arbitration agreement.

16.3 Class action waiver

Arbitration will be conducted on an individual basis only. You and the Company each agree not to bring or participate in any claim as a plaintiff or class member in any purported class, consolidated, or representative proceeding. If a court or arbitrator determines that this class action waiver is unenforceable as to a particular claim or request for relief, that claim or request (and only that one) will be decided by a court, and all other claims remain subject to arbitration.

16.4 Right to opt out

You may opt out of this arbitration agreement and class action waiver (Sections 16.2 and 16.3) by sending written notice to support@compliancecolleague.ai, or to the mailing address in Section 20, within 30 days of the date you first agree to these Terms. Your notice must include your name, account email address, and a clear statement that you opt out of arbitration. Opting out does not affect your agreement to any other part of these Terms, and does not affect any arbitration agreement you may have previously entered into with the Company.

16.5 Exceptions

16.6 Arbitration procedures and fees

The arbitration will be held in Pima County, Arizona, or another mutually agreed location, or may be conducted by phone, video, or on written submissions where permitted by AAA rules. The arbitrator may award the same individual relief a court could award, including injunctive relief, but only in favor of the individual party seeking relief. Each party will bear its own attorneys' fees and costs unless the arbitrator awards fees to the prevailing party under applicable law or the AAA's rules. For consumer accounts, the Company will pay any AAA filing fees in excess of the fee that party would have paid to file the claim in court, consistent with AAA Consumer Arbitration Rules.

16.7 Severability of this section

If any part of this Section 16 (other than the class action waiver in Section 16.3) is found unenforceable, the remainder of this Section 16 remains in effect. If the class action waiver in Section 16.3 is found unenforceable as to a claim seeking class-wide relief, the arbitration agreement as a whole will not apply to that specific claim, which may proceed in court; all other claims remain subject to arbitration.

17. Global Use; Availability; Export Compliance

Compliance Colleague is marketed and sold over the internet in English, and we expect Authorized Users located outside the United States — including in the European Economic Area, the United Kingdom, India, and Australia — regardless of where the Company is incorporated. This section addresses that reach directly rather than assuming a single country's law is the only one that matters.

17.1 Global availability; no jurisdiction-specific warranty

We make no representation that the Service, or any standard or content referenced within it, is appropriate, lawful, or available for use in every country or jurisdiction. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law, including any law governing the use of artificial intelligence tools, the cross-border handling of data, or professional practice in your jurisdiction.

17.2 English-language terms control

These Terms are drafted in English. Any translation we or a third party may provide for convenience is not authoritative, and the English-language version controls in the event of any conflict or inconsistency.

17.3 Data protection outside the United States

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with its own data protection law, our Privacy Policy describes how we handle personal data, including any cross-border transfer safeguards that apply. Nothing in these Terms limits any data protection right you have under a law that cannot be waived by contract.

17.4 Export control and sanctions

You may not access or use the Service if you are located in, or are a national or resident of, any country or region subject to comprehensive U.S. trade sanctions, or if you are listed on any U.S. government restricted- or denied-party list (including the U.S. Treasury's Specially Designated Nationals list). You represent that you are not subject to any such restriction and will not use the Service in violation of U.S. export control or sanctions law.

17.5 No guarantee of local regulatory sufficiency

Compliance standards, regulatory citations, and legal thresholds referenced in the Service reflect those frameworks as generally published; they may not reflect local variations, transpositions, or regulator guidance specific to your country. Section 3 applies fully to international use: the Service does not substitute for locally qualified professional advice.

18. Changes to These Terms

18.1 Changes generally

We may update these Terms from time to time — for example, to reflect changes to the Service, to our pricing or plans, or to applicable law.

18.2 Notice of material changes

If we make a material change to these Terms, we will give you at least fifteen (15) calendar days' advance notice before that change takes effect, by email to the address associated with your account, by a notice in the Service, or both. Section 18.6 sets out what is, and is not, a material change. A change that is not material takes effect when posted and may be made without advance notice. Section 18.7 describes the limited circumstances in which a material change may take effect on shorter notice.

18.3 Accepting, or declining, a change

If you continue to use the Service after a material change takes effect, you accept the revised Terms. If you do not wish to accept them, your remedy is to stop using the Service and cancel your subscription before the change takes effect. If you do, the Terms in effect when you last accepted them continue to govern your use through the end of the paid period you have already purchased, consistent with Section 15.

18.4 Changes are not retroactive

A change to these Terms applies only to conduct occurring, and claims arising, after that change takes effect. No change will apply retroactively to any dispute, claim, or controversy that arose, or of which either party gave notice, before the effective date of the change. In particular, no change to Section 16 (Governing Law; Dispute Resolution) will apply to a dispute of which either party gave notice before that change took effect.

18.5 Limits on this right

This Section 18 does not permit us to deprive you of the benefit of a paid period you have already purchased, to alter Section 16 as applied to a dispute that has already arisen, or to give you less notice of a particular change than Section 18.2 requires, other than as expressly permitted by Section 18.7. Changing the length of the notice period stated in Section 18.2 is itself a material change to these Terms: we may make it only on the full notice that Section 18.2 requires at the time we announce it, and a new period applies only to changes announced after it has taken effect. Our right to change these Terms is limited accordingly, and is exercised subject to the covenant of good faith and fair dealing implied in these Terms.

18.6 What is, and is not, a material change

A change is material if it would meaningfully reduce the rights you have, or meaningfully increase the obligations you owe, under these Terms. We will determine in good faith whether a change is material. Without limiting the foregoing, each of the following is a material change:

None of the following is a material change, and each may take effect when posted:

Changes to the Service itself — including its features, interface, workflow, and the way any part of it operates — are governed by Section 2 and are not changes to these Terms. This Section 18 applies only to changes to the text of these Terms. Nothing in this Section requires us to give advance notice before improving, correcting, or otherwise developing the Service.

18.7 Changes we may need to make with shorter notice

We will always seek to give the full fifteen (15) calendar days' notice described in Section 18.2. There are circumstances in which we cannot, and in each of the following a material change may take effect on shorter notice:

In any of those cases we will give you as much advance notice as is reasonably practicable in the circumstances, and we will tell you why the change could not wait. Your right to decline the change and exit under Section 18.3 applies in full, and the limits in Section 18.5 apply to a change made under this Section in the same way as to any other change. This Section does not permit us to shorten notice for a change made solely for our own commercial convenience.

19. Miscellaneous

19.1 Entire agreement

These Terms, together with our Privacy Policy, constitute the entire agreement between you and the Company regarding the Service.

19.2 Severability

If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect.

19.3 No waiver

Our failure to enforce any provision is not a waiver of that provision.

19.4 Assignment

You may not assign these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition, or sale of assets.

19.5 Force majeure

We are not liable for delays or failures caused by events beyond our reasonable control.

19.6 No third-party beneficiaries

These Terms are between you and the Company only. Nothing in these Terms creates any rights in any third party, including any client, employer, or end customer of yours, and no such third party may bring a claim under these Terms.

20. Contact

Questions about these Terms can be sent to support@compliancecolleague.ai or 6556 North Burro Creek Lane, Tucson, Arizona 85718.