This document is pending review by legal counsel and may change. If you need a signed version or have questions, email support@compliancegrid.ai.
This policy explains how ComplianceGrid ("we") handles personal data when you use our website, developer dashboard and APIs. Where you send us personal data about other people through the API (for example the names of parties you screen), we act as your processor; see the Data Processing Addendum.
What we collect
- Account data. Name, email address, organization and sign-in method, collected through our authentication provider (Clerk) when you register or sign in with email, Google or Apple.
- Billing data. Billing contact and usage totals. Card details are handled by Stripe and are not stored by us.
- API usage data. Which endpoints you call, when, from which key, response status and timing. We also keep request and response bodies for troubleshooting and security. Date of birth, SSN digits, passport and national ID numbers, and credentials are redacted before bodies are stored.
- Screening records. For production API calls, the subject name, country, result, list version and any reviewer decision you record, so you can retrieve past screenings. The stored request has personal identifiers redacted.
- Messages. What you send through sales and support forms.
- Cookies. Essential session cookies set by our authentication provider. We do not use advertising cookies.
How we use it
- To provide, secure and bill for the service, and to answer support requests.
- To detect abuse and diagnose problems.
- To meet legal obligations.
We do not sell personal data, and we do not use API request data to train models.
AI processing
Some features use a third-party language model (Anthropic). Date of birth, SSN digits, passport and national ID numbers are never sent to them. You can switch AI off per request (aiMode: "off") or for your whole account. See subprocessors for what the provider receives and how long it may keep it.
Who receives data
Our subprocessors are listed on the subprocessors page. We also disclose data when required by law. Some lookups send search terms (such as a company name) to public data services, as listed on that page.
Where data is stored
Data is hosted in the United States (Microsoft Azure; East US and Central US). If you access the service from outside the United States, your data is transferred to and processed in the United States.
Retention
- Account and billing records are kept while your account is open and as long as the law requires afterwards.
- Screening records are kept until you ask us to delete them or your account is closed.
- Request logs are kept for operational and security purposes. We are defining a fixed retention period and will publish it here.
Your choices and rights
You can ask to access, correct, export or delete your personal data, or object to some processing, by emailing support@compliancegrid.ai. Depending on where you live, you may also have the right to complain to a data protection authority. If you sent us personal data about other people, direct requests from those people to the customer who submitted it; we will help that customer respond.
Security
See our security page for what we do to protect data and how to report a vulnerability.
Children
The service is for businesses and is not directed to children under 16.
Changes
We will post changes on this page and update the date above.