Legal
Privacy Policy
Effective Date: 28 May 2026
1. Introduction
Welcome to CompliOne ("we", "our", or "us"). CompliOne is a compliance management platform for Indian startups and small businesses, operated by CompliOne.
This Privacy Policy explains how we collect, use, store, share, and protect information about you when you use our website (complione.org) and platform (complione.org) (collectively, the "Service").
By using our Service, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account & Profile Information
- Full name
- Email address
- Phone number
- Password (stored encrypted, we never see your plain text password)
2.2 Company Information
- Company name, type, and industry
- State and date of incorporation
- Employee count and annual turnover
- Tax and labour registrations (GST, PF, ESI, TDS, Professional Tax, Shops & Establishment)
- Business activities (import/export, e-commerce, foreign investment, government contracts)
2.3 Team Member Information
- Name, email address, and phone number of invited team members
- Their role within your organisation on CompliOne
- Actions they perform within the platform (audit trail)
2.4 Payment Information
Payment is processed by our third-party payment processor. We do not store your full card details. We retain subscription plan, transaction IDs, payment status, and billing address.
2.5 Usage Data
- IP address and approximate location
- Browser type and device information
- Pages visited and features used
- Actions performed within the app
3. How We Use Your Information
- Create and manage your account
- Generate your personalised compliance calendar
- Send compliance deadline reminders, OTP codes, and account emails
- Process payments and manage your subscription
- Provide customer support
- Improve the Service and fix bugs
- Maintain security and prevent fraud
- Comply with legal obligations under Indian law
We do not use your data for advertising. We do not sell your personal information to third parties.
4. Legal Basis for Processing (DPDP Act 2023)
- Consent: You have given consent by creating an account
- Contract: Processing is necessary to provide the Service
- Legitimate Interests: To improve our Service and prevent fraud
- Legal Obligation: Where required by Indian law
5. How We Share Your Information
5.1 Supabase (Infrastructure & Database)
Your account data, company information, and audit trail are stored on Supabase servers. Supabase is SOC 2 Type II certified. View Supabase Privacy Policy
5.2 Resend (Email Delivery)
We use Resend to send transactional emails. Resend receives your email address for this purpose only. View Resend Privacy Policy
5.3 Payment Processor
Payment processing is handled by our payment gateway partner. You are subject to their privacy policy when making payments.
5.4 Other Disclosures
- With your explicit consent
- To comply with a legal obligation or court order
- To protect the rights or safety of CompliOne or our users
- In connection with a merger or acquisition (you will be notified in advance)
6. Data Storage & Security
- All data in transit is encrypted using TLS/HTTPS
- Passwords are hashed using industry-standard bcrypt encryption
- Database access is protected by Row Level Security (RLS)
- Session tokens expire automatically after inactivity
7. Data Retention
- Account and profile data: Deleted within 30 days of account deletion request
- Audit trail events: Retained for 7 years (Indian financial record-keeping requirements)
- Payment records: Retained for 8 years (Indian tax law)
- Deleted team member data: Removed within 30 days
8. Your Rights
- Access: Request a copy of your personal data
- Correction: Update your name and phone from your Profile page
- Erasure: Request deletion of your account and data
- Portability: Export your data from the Reports section (CSV/JSON)
- Withdraw Consent: Request account deletion at any time by contacting us; self-service deletion will be available in a future update
- Nomination: Nominate someone to exercise your rights (DPDP Act 2023)
9. Cookies & Local Storage
CompliOne uses browser local storage (not cookies) to store your session token, app preferences, and cached data. We do not use third-party tracking cookies or advertising pixels.
10. Children's Privacy
CompliOne is not directed at individuals under the age of 18. We do not knowingly collect data from minors.
11. Changes to This Policy
We will notify you of material changes via email and an in-app notice, and update the effective date above.
12. Grievance Officer
In accordance with the DPDP Act 2023: