Privacy Policy

1. Who is the data controller?

Tech brows AB (Org. no. 559434-1967) is the controller responsible for the processing described in this notice.

• Company: Tech brows AB
• Location: Stockholm, Sweden
• Contact: hello@compilo.ai

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, company name, job title
• Compliance Data: Documents, evidence, policies, and other compliance-related information you upload
• Communication Data: Messages, feedback, and support inquiries
• Payment Information: Billing details (processed by our payment provider)

2.2 Automatically Collected Information

• Usage Data: Pages viewed, features used, time spent, and interaction patterns
• Device Information: IP address, browser type, operating system
• Cookies: Essential and analytics cookies (see our Cookie Policy)

3. How We Use Your Information

We process your personal data for the following purposes:

• Service Provision: To provide, maintain, and improve our compliance platform
• Account Management: To create and manage your account, authenticate users, and provide customer support
• AI Processing: To generate compliance reports, analyze documents, and provide AI-driven insights
• Communication: To send service updates, security alerts, and respond to inquiries
• Analytics: To understand usage patterns and improve our services
• Legal Compliance: To comply with legal obligations and protect our rights

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our services
• Legitimate Interests (Art. 6(1)(f)): Improving our services, security, and fraud prevention
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws and regulations
• Consent (Art. 6(1)(a)): Marketing communications (where applicable)

5. Data Storage and Security

Your data is stored exclusively within the European Union on ISO 27001-aligned servers operated by Bahnhof in Stockholm, Sweden. We implement industry-standard security measures including:

• AES-256 encryption at rest and TLS 1.3 encryption in transit
• Multi-factor authentication and role-based access controls
• Regular security audits and penetration testing
• Automated backup and disaster recovery procedures
• Employee training on data protection and security

6. AI Processing

We never use your data to train AI models. All AI inputs and outputs are processed in real-time and are not retained after your session. Zero data retention — all processing logs are automatically purged.

7. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Service Providers: Cloud hosting, payment processing, and customer support (all EU-based or with adequate safeguards)
• Legal Requirements: When required by law, court order, or to protect our rights
• Business Transfers: In the event of a merger, acquisition, or sale of assets

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at hello@compilo.ai. We will respond within 30 days.

9. Data Retention

We retain your personal data only as long as necessary to provide our services and comply with legal obligations. Account data is retained for the duration of your subscription plus 30 days. After account closure, data is securely deleted within 90 days unless required by law.

10. International Transfers

Your data is processed exclusively within the European Union. In rare cases where transfers outside the EU are necessary, we ensure appropriate safeguards through Standard Contractual Clauses (SCCs) as approved by the European Commission.

11. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email or through our platform.

13. Contact Us

You also have the right to lodge a complaint with your local data protection authority. In Sweden, this is the Swedish Authority for Privacy Protection (IMY).