Privacy Policy

01 About this policy

This Privacy Policy describes how CompEye Pty Ltd (ACN [pending], "CompEye", "we", "our", or "us") collects, uses, discloses, and protects personal information when you visit compeye.com.au or use our compliance-copilot service (the "Service").

CompEye is an Australian entity. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where you are in the European Union, United Kingdom, or other jurisdiction with applicable data-protection law, we also comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent regimes.

02 What we collect

2.1 Information you give us

• Email address — provided at signup to verify your identity via a magic link.
• Account preferences — including the jurisdiction you select if you choose the Single-jurisdiction tier.
• Question text — the compliance questions you submit through the Service.
• Billing information — collected by our payments processor, Stripe, Inc. We never see or store full card numbers; we only receive a customer reference and subscription status.
• Support correspondence — emails you send us at contact@compeye.com.au.

2.2 Information we generate automatically

• API key — generated for you at signup. We store only its SHA-256 hash, not the key itself; we cannot retrieve a lost key on your behalf.
• Generated responses — the synthesised answer the Service returns, retained against your account.
• Watermark identifier — a unique query ID encoded as invisible Unicode characters in each response. See §9.
• Usage records — query timestamps, latency, confidence level, and which tier you were on at the time.

2.3 Information collected from your device

• IP address — logged at signup and at the time of each query.
• User-Agent string — sent by your browser, logged with each query.
• Composite browser fingerprint — a SHA-256 hash derived from your User-Agent, accept-language, timezone, screen resolution, platform, and language. Used only for free-tier abuse prevention (preventing the same browser from creating multiple free accounts). We do not use this for advertising or analytics.

2.4 Information we do NOT collect

• We do not store your full payment card details — that is Stripe's role.
• We do not use third-party analytics (Google Analytics, Mixpanel, Segment, etc.).
• We do not use third-party advertising trackers.
• We do not sell or rent your personal information to any third party.
• We do not permit our AI sub-processors to train their models on your data — see §4.

03 Why we use it

We process your personal information for the purposes set out below. Where the GDPR or UK GDPR applies, the lawful basis is identified.

Purpose	Data used	Lawful basis (EU/UK)
Account creation & auth	Email, API key hash	Performance of a contract
Service delivery (answering queries)	Question text, account tier	Performance of a contract
Billing & subscription management	Email, Stripe customer ref	Performance of a contract
Abuse prevention (free-tier signup throttle)	IP address, browser fingerprint	Legitimate interests (Art. 6(1)(f))
Audit logging & piracy tracing	Query record, watermark ID, IP, UA	Legitimate interests + legal obligation
Service security & integrity	IP, UA, magic-link metadata	Legitimate interests
Transactional emails	Email	Performance of a contract
Service improvement (aggregate analysis)	Anonymised usage patterns	Legitimate interests

We do not use your data for direct marketing without your prior consent. Where we rely on legitimate interests, you have the right to object — see §7.

04 Sharing & sub-processors

We use a small set of sub-processors to deliver the Service. Each is contractually bound to maintain confidentiality and to process data only on our instructions.

Sub-processor	Role	Data sent	Location
Anthropic, PBC	AI synthesis (Claude)	Question text + retrieved regulator excerpts	United States
Voyage AI, Inc.	Query embeddings	Question text only	United States
Stripe, Inc.	Payments & tax	Email, billing address, payment method	United States / Australia
Resend, Inc. (when configured)	Transactional email delivery	Email, magic-link URL	United States
Hosting provider	Application + database hosting	All data we hold	To be confirmed at deployment

Anthropic and Voyage AI's data-use commitments. Anthropic and Voyage AI both contractually commit not to train their models on API-submitted content. Anthropic retains submissions for up to 30 days for safety/abuse review and then deletes them, unless we opt out of trust-and-safety logging (which we currently have not).

We may also disclose personal information:

• where required by law, court order, or a binding regulatory request;
• to defend or enforce our legal rights;
• to a successor entity in connection with a merger, acquisition, or asset transfer — with notice to you;
• to professional advisers (auditors, lawyers, accountants) under confidentiality.

05 International transfers

Most of our sub-processors are in the United States. For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on:

• the European Commission's Standard Contractual Clauses (SCCs) 2021/914, or
• the EU-US Data Privacy Framework where the sub-processor is certified.

For Australian users, cross-border disclosure is consistent with APP 8: we take reasonable steps to ensure overseas recipients are bound to similar standards.

06 Retention

Data category	Retention period
Account record (email, hashed API key, tier)	While your account is active, plus 7 years after closure for regulatory/audit purposes
Query audit log (question + response refs + watermark)	Indefinite — required for piracy tracing and to honour the audit-grade promise we make to customers
Conversation history (your chat threads)	While your account is active — deleted on account deletion request, except where retained per the audit log
Billing records (invoices, payment status)	7 years — Australian Tax Office record-keeping requirements
Magic-link tokens	15 minutes (single-use; deleted on consumption or expiry)
Signup-attempt log (IP, fingerprint, outcome)	180 days for abuse-pattern detection
Server logs	30 days unless required for an active security investigation

07 Your rights

Subject to certain conditions, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion ("right to be forgotten" under GDPR; "right to delete" under CCPA where applicable). Note that audit log records associated with a watermarked response may be retained where their deletion would compromise the integrity of our piracy-tracing obligations to other customers.
• Restrict or object to processing based on legitimate interests.
• Data portability — receive your personal information in a structured, commonly-used format.
• Withdraw consent, where processing is based on consent (e.g., marketing).
• Lodge a complaint with a supervisory authority — see §13.

To exercise any of these rights, email privacy@compeye.com.au. We will respond within 30 days (GDPR) or a reasonable period (Australian Privacy Act).

08 Security

We take reasonable steps to protect personal information, including:

• Hashed credentials. API keys are stored as SHA-256 hashes only. Magic-link tokens are also stored as hashes.
• TLS in transit. All traffic between your browser and our servers is encrypted.
• Encryption at rest. Production databases are encrypted at the storage layer.
• Principle of least privilege. Only authorised personnel have administrative access.
• Webhook-signature verification for all incoming Stripe events.
• Watermarking of every generated response (see §9) for forensic recovery if content is leaked.

No method of transmission or storage is 100% secure. We will notify affected users and relevant regulators of any eligible data breach in accordance with the Notifiable Data Breaches scheme (Privacy Act 1988, Part IIIC) and Article 33 GDPR.

09 Watermarking & piracy tracing

Each response generated by the Service includes a watermark: a unique 32-bit identifier encoded as invisible Unicode characters (U+200B, U+200C, U+200D, U+2060) distributed across the response prose. This identifier is mapped server-side to:

• your user account;
• the question you asked;
• the IP address you used;
• the user agent of your browser; and
• the timestamp of the request.

The watermark cannot be detected by humans reading the response. It survives most copy-and-paste flows. The purpose is to deter unauthorised redistribution of our content and to enable us to identify the source of any leaked excerpts.

The watermark is not used for tracking your activity within other websites or for behavioural advertising.

10 Cookies & local storage

We do not use third-party analytics or advertising cookies. The Service stores the following in your browser's localStorage for functional purposes:

• Your API key (so you stay signed in across page reloads).
• The ID of the conversation you are currently viewing.
• Any pending payment intent (so an interrupted checkout can resume).

You may clear this at any time via your browser settings or by using the "Sign out" button.

11 Children

The Service is intended for use by adults in a professional capacity. We do not knowingly collect personal information from anyone under 18 years of age. If you believe a minor has provided us with personal information, please contact us and we will delete it.

12 Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Where the change is material, we will notify active users by email or in-app banner at least 14 days before it takes effect.

13 Contact & complaints

If you have a question or concern about your privacy:

• Email privacy@compeye.com.au
• Write to: CompEye Pty Ltd, [postal address pending]

If we are unable to resolve your concern, you may also lodge a complaint with the relevant supervisory authority:

• Australia — Office of the Australian Information Commissioner (OAIC): oaic.gov.au
• European Union — your local Data Protection Authority. A list is available at the European Data Protection Board: edpb.europa.eu
• United Kingdom — Information Commissioner's Office (ICO): ico.org.uk
• California, USA — California Privacy Protection Agency (CPPA): cppa.ca.gov