Privacy Policy

Seller legal business name: incompli. incompli is the provider of this service. As data controller, incompli is responsible for account, billing, website, support and sales data.

As processor, incompli processes customer content (AI system records, test prompts and responses, findings, risk registers, assessments, model cards and evidence) only on your organisation's documented instructions. Your organisation is the controller of that data.

• Account data: name, work email, organisation, role, and sign-in records.
• Organisation profile: company size, compliance focus, and corporate billing details.
• Customer content: AI system metadata, model connection settings, test results, findings, guardrails, governance assessments, approvals and audit trail entries.
• Model credentials: API keys you provide for your models, stored encrypted (see Security).
• Support data: service requests, chat messages and assistant conversations.
• Payment data: handled by our merchant of record; we receive invoice and subscription status, never full card numbers.
• Technical data: IP address, browser type and essential session storage needed to run the service securely.

• To provide the platform and run the tests you start — performance of contract.
• To create and administer accounts and organisation profiles — performance of contract.
• To store model connection settings, encrypted credentials and governance evidence on your instructions — performance of contract.
• To secure accounts, prevent abuse and keep an audit trail — legitimate interests and legal obligation.
• To bill subscriptions and issue invoices — contract and legal obligation.
• To answer support and sales requests — contract or legitimate interests.
• To process technical data and sign-in records for reliable operation and fraud prevention — legitimate interests in maintaining a secure service.
• To send service and account emails — contract. Marketing emails only with consent, with an opt-out in every message.
• Optional preference and analytics storage — consent, which you can withdraw at any time.

• No model training: we do not use your customer content, test prompts or model outputs to train AI models.
• Testing on your instruction: test probes are sent only to the model endpoints you connect, when you or your team start a run.
• Your model provider: traffic between our testing engine and your model is also subject to your agreement with that provider.
• Sales and support assistant: answers come from predefined product FAQs, not a language model. Questions are not sent to an AI provider. Conversations shared through a service request or live-agent handoff are available to our support team; avoid entering sensitive personal data in chat.

We do not sell personal data or share it for cross-context behavioural advertising. We share data only with:

• Cloud hosting, database and authentication infrastructure providers.
• Our testing engine hosting provider.
• Paddle.com, our Merchant of Record (online reseller), for the sale of the product, subscription management, payments, tax compliance and invoicing. We share relevant customer and billing information with Paddle for these purposes. Paddle handles payment information under its own privacy notice.
• Email delivery providers, for account and service emails.
• Professional advisers, including legal and accounting advisers, where necessary.
• Authorities, where required by law.

A current sub-processor list is available on request and is included in our Data Processing Addendum.

Data may be processed outside your country. Where required we rely on adequacy decisions, the EU Standard Contractual Clauses, the UK Addendum, or the transfer mechanisms permitted under the PDPL and UAE law, together with supplementary security measures.

• Customer model API keys are encrypted with AES-256-GCM and are never sent to browsers.
• Organisation data is isolated per tenant, with role-based access enforced on the server.
• Data is encrypted in transit with TLS and at rest by our infrastructure providers.
• Evidence and audit records can be locked for audit to prevent alteration.

We keep account and customer content for the life of your subscription. After termination, customer content is deleted or returned within 90 days unless law requires longer retention. Invoices and tax records are kept for the period required by law.

Depending on where you live, you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent. California residents may also request to know and delete, and will not be discriminated against for doing so.

For customer content, we will pass your request to your organisation as controller. Email contact@incompli.io. We respond within the time limits set by law, and you may complain to your local data protection authority. For UK/EEA rights requests, we normally respond within one month; where legally permitted, we will explain any extension within that month.

We use essential cookies and browser storage for authentication, security and cookie preferences. Optional analytics or marketing storage requires your consent; it is not enabled by accepting these legal terms. You can change or withdraw optional consent using “Cookie preferences” in the footer. See our Cookie Policy for details.

incompli is a business service and is not directed to anyone under 18.

We will post updates here and change the date above. Material changes will be notified to account owners by email before they take effect.