Sign in Join the beta My account Open Compliome

Privacy Policy

Last updated: October 23, 2026

This Privacy Policy explains how Levacells SRL (8 Avenue de la Renaissance, 1000 Brussels, Belgium), the operator of Compliome and the data controller ("we", "us"), collects, uses, and protects your information when you use our website and Service. Contact: contact@levacells.com.

1. Information we collect

  • Account information: your name, email address, and password (stored only as a secure hash).
  • Usage data: the questions you ask and chat history, used to provide and improve the Service.
  • Billing information: processed and stored by our payment processor, Stripe. We do not store your full card details.
  • Technical data: standard log and device information for security and reliability.
  • Product analytics: cookieless, first-party usage events (such as pages viewed and features used) linked to your account, used only to understand and improve the Service. We do not use third-party analytics or advertising trackers.

2. How we use information

We use your information to operate the Service, authenticate you, process payments, respond to support requests, and improve our product. We do not sell your personal information.

3. Cookies

Compliome uses only strictly necessary (essential) cookies. We do not use advertising, marketing, analytics, or cross-site tracking cookies, and we do not sell or share cookie data with third parties for advertising.

The cookies we set are:

  • compliome_access — an encrypted, httpOnly session token that keeps you signed in. Scoped to .compliome.com so a single login works across compliome.com and app.compliome.com. Not readable by JavaScript.
  • compliome_loggedin — a non-sensitive flag indicating that a session exists, so the interface can show the correct signed-in state.
  • compliome_csrf — a security token used to protect your account against cross-site request forgery (CSRF).

These cookies expire when your session ends or after a fixed period, and are removed when you sign out. Because they are essential to providing the Service, they cannot be disabled while using your account; you may block cookies in your browser, but the Service will not function. We display a notice about these cookies on your first visit.

4. Data sharing & sub-processors

We share data only with service providers ("sub-processors") that help us operate the Service, and only as necessary to provide it or comply with the law:

  • Infomaniak (Switzerland) — application hosting and database storage. Your account and chat data are hosted in Swiss data centres.
  • Infomaniak Swiss Backup (Switzerland) — encrypted off-site backups of the database.
  • Anthropic, PBC (United States) — the Claude AI model that generates answers, through Anthropic's commercial API (see international transfers below).
  • Amazon Web Services (AWS) — Amazon Bedrock: the same Claude model as a fallback when Anthropic's API is unavailable, plus the embedding and ranking models that search our regulatory library (United States region).
  • Bunny.net — content delivery network for our public website.
  • Proton Mail (Switzerland) — transactional email (verification, password reset, receipts).
  • Stripe — payment processing and billing. Card details are handled entirely by Stripe and are never stored on our servers.
  • Cloudflare Turnstile (Cloudflare, Inc.) — bot protection on our sign-up, password-reset, contact and newsletter forms. When one of these forms loads, Cloudflare checks signals from your browser and connection (including your IP address) to tell people from bots.
  • Sentry (Functional Software, Inc.; EU data region, Germany) — error monitoring for the app and API. Error reports carry technical details only (error message, stack trace, browser/OS, release); we configure it not to collect IP addresses, cookies, request bodies, your questions or answers, and we do not use session replay.

We do not sell your personal information, and your questions and content are not used to train third-party or foundation AI models (neither Anthropic's commercial API nor Amazon Bedrock uses customer prompts to train its models).

International data transfers. Your account data, chat history, and backups are stored in Switzerland (Infomaniak). When you ask a question, its content is sent to Anthropic (or, as a fallback, Amazon Bedrock) in the United States to generate the answer. These transfers outside the EEA/Switzerland are covered by the European Commission's Standard Contractual Clauses (SCCs) in our data-processing agreements with Anthropic and AWS, together with their supplementary technical safeguards. We do not transfer your data internationally for any other purpose.

5. Data retention and security

We retain your information for as long as your account is active. An account whose email address is never verified is deleted automatically after 7 days. We use industry-standard measures to protect your data, including encryption in transit (HTTPS), secure password hashing (Argon2), httpOnly session cookies, and CSRF protection.

To prevent the same person from claiming free beta credits more than once, we keep a one-way hash of your email address (it cannot be turned back into the address) even after your account is deleted.

6. Your rights

You may access, update, or delete your account information at any time from your account settings, or by contacting us. Deleting your account permanently removes your personal data and chat history. Depending on your jurisdiction (e.g. the EEA/UK under GDPR, or California under the CCPA), you may have additional rights to access, correct, port, or erase your data, and to lodge a complaint with a supervisory authority.

7. Children's privacy

Compliome is a professional tool intended for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice within the Service.

9. Contact

Data controller: Levacells SRL, 8 Avenue de la Renaissance, 1000 Brussels, Belgium. Questions about your privacy or to exercise your rights, email contact@levacells.com or use our contact form. EEA/UK users may also lodge a complaint with their local data-protection authority (in Belgium, the Autorité de protection des données).