Privacy Policy
1. Who we are
RegController is operated by ComplyControl Ltd, a private limited company registered in England and Wales under company number 15612471, registered office 298A Bath Road, Hounslow, England, TW4 7DN ("RegController", "we", "us").
For questions about this policy or about your personal data, contact us at info@complycontrol.com.
2. What RegController is, in one paragraph
RegController turns approved regulations and company policies into project-specific, versioned instructions for developers and AI coding tools. It is compliance engineering. It does not provide legal advice, certify compliance, or approve documents. It is a workspace for your compliance records — not a place your source code is sent.
3. The two kinds of data, and our different roles
Account data — we decide how it is used (we are the controller). The identity of the people who sign in, and the security and audit records the service creates about their use of it.
Workspace content — you decide how it is used (we process it for you). Everything your organisation puts into RegController: your company details, your projects, your questionnaire answers, the requirements and rules you author, the packs you generate, and the findings and evidence recorded against them.
4. Account data: what we hold and why
We use Google Sign-In and nothing else. There is no password to create, and we never see one.
When you sign in, Google gives us three things from your Google account:
| What | Why we hold it |
|---|---|
| Your Google account identifier (the "sub") | It is how we recognise you on every later sign-in. It is the identity key; your email address is not. |
| Your email address | To show who you are to your colleagues, and to match an invitation someone sent you. |
| Your name, if your Google account has one | To show who you are in your workspace, and who recorded an approval. |
We request only the openid email profile scope. We do not receive or store your Google profile photo, your contacts, your calendar, your files, or anything else in your Google account. We do not store Google access or refresh tokens; the sign-in token is checked at the moment you sign in and then discarded.
We accept a sign-in only if Google states that your email address is verified. An unverified address is refused.
Legal basis: performance of our contract with you or your organisation (GDPR Art. 6(1)(b)), and our legitimate interest in operating a secure service (Art. 6(1)(f)).
5. Workspace content: what your organisation puts in
Your workspace holds what your organisation records in it:
- your company name, jurisdiction, licences, regulated activities, services, markets and operating model;
- your projects, including any client name your team chooses to type in;
- your questionnaire answers;
- the regulations and policies on your shelves, the versions you approve, and who approved them and when;
- the requirements and Development rules you author;
- the Runtime Packs you generate, and their contents;
- findings, resolutions, accepted exceptions and the reason and expiry recorded for each;
- the audit trail of who did which of these things, and when.
Some of these fields can contain personal data if your team types it there — a client name, for instance, or a reason recorded against a finding. What goes in is your organisation's choice; we do not require any of it to contain personal data.
Legal basis: we process this on your organisation's instructions, under our contract with it. Your organisation decides its own legal basis for the personal data it puts in.
6. What we deliberately do not collect
This section is not aspiration. Each line is a property of the software, and §C names the file that makes it true.
- We do not store your source code. RegController never receives your repository, your diffs, or your prompts. The pull-request check runs on your machine or your CI runner, reads the diff there, and reports back only: the rule code that was triggered, the file path, the line number, the correction text that came from your own rule, the commit identifier, and counts. The code itself never leaves your machine. Our database has no column that could hold it.
- Credentials are redacted before anything is printed or sent. The check redacts secrets at the boundary of every output path — including the report it sends us — so that a leaked key in a diff does not become a second copy in a CI log or in our database.
- Documents you approve are never uploaded. When you fingerprint a policy document, the SHA-256 is computed in your browser. We record the fingerprint, the file name, the size in bytes, and who recorded it. The file itself is never sent to us and we could not produce it if asked.
- We run no analytics and no tracking. There is no Google Analytics, no Plausible, no PostHog, no Mixpanel, no Hotjar, no session recorder, no advertising pixel, and no third-party script of any kind. Nothing on the page is loaded from another company's servers — not even a webfont.
- We send no marketing email. In fact the service sends no email at all. An invitation is a record your administrator creates; the person invited signs in with Google.
- We do not sell personal data, and we do not share it for advertising.
- We do not profile you or make automated decisions with legal effect about you. The applicability engine makes determinations about *projects and regulations*, never about people.
Note honestly, because the sentence above could be read too widely: file paths, line numbers and commit identifiers are sent to us when the check reports a finding. A file path can carry meaning (a developer's name in a branch or directory, for example). It is data about your code's structure, not its contents.
7. Sign-in cookies
RegController sets five cookies. All of them are necessary for the service to work; none of them is used for analytics or advertising, and none is shared with anyone.
| Cookie | What it is for | How long |
|---|---|---|
rc_session | Proves you are signed in. HTTP-only, so page scripts cannot read it. | 12 hours |
rc_csrf | Protects against another site submitting a form as you. Readable by the page by design — it carries no authority on its own. | 12 hours |
rc_oauth_state | Ties your sign-in attempt to the one you started, for the few seconds the Google round trip takes. | Cleared as soon as you return |
rc_auth_denied | Lets the "sign-in refused" screen explain why. | Cleared when you leave that screen |
rc_last_project | Remembers which project you had open, so the app opens where you left it. It holds a project identifier and nothing else. | One year, or until you click "Show all projects" |
8. Where the data lives, and who else touches it
Two companies process data on our behalf:
| Who | What they do | What they see |
|---|---|---|
| Signs you in. | Your Google identity, and the fact that you signed in to RegController. Google's own privacy policy applies to your Google account. | |
| DigitalOcean | Hosts the application server and the managed PostgreSQL database. | Everything stored in the service, as the infrastructure provider. |
The droplet and the managed database both run in DigitalOcean's Frankfurt (FRA1) region, in Germany — inside the EU. Your workspace content is stored there.
Both DigitalOcean and Google are US-headquartered companies, so although the servers holding your data are in the EU, those companies are themselves subject to US law.
We do not use any other processor. There is no email provider, no analytics provider, no CDN, no error-reporting service, and no AI provider in the path of your data.
9. How long we keep it
- Your account stays while you have access to a workspace.
- Your workspace content stays while your organisation's account is open, and is deleted on request as described below.
- The audit trail is deliberately hard to change. Generated packs, their files, and recorded evidence events cannot be edited or deleted through the application at all — the database itself refuses. That is what makes the trail worth having in a compliance tool, and it is why an erasure request touching it is handled by us rather than by a button.
Being honest about today's limits: there is no self-service delete in the product yet. An account can be deactivated, which ends access immediately; deleting the underlying records is done by us on request.
We answer a deletion request within 30 days, and will tell you before we act what we can remove and what the audit trail requires us to keep. We do not offer an automated export today; if you need your workspace content in a portable form, ask and we will produce it.
10. Your rights
If you are in the EU, the UK, or another place with comparable law, you can ask us to: give you a copy of your personal data; correct it; delete it; restrict or object to our use of it; or give it to you in a portable form. You can also complain to your data protection authority.
Ask us at info@complycontrol.com, and we will answer within the time the law allows.
One limit, stated up front rather than discovered later. RegController exists to keep a compliance audit trail. Where your name sits in that trail — you approved this regulation version on that date, you accepted that exception for that reason — erasing it would destroy the record's meaning for your own organisation, which may itself be required to keep it. In those cases we will tell you exactly what we can remove, what we cannot, and why.
If the request concerns workspace content, we will normally refer you to the organisation whose workspace it is, because they decide what happens to it.
11. How we protect it
- Every connection uses HTTPS, with certificates renewed automatically.
- Each workspace is isolated in the database itself, not only in the application: every table carries a workspace and the database refuses to return another workspace's rows, even if the application asked wrongly. It fails closed — a query with no workspace context returns nothing rather than everything.
- Sign-in sessions last 12 hours and are re-checked against the database on every request, so removing someone's access takes effect immediately.
- Access inside a workspace is by role: administrator, legal, engineer, developer, and a read-only auditor.
- The token your CI uses to report findings is stored hashed; the value itself is shown once when you create it and is never recoverable from us.
- Our own sign-in logs record that a sign-in happened, not who it was: they carry no email address and no user identifier, and the OAuth code and state are redacted from any URL that is logged.
No system is perfectly secure.
12. Children
RegController is a tool for businesses. It is not directed at children and we do not knowingly collect data from anyone under 16.
13. Changes to this policy
If we change this policy we will update the date at the top and, for changes that matter, tell workspace administrators. We give 30 days' notice of a material change, by notice inside the application — the only channel that exists, since the service sends no email.
14. Contact
ComplyControl Ltd 298A Bath Road, Hounslow, England, TW4 7DN info@complycontrol.com