Terms of Service
1. Who these terms are with
These terms are an agreement between you (and, if you are using RegController for an organisation, that organisation) and ComplyControl Ltd, a private limited company registered in England and Wales under company number 15612471, registered office 298A Bath Road, Hounslow, England, TW4 7DN ("RegController", "we", "us").
*(Provenance as in the Privacy Policy §1: search summaries, not the register; owner-checked 2026-08-25, address spacing corrected to "298A". Must match the Privacy Policy §1 word for word — it does.)*
By signing in, you accept these terms. If you are accepting on behalf of an organisation, you confirm you are allowed to.
2. What RegController does — and what it does not
RegController turns approved regulations and company policies into project-specific, versioned instructions for developers and AI coding tools, and keeps the record of what was decided, by whom, and when.
It is compliance engineering. It does not provide legal advice, certify compliance, or approve documents.
That sentence is not a disclaimer bolted on at the end; it is how the product is built, and you can see it working:
- Every pack RegController generates is stamped "Not legal advice" inside its own manifest.
- RegController does not invent regulatory content. The regulations, versions and requirements in your workspace are the ones you put there and your legal function approved. Where nothing has been approved, the product refuses to generate a pack and says why, rather than filling the gap with something plausible.
- Where an automated check cannot decide a rule, it reports "requires human review". It never reports such a rule as passing.
You remain responsible for your own compliance. Decisions about what the law requires of you are yours and your advisers'.
3. Accounts, roles, and who may invite whom
You sign in with Google. You are responsible for the security of the Google account you use.
Inside a workspace, what you may do depends on your role — administrator, legal, engineer, developer, or a read-only auditor. Administrators invite other people and set their roles. If you invite someone, you are giving them access to your workspace's content, and you are responsible for that choice.
Each workspace is separate. Nobody in another workspace can see yours; the database itself enforces that, not merely the screens.
4. Your content stays yours
Everything your organisation puts into RegController — your company details, projects, questionnaire answers, authored requirements and rules, generated packs, findings and evidence — remains yours.
You give us permission to store and process it for one purpose: running the service for you. We do not use your content to train models, we do not sell it, and we do not share it with anyone except the two infrastructure providers named in our Privacy Policy.
5. The pull-request check runs on your machines
RegController ships a checker inside each pack. It runs on your computer or your CI runner, reads your diff there, and reports back only the rule that was triggered, the file path and line, the correction text from your own rule, the commit identifier, and counts. Your source code is never sent to us. Credentials found in a diff are redacted before anything is printed or reported.
You are responsible for where you run it and for the CI token you generate. The token is stored by us as a hash and shown to you once; if it leaks, generate a new one — it takes one click and immediately invalidates the old one.
6. Acceptable use
Do not use RegController to break the law, to store material you have no right to store, to attempt to reach another workspace's data, to probe or overload the service, or to resell access to it.
7. Availability
We make no uptime commitment. RegController runs on a single server with a managed database and no redundancy; deploys briefly restart it, and there is no monitoring alert that would wake anyone at night. We will not promise availability we have not engineered.
We may change, suspend or discontinue parts of the service. If we discontinue something that holds your data, we will give you notice and a way to get your data out. We give 30 days' notice.
8. Fees
RegController is free during early access. If we introduce charges we will give 30 days' notice before any fee applies to you, and you may stop using the service instead.
9. Ending it
You may stop using RegController at any time. An administrator can deactivate any account in your workspace — except the last remaining administrator, which the product refuses so that no workspace is left with nobody able to grant access. A deactivation takes effect on that person's very next request, not at the end of their session.
If you want your workspace's data deleted, ask us and we will do it, with one honest limit repeated from the Privacy Policy: generated packs and the evidence trail cannot be edited or deleted from inside the application by design, so deletion is something we perform, not a button you press. We act on a deletion request within 30 days — the same commitment as the Privacy Policy §9, and it must stay the same number in both.
We may end your access if you materially breach these terms.
10. No warranty
The service is provided "as is". We do not warrant that it will be uninterrupted or error-free, that its output is complete or correct for your circumstances, or that it will satisfy any regulator or auditor.
This is the honest counterpart to §2: RegController's output is only as good as the regulations, versions and rules your own legal function approved, and the facts your team recorded.
11. Limitation of liability
Nothing in these terms excludes liability that cannot lawfully be excluded.
12. Changes to these terms
We may update these terms. If a change matters, we will tell workspace administrators before it takes effect. Continuing to use the service after that means you accept the new terms. We give 30 days' notice of a material change, by notice inside the application — the only channel that exists, since the service sends no email.
13. Law and disputes
These terms are governed by the law of England and Wales, and disputes go to the courts of England and Wales.
14. Contact
ComplyControl Ltd 298A Bath Road, Hounslow, England, TW4 7DN info@complycontrol.com