This Privacy Policy explains how The Software Suite and A.J. Hakimi ("we", "us", "our") collect, use, disclose, and protect personal data when you use the ComplianceOracle™ AI platform (the "Service"). It is written to address, among others, the EU and UK GDPR, the California Consumer Privacy Act as amended (CCPA/CPRA), and India's Digital Personal Data Protection Act 2023 (DPDP Act). Where a specific law grants you stronger rights, that law prevails.
1. Who is responsible for your data
For the purposes of the GDPR and similar laws, the data controller is The Software Suite / A.J. Hakimi. Contact: the.software.suite@protonmail.com.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Content you submit | Company name, industry, jurisdictions, transaction type, and the free-text scenario you enter for analysis | You |
| Account & contact data | Email address and any access credentials, where accounts or paid access apply | You |
| Payment data | Processed by our payment processor; we receive confirmation of payment, not full card details | Payment processor |
| Technical & usage data | IP address, request metadata, timestamps, error and rate-limit logs, and similar operational records | Automatically |
We do not intentionally seek special-category / sensitive personal data. Please do not include it in scenarios unless necessary and lawful.
3. How and why we use it (legal bases)
| Purpose | Legal basis (GDPR / DPDP) |
|---|---|
| To provide the analysis you request | Performance of a contract; your consent (DPDP) |
| To operate, secure, and troubleshoot the Service (logging, rate-limiting, abuse prevention) | Legitimate interests; legal obligation |
| To process payments | Performance of a contract |
| To comply with law and enforce our Terms | Legal obligation; legitimate interests |
4. Sharing and international transfers
We share personal data only as needed to run the Service:
- AI provider (xAI) — scenario content is transmitted for processing. Subject to xAI's terms and retention practices.
- Hosting & infrastructure (Netlify; database provider Neon) — to run the application and store operational and corpus data.
- Payment processor — to take payment where applicable.
- Legal / safety — where required by law, to enforce our Terms, or to protect rights and safety.
We do not sell personal data, and we do not "share" it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.
Because our providers and users are international, personal data may be transferred to and processed in countries other than your own, including the United States. Where required, such transfers are made under appropriate safeguards (for example, standard contractual clauses or an equivalent lawful transfer mechanism).
5. Retention
We keep personal data only as long as necessary for the purposes above or as required by law. Operational logs are retained for a limited period for security and troubleshooting. Where you hold an account, we retain account data for its duration and a reasonable period afterwards. Note that data transmitted to our AI provider is subject to that provider's retention practices, which are outside our control.
6. Your rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data; to object to or restrict certain processing; to withdraw consent; and, under the CCPA/CPRA, to opt out of sale/sharing (which we do not do) and not to be discriminated against for exercising your rights. Under the DPDP Act you also have rights of access, correction, erasure, grievance redressal, and nomination.
To exercise any right, email the.software.suite@protonmail.com. We will respond within the time required by applicable law. You may also have the right to complain to your local data-protection authority.
7. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), a strict content-security policy, origin restrictions, rate limiting, secret management for credentials, and integrity signing of generated reports. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Children
The Service is intended for business and professional use and is not directed to children. We do not knowingly collect personal data from anyone under 18 (or the age of digital consent in your jurisdiction). If you believe a child has provided us data, contact us and we will delete it.
9. Cookies and similar technologies
The Service uses only what is necessary to operate (for example, to maintain a session or apply security controls). We do not use third-party advertising or cross-site tracking cookies. Where required, any non-essential technologies will be used only with your consent.
10. Changes
We may update this Policy. Material changes will be reflected in the "Last updated" date and, where appropriate, by additional notice. Continued use after changes take effect constitutes acceptance where permitted by law.
11. Precedence
This Privacy Policy and the Terms of Service published at this domain are the controlling documents for the Service. They supersede and prevail over any conflicting statement, policy, disclaimer, or content appearing elsewhere — including any earlier version, any other page of this site, any external or third-party website (including pages hosted on other platforms), and any marketing material. In the event of a conflict, the most recently updated version published at this domain governs. On matters of personal-data handling, this Privacy Policy controls; on all other matters, the Terms of Service control.
12. Contact
The Software Suite · A.J. Hakimi
Email: the.software.suite@protonmail.com