Privacy Policy
This policy explains what personal data COMPLIBOX collects, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025.
Who we are
COMPLIBOX [verify: registered legal entity name and address] ("COMPLIBOX", "we", "us") is the Data Fiduciary for personal data collected through complibox.app and for account data in the COMPLIBOX app.
When our customers use COMPLIBOX to manage their own compliance, they decide what data they upload. For that data the customer is the Data Fiduciary and we process it on their behalf as a Data Processor, under our Terms [verify: data processing agreement].
What we collect
When you start a free trial
- First name and, if you give it, last name
- Work email address
- Company name
- A password, which we store only as a one-way hash
- The time you gave consent
When you use the app
- Records of what you create, change or delete, with the time and your IP address. These form a tamper-evident audit log that cannot be edited.
- Documents and evidence you upload
- Technical error reports when something goes wrong
When you email us or book a demo
Whatever you include in your message.
Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your trial account, including email verification | Name, email, company, password hash | Your consent |
| Contact you about your trial and account | Name, email | Your consent |
| Provide the service and keep an audit trail | Account data, audit log, uploads | Your consent, and our contract with your organisation |
| Fix errors and keep the service secure | Error reports, IP address | Legitimate use for security [verify] |
| Meet legal obligations | Any of the above, as required | Compliance with law |
We do not sell personal data, and we do not use it for advertising.
Who we share it with
We use these service providers (Data Processors) to run COMPLIBOX:
- Amazon Web Services: file storage, in the Mumbai (ap-south-1) region [verify: database and server location]
- Brevo (formerly Sendinblue): sending account and verification emails [verify]
- Sentry: error monitoring [verify: region and data scrubbing settings]
We share data with authorities only when the law requires it.
How long we keep it
- Trial accounts that are never verified: [verify: e.g. deleted after 30 days]
- Active accounts: for as long as your organisation uses COMPLIBOX, then [verify: retention period] after the account closes
- Audit logs: [verify: retention period]. They cannot be edited while kept.
Your rights
Under the DPDP Act you can:
- Withdraw consent at any time, as easily as you gave it
- Ask for a summary of the personal data we hold about you and how we use it
- Ask us to correct, complete, update or erase your data
- Nominate someone to exercise your rights if you die or become incapacitated
- Raise a grievance with us, and then with the Data Protection Board of India if you're not satisfied
Email privacy@complibox.app to use any of these rights. We will respond within [verify: response period; the DPDP Rules cap grievance responses at 90 days].
Withdrawing consent doesn't affect processing that happened before. We may need to close your account if we can no longer process the data needed to run it.
Security
See our Security page for how we protect data.
Contact and grievances
For data protection questions and grievances, contact our privacy team at privacy@complibox.app. [verify: the DPDP Rules require the business contact details of a person able to answer questions on our behalf; confirm with counsel that a role mailbox satisfies this]
Changes to this policy
If we make significant changes we'll email account holders before they take effect. The date at the top shows when this policy last changed.