Privacy policy

This policy explains how Illumify Ltd handles personal data when you visit www.compleka.com, contact us, or use the Compleka application at app.compleka.com. It is written for people at the organisations that use Compleka and for anyone who gets in touch with us.

Who we are

Compleka is provided by Illumify Ltd, a company registered in England and Wales (company number 15921614), whose registered office is International House, 55 Longsmith Street, Gloucester, Gloucestershire, GL1 2HT, United Kingdom. In this policy, "we", "us" and "our" mean Illumify Ltd.

For questions about this policy or your personal data, email support@compleka.com or write to us at our registered office.

Our two roles

How data protection law applies depends on whose data it is and why we hold it.

• We are the controller of the data we need to run the service and our business: account and sign-in details, billing records, support conversations, enquiries and security logs.
• We are a processor for the content your organisation puts into Compleka: documents, evidence, questionnaires, audit records, nonconformances and the questions you ask. Your organisation is the controller of that content and decides what goes in. We handle it only to provide the service, under the data processing terms in our terms of service. If your question is about personal data in your organisation’s content, please contact your organisation first.

What we collect

When you visit this website

This website does not use cookies, analytics or advertising trackers, and it loads no third-party scripts or fonts. It is hosted by Cloudflare, and visits to compleka.com without the “www” are redirected through Amazon CloudFront. Like any web host, they record technical information for each request, such as IP address, browser type, the page requested and the time. This information is used only to deliver the site and keep it secure.

When you contact us

If you email us or ask for a demo, we receive your name, email address, company and whatever you choose to tell us.

When you use Compleka

• Account details: name, work email address, company, role and password (stored only as a secure hash). If you turn on multi-factor authentication, we store the authenticator secret, encrypted.
• Billing details: the billing contact and address, subscription status, invoices and AI credit balance. Card details are entered on Stripe’s payment pages and are never seen or stored by us.
• Usage and security data: sign-ins, significant actions in the application (the audit log), IP address and browser details recorded with them, and AI usage per company for billing and the usage dashboard.
• Your organisation’s content: the documents, files and records your organisation uploads or creates, which may include personal data such as names of document owners, auditors or people named in evidence.
• Microsoft 365 connection: if your organisation connects SharePoint, OneDrive or Teams, we store the access tokens needed to read the files and sites you choose, encrypted, and copies of the documents you sync.
• Emails we send: invitations, password resets and notifications, and whether delivery bounced, so we can stop sending to addresses that do not work.

Why we use it, and our lawful basis

We do not sell personal data, and we do not use it for advertising. We do not send marketing emails unless you have asked us to.

How the AI features use your data

When you ask a question, answer a questionnaire, run a gap analysis or draft a policy, the relevant passages of your organisation’s documents and your request are sent to our AI model provider to generate the response. The search index that finds those passages is built on our own servers.

Your documents and requests are not used to train AI models, by us or by our AI model provider. AI output is a draft for a person to review: Compleka never adds AI-drafted material to your evidence base automatically, and no decision with legal or similarly significant effects on anyone is made by automated means alone.

Who we share it with

We use a small number of service providers (sub-processors) to run Compleka. Each acts on our instructions under a written contract that requires it to protect the data.

For the name of our AI model provider, or a copy of our current sub-processor list, email support@compleka.com. We will give customers notice before adding or replacing a sub-processor.

If your organisation connects Microsoft 365, data passes between Compleka and your organisation’s own Microsoft tenant under your organisation’s agreement with Microsoft.

We may also share personal data with professional advisers, with a buyer if our business is sold (in which case this policy will continue to apply), or where the law requires it.

International transfers

Compleka is hosted in the UK. Where a provider handles personal data outside the UK, we make sure the transfer is protected, either because the destination is covered by UK adequacy regulations (including the UK–US data bridge, where the provider is certified) or by using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Account and content data: for as long as your organisation’s account is open. Cancelling a subscription does not delete data. When an administrator closes the account, all of the company’s data and files are permanently deleted from the application straight away, and from our backups within seven days, when those backups expire.
• Individual users: when an administrator removes a user, their access ends. Their name may stay attached to records they created, such as audit entries and document revisions, because those records form part of the organisation’s compliance history.
• Billing records: six years after the end of the financial year they relate to, as UK tax law requires.
• Enquiries and support emails: up to two years after our last contact, unless they become part of a customer relationship.
• Web server logs: no longer than needed for security and troubleshooting, normally a few weeks.

How we protect it

Each company’s data is kept separate, documents are encrypted at rest with a key specific to each company, and sign-in is protected by rate limiting and optional or mandatory multi-factor authentication. Our security page has more detail. If you believe you have found a security issue, email security@compleka.com.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data;
• ask us to restrict how we use it, or object to our using it on the basis of legitimate interests;
• ask for data you gave us in a portable format;
• withdraw consent, where we rely on it.

To use any of these rights, email support@compleka.com. We will reply within one month. Where the request concerns your organisation’s content, we will pass it to your organisation, as the controller, and help it respond.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Children

Compleka is a business service and is not intended for anyone under 18.

Changes to this policy

We will update this policy when our practices change, and change the date at the top. If a change is significant, we will tell account administrators by email before it takes effect.