How we handle
your information.

Last updated: 30 October 2026.

Who we are

COMPLIAR LTD is a private limited company registered in England and Wales, company number 17519777, registered office 11 Wakefield Drive, Endmoor, Kendal, LA8 0BF. We are the controller for the personal data described in this notice unless we say otherwise.

We are registered with the Information Commissioner's Office (ICO) as a data controller, registration reference ZC278853. Our Data Protection Officer is Keiran Sandham. Contact him about anything in this notice at keiran@compliar.co.uk.

This website

The website is a set of static pages and does not ask you to create an account. We use the Google tag for Google Ads to measure which of our adverts lead to demo requests. Advertising and analytics cookies are only set if you choose “Accept” in the cookie banner (lawful basis: consent, which you can withdraw at any time with Cookie settings in the footer). If you choose “Decline”, Google still receives limited cookieless signals, such as a page view or demo-button click with your IP address and browser details, which it uses to model conversions in aggregate (lawful basis: our legitimate interest in measuring our advertising). Google acts as an independent controller for this data; our Cookies page has the details. We use Cloudflare Web Analytics to count page views: it sets no cookies, stores nothing in your browser and does not fingerprint or track you across sites. Cloudflare receives your IP address and browser details to count the visit and gives us totals only (pages viewed, referring sites, country and device type). The typefaces are loaded from Google Fonts, so your browser requests them from Google's servers and Google receives your IP address and browser details in the course of serving them (Google says it does not use this to set cookies or build profiles); we plan to serve the fonts from our own domain. Our hosting provider (GitHub Pages, operated by GitHub, Inc.) keeps standard server logs, which include your IP address and the pages requested, for security and operation of the service; we do not receive personal data from those logs.

Enquiries and demos

When you email us or fill in the demo request form (on the home page, the contact page or the “Book a 15-Min Walkthrough” pop-up), we receive your name, work email address, company name, team size, the disciplines you work in, and whatever else you write. The form is delivered by Web3Forms, a service provider that passes your submission to our email; see Web3Forms' privacy policy. We use this to reply, arrange a demo, set up your workspace and keep a record of the conversation. The lawful basis is our legitimate interest in responding to business enquiries and, where you ask to subscribe, taking steps at your request before entering a contract. We keep enquiry correspondence for up to 24 months after our last contact, or for the life of your account if you become a customer. Email is handled through Google Workspace.

The Compliar application

Account data (we are the controller)

To run your workspace we hold the name, work email address, role and sign-in details of each user, your company details and billing contact, and usage and security logs. We use this to provide the service, bill for it, keep it secure, support you and send service messages. The lawful basis is performance of our contract with your company and our legitimate interests in running a secure service. Payments are processed by Stripe; we do not store card numbers.

Your customers' data (you are the controller, we are the processor)

The sites, assets, jobs, certificates, reports, defects, photographs, signatures and contacts you record in Compliar belong to your company. You decide what to collect and why; we process it only on your instructions to provide the service, under the data-processing terms in our Terms of Service. We do not sell it, use it for advertising or use it to train models.

Who we share data with

Service providers who host and operate parts of Compliar on our behalf under contract: database and file storage (Supabase), application hosting (Lovable), payments (Stripe), email (Google Workspace), demo request form delivery (Web3Forms), transactional email such as invites, quotes, invoices and certificates sent from the app (Resend), the in-app help assistant, which sends your question to an AI model through Lovable's AI gateway, site address lookups (OpenStreetMap Nominatim), web push notifications delivered through your browser or phone's push service, and source control and website hosting (GitHub). Some providers operate outside the United Kingdom; where personal data is transferred outside the UK we rely on the UK International Data Transfer Agreement or Addendum, or an adequacy regulation. We will also disclose data where the law requires it.

How long we keep it

Account data for the life of your subscription and up to 12 months afterwards, then deleted or anonymised, except where we must keep records for tax or legal reasons (normally six years for financial records). Workspace content is available for export for 30 days after your subscription ends and is then deleted from live systems; backups roll off within a further 35 days.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, object to or restrict processing, and ask for data you gave us in a portable form. Email our Data Protection Officer at keiran@compliar.co.uk and we will respond within one month. If your data is in a customer's workspace, we may refer your request to that customer, who controls it. You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113; our registration reference is ZC278853.

Security

Data is encrypted in transit and at rest, access inside the application is limited to your own company by database-level controls, and staff access to production systems is restricted and logged. No system is perfectly secure; if we become aware of a breach that affects you we will tell you without undue delay.

Children

Compliar is a business tool and is not intended for anyone under 18.

Changes

We will post changes here with a new date. If a change materially affects how we use your data we will tell account holders by email first.