Privacy Policy

Who we are

CheckRef Ltd (company number 15416191)
71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ, United Kingdom
Contact: hello@opencomplai.com

Data we collect

Product updates form

When you submit the product updates form, we collect only your email address. It's sent to our team at hello@opencomplai.com through Brevo, our email provider, so we can send you occasional product updates. The legal basis for this is your consent, given when you submit the form. We don't use this data for anything else. You can withdraw your consent, or ask us to delete your email address, at any time by emailing hello@opencomplai.com.

Contact form

When you submit the contact form, we collect your name, your email address, the reason you selected, and your message. It's sent to our team at hello@opencomplai.com through Brevo, our email provider, so we can reply to you. The legal basis for this is our legitimate interest in responding to your enquiry, or, where relevant, taking steps at your request before entering into a contract. We keep this data for as long as needed to handle your enquiry.

EU AI Act checker

The checker at /checker runs in your browser, and your answers stay there until you ask for the full report. When you do, we collect your email address, your company name and your answers. After that you can also tell us your team size, how many AI systems you run, your production timeline, whether risk controls are in place and who the system's intended users are. We use your answers to work out your result and email you the report through Brevo, our email provider. Brevo also sends our team at hello@opencomplai.com a note with your email address, company name, a summary of your result and how you reached the checker, and a second note with any of those organisation details you give, so we can follow up with you. We keep your email address, your answers and your result in our database so our team can follow up with you. The legal basis for this is our legitimate interest in sending you the report you asked for and responding to your enquiry. We keep this for 12 months and then delete it automatically, and you can ask us to delete it sooner at any time by emailing hello@opencomplai.com.

Repo chat (invite-only)

The repo chat feature at /repo-chat is available only to people we've given an access code. If you use it, we store your conversation history on our servers, tied to the name associated with your access code, and the text of your messages is sent to Google's Gemini API to generate responses. Google acts as a sub-processor for this feature, and using it may involve transferring your data outside the United Kingdom; we rely on the safeguards described under International data transfers below. Because this is a small, identifiable group of people, you can ask us to access or delete this data at any time by contacting hello@opencomplai.com.

Vercel Web Analytics

We use Vercel Web Analytics on every page of this site to understand aggregate traffic patterns. It is cookieless: it does not set any cookie and does not assign you a persistent visitor identifier. We rely on our legitimate interest in understanding how the site is used as the legal basis for this processing.

Authentication cookies

The admin area and repo chat feature use strictly-necessary, HttpOnly cookies to keep you signed in. These cookies are not used for tracking or advertising. See our Cookie Policy for details.

The hosted service (app.opencomplai.com)

Our hosted service is sold to businesses. What we do with personal data there depends on whose data it is:

• Data your organisation puts into the service, such as details of its AI systems, control owners, risk assessments, the evidence artifacts its CI pipelines send, and support tickets raised in the service. We process this as a processor on your organisation's behalf, under our Data Processing Agreement. Your organisation is the controller of that data, so to exercise your rights over it, contact your organisation; we will pass on any request we receive.
• Account data, what we need to sign you in and run your account and details of your organisation's sales, billing and support contacts that we hold outside the service, for example in emails with our team. We are the controller of this data, and this policy applies to it.

What we collect to sign you in

• Your email address, which we use to send you sign-in links and to identify your account.
• Your name, if you provide one.
• The organisations you belong to, your role in each, and records of invitations sent to you or by you.
• A single-use sign-in token, which expires when you use it or after 24 hours.
• Cookies on app.opencomplai.com that keep you signed in (until 8 hours after your last activity) and remember which organisation you are working in, plus preference cookies that remember your theme, sidebar state and whether you have dismissed the product tour and getting-started checklist (up to 1 year). They are not used for tracking or advertising.
• Your IP address and basic request information, which we use to protect sign-in and the service against abuse, for example by rate limiting, and which our hosting provider, Vercel, records in its logs.

There are no passwords: you sign in with a link we email to you. Sign-in links, invitations, welcome emails and support-ticket notifications are sent through Brevo, our transactional email provider, which receives your email address and the content of the message. We use account data to provide and secure the service, to communicate with you about it, and to meet our legal obligations. We keep it for as long as you have an account, and for a reasonable period afterwards to deal with any questions or legal requirements; you can ask us to delete it at any time by contacting hello@opencomplai.com.

Legal bases for processing

• Product updates marketing communications: your consent, given when you submit the form.
• Analytics and security: our legitimate interest in operating and improving the site.
• Contact form: our legitimate interest in responding to your enquiry, or, where relevant, taking steps at your request before entering into a contract.
• EU AI Act checker: our legitimate interest in sending you the report you asked for and responding to your enquiry.
• Repo chat: performance of the service you've requested and our legitimate interest in providing this feature.
• Hosted service account data: performance of our contract with your organisation (or with you, if you are the customer), and our legitimate interest in providing a secure service to your organisation.

Sub-processors

We use the following third parties to process data on our behalf. For the hosted service, the full list, with processing locations and transfer safeguards, is in Annex 3 of our Data Processing Agreement.

• Google (Gemini API) - Processes repo chat messages.
• Brevo - Sends transactional email: product updates and contact-form messages to our team, EU AI Act checker reports to you with a summary to our team, and sign-in links, invitations and notifications for the hosted service.
• Vercel - Hosts this website (including web analytics and file storage) and the hosted service, which runs in its Frankfurt region.
• Neon - Hosts our Postgres databases: this website's (repo chat history, blog content, EU AI Act checker records) and the hosted service's, in Frankfurt.

International data transfers

Some of our sub-processors (including Google, Vercel, and Neon) may process data outside the United Kingdom. Where this happens, we put appropriate safeguards in place before the transfer occurs, for transfers to the European Economic Area, we rely on the UK's data protection adequacy regulations recognising the EEA; for transfers elsewhere, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as appropriate to each sub-processor and transfer.

Data retention

We keep product updates form submissions and repo chat conversation history until you ask us to delete it, contact hello@opencomplai.com at any time to request deletion. We do not retain data for longer than necessary for the purposes described in this policy.

How to complain

If you're unhappy with how we've handled your personal data, you can complain to us directly at hello@opencomplai.com. Please include enough detail for us to understand and investigate your concern.

We will acknowledge your complaint within 30 days of receiving it, and we will look into it and respond as soon as we reasonably can. We keep a record of complaints we receive so we can identify and fix recurring issues.

If you're not satisfied with our response, or you'd prefer not to complain to us directly, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or by calling 0303 123 1113.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at hello@opencomplai.com.

If you're in the UK, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you're located elsewhere, you may have the right to complain to your local data protection supervisory authority instead.

Children's privacy

This site is not directed at children. We do not knowingly collect personal data from individuals under the age of 16. While UK data protection law sets a lower age (13) at which a child may consent to use of information society services, we apply the higher age of 16 as our own policy.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision.