Privacy Policy

Comply.AI (“Accessible Notes”) converts handwritten lecture notes into accessible, screen-reader-friendly PDFs. This policy explains what data we collect when you use the service, why we collect it, how long we keep it, and the choices you have.

• Account information. When you sign in with Google, we receive your email address and basic profile information through our authentication provider. We never see or store your Google password. You can also sign up with an email address and password (restricted to institutional email domains); that password is hashed and held by our authentication provider (Supabase), never by us in plain text.
• Documents you upload. We store the original PDF in private storage, along with the page images, transcription, and accessible PDF produced from it, so the document can be reviewed, edited, downloaded, and quality-checked during its retention period.
• Audit records. For security and accountability we log key actions (sign-in, sign-out, upload, view, download, generate, delete) with a timestamp, your user ID, the document’s job ID, and the request’s source IP address. Audit records never contain document content.
• Feedback. If you submit feedback, we store the message, any contact details you choose to provide, and any files you attach.

Your data is used solely to provide, maintain, secure, and support the service. We do not sell your data, share it with advertisers, or use it for any purpose unrelated to the service.

• Documents (original PDFs, page images, transcriptions, preview PDFs, and final PDFs) are kept until you delete them, so you can come back to a document whenever you need it. This applies to signed-in and guest jobs alike.
• When you delete a document it disappears from your account immediately and is no longer accessible to you. We hold the underlying files for a further 7 days — so an accidental deletion can be recovered on request and our quality-review process can complete — and then permanently erase them.
• Internal transcription caches: purged automatically after 30 days.
• Audit logs and feedback: retained as security and business records, with a target retention period of 24 months.

We use vetted subprocessors to operate, maintain, and secure the service, each of which may process information only as necessary to perform services on our behalf. All service data is hosted and processed in the United States.

• Vercel — hosts the web application (no document content stored).
• Render (behind Cloudflare) — hosts the backend that processes and stores your documents.
• Supabase — authentication, database, and private document storage.
• Anthropic — receives page images to produce the AI transcription; not used to train Anthropic’s models under our commercial API terms.
• Resend — delivers feedback and job-failure email notifications (metadata only, not document content).

If we add or change a subprocessor that materially affects how your data is handled, we’ll update this page. A full current list, including any institution-specific details, is also available on request at complyaibusiness@gmail.com.

• All traffic is encrypted with HTTPS/TLS; stored data is encrypted at rest.
• Every document is owned by the account that uploaded it — access is verified on every request, and no other signed-in user can see your documents. Documents created without signing in (“guest mode”) are not tied to an account; anyone holding that document’s unique link could access it, which is why guest jobs are kept for a shorter period and we recommend signing in for anything sensitive. Institutions can request that guest mode be disabled entirely.
• Uploads are validated and size-limited; endpoints are rate-limited.
• Privileged (administrative) access is token-controlled and audit-logged.

Lecture notes may constitute student education records. We act as a service provider to you (or your institution): we process notes only to provide the conversion you request, we do not disclose them to third parties beyond the subprocessors described above, and we delete them on the schedule described in this policy.

• Delete any job at any time from the My Docs page — it is removed from your account immediately and permanently erased 7 days later.
• Use guest mode to avoid creating an account. Guest jobs are reachable only by their unguessable link and are kept until deleted from that link.
• Email us at complyaibusiness@gmail.com to request deletion of your account and all associated data.

If this policy changes materially, we will update the effective date above and note the change on this page. Questions or concerns: complyaibusiness@gmail.com.

See also our Terms of Service.