Privacy policy

Who we are

Compliance Signal (“we”, “us”; formerly Compliance Hub) decides how and why your personal data is used, which makes us the controller under the GDPR and the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023. For anything in this policy, contact@compliancesignal.tech.

What we collect and why

• Reading the site — nothing that identifies you. No account is needed. Our host keeps standard server logs (IP address, browser, pages requested) to run and secure the site, and we count page views with cookieless analytics that don’t identify you or follow you to other sites.
• Your account — if you sign in, our sign-in provider shares your name, email address and an account ID with us. We use them to run your account. Basis: our agreement with you (GDPR Art. 6(1)(b)); your consent when you sign up (DPDP Act s.6).
• What you do with your account — upvotes, saved stories, followed frameworks, comments, story submissions and your watch log (assessments, notes and client labels). Comments are public and show your first name and last initial. Everything else, including your watch log, is private to you. Basis: our agreement with you.
• The Monday briefing — your email address, the frameworks you chose, and when we sent confirmation and briefing emails. Basis: your consent, which you give by confirming the sign-up and can withdraw with the unsubscribe link in every email or in Settings.
• Messages you send us — corrections, privacy requests and other email, kept to answer you.

We use the minimum needed to keep the service secure and working (for example limiting abuse: to cap how often sign-ups, comments and submissions can be sent, we keep a one-way scrambled form of your IP address, or of an email address entered in the briefing form, for no more than a day) under our legitimate interests (GDPR Art. 6(1)(f)). We don’t sell or rent personal data, don’t use it for advertising, and don’t use it to train AI models.

Who processes it for us

These providers handle data only on our instructions:

• Kinde — sign-in and account management.
• Supabase — our database (stories, your account activity, briefing subscriptions).
• Resend — sending confirmation and briefing emails.
• Our hosting provider — serving the site and its server logs.
• Umami — cookieless, aggregate page-view counts.

Story summaries are drafted with an AI service (Groq), and cover illustrations are drawn with Cloudflare Workers AI, from public news articles only. We don’t send either of them your personal data. Some providers may process data outside your country; where the law requires it, we rely on the safeguards they offer, such as the EU Standard Contractual Clauses.

How long we keep it

• Account data and activity — until you delete your account (Settings → Account) or ask us to.
• Briefing sign-ups that are never confirmed — deleted after 30 days. When you unsubscribe we keep your address marked as unsubscribed, only so we never email you again; ask and we’ll erase it completely.
• Server logs — for the period our hosting provider keeps them, typically up to 30 days.
• Emails you send us — as long as needed to deal with your request.

Cookies and local storage

We use only the cookies needed to keep you signed in. Your browser’s local storage remembers your theme and whether you closed the briefing banner. No advertising or cross-site tracking cookies, so there’s no cookie banner.

Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent at any time (which doesn’t affect what we did before). Under the DPDP Act you can also nominate someone to exercise your rights if you die or become incapacitated. You can download or delete your account data yourself in Settings → Account. To use any of these rights otherwise, contact@compliancesignal.tech from the email on your account; we reply within 30 days.

If you’re unhappy with our answer you can complain to your data protection authority — in the EU or UK your national supervisory authority, in India the Data Protection Board of India, and in California the California Privacy Protection Agency. We don’t sell or share personal information as the CCPA defines those terms.

Security and breaches

Data is encrypted in transit, your personal data can only be reached through our own servers, and every account action is checked against your signed-in session on the server. If a breach affects your personal data we’ll tell you and the relevant authorities as the law requires.

Children

Compliance Signal is meant for professionals and isn’t directed at anyone under 18. We don’t knowingly collect children’s data; if you think we have, contact@compliancesignal.tech and we’ll delete it.

Changes

We’ll update the date at the top when this policy changes, and tell briefing subscribers about significant changes by email. See also our terms of use.