Privacy policy

Who we are

Complytio (“we”, “us”) provides food safety compliance software for UK hospitality businesses. This policy explains how we handle personal data when you visit www.complytio.com, create a workspace, or use the product.

For questions about privacy, contact us via the demo form at /demo or through in-app support if you already have an account.

What data we collect

Account and billing: name, email, business name, role, plan selection, and payment-related identifiers processed by Stripe (we do not store full card numbers on our servers).

Workspace content: food safety checks, temperatures, documents, training records, allergen matrices, incident logs and similar compliance records you or your staff enter. This may include names of staff and visitors you choose to record.

Technical data: IP address, device/browser type, app version, and security events (for example sign-in attempts and audit logs) needed to operate and secure the service.

Marketing site: form submissions (demo requests, signup) and optional analytics events configured for product improvement. We avoid fabricating tracking claims; configuration depends on your deployment environment.

Why we process data

To provide the contracted service (contract / legitimate interests).

To bill and manage trials and subscriptions (contract / legal obligation).

To keep the platform secure, prevent abuse and investigate incidents (legitimate interests / legal obligation).

To respond to support requests and product communications you request (contract / legitimate interests / consent where required).

To improve the product using aggregated or operational metrics where appropriate (legitimate interests).

Sharing and processors

We use infrastructure and service providers under contract — for example hosting (such as Vercel), databases, object storage for documents, email delivery, payment processing (Stripe), and optional monitoring. They process data only on our instructions where we are the controller for platform operations.

We do not sell personal data. Customer workspace content is isolated by company (tenant). Platform support access, when used, is controlled, audited and limited.

We may disclose data if required by law or to protect rights, safety and security.

International transfers

Some providers may process data outside the UK. Where required, we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) offered by those providers.

Retention

We keep account and billing records for as long as your workspace is active and for a reasonable period afterward for legal, tax and dispute purposes.

Compliance records you store are retained according to your use of the product and any deletion tools available to your administrators, subject to backups and legal holds.

Security logs are kept for a limited operational period unless needed longer for investigations.

Your rights

Depending on UK GDPR and related law, you may have rights to access, rectify, erase, restrict or object to certain processing, and to data portability. Workspace end-users should usually contact their company administrator first for data held in the business account.

You may complain to the UK Information Commissioner’s Office (ICO). We encourage you to contact us first so we can help.

Cookies and similar technologies

We use essential cookies for authentication and security. The marketing site may use additional cookies or similar storage if analytics is enabled in your environment. You can control cookies through your browser settings.

Children

Complytio is a business product and is not directed at children.

Changes

We may update this policy from time to time. The “Last updated” date below will change when we do. Material changes may also be notified in-product or by email where appropriate.