Privacy Policy

Information you provide. Business details submitted to the compliance checker, including business or trade name, municipality and ZIP code, business type, license type, product and fulfillment selections, and current packaging descriptions; your email address when you request a report; questions you type into the explanation assistant; and any optional photograph of your packaging that you upload.

Account information. For administrative users, an email address and authentication credentials managed by our authentication provider. We do not receive or store your password in readable form.

Automatically collected information. Product usage events (for example, checker started, step completed, report viewed, requirement card viewed, source link clicked, resource link clicked, assistant question asked), timestamps, referring pages, coarse device and browser characteristics, and server logs including IP address for security and abuse prevention.

Information we do not want. Do not submit government identification numbers, payment card data, health information, or personal information about customers or employees. If you send such data, we may delete it.

• to generate, store and display your personalized compliance report;
• to deliver the report link to the email address you provide and to respond to your inquiries;
• to operate, secure, debug, measure and improve the Service, including aggregate analysis of which requirements and resources are most used;
• to maintain an internal audit trail of which rule versions and sources were relied upon in each report;
• to review submitted packaging photographs when needed to improve our guidance and resource directory;
• to detect, investigate and prevent fraud, abuse, scraping and security incidents;
• to comply with legal obligations and enforce our Terms of Use.

Where applicable law requires a legal basis, we rely on performance of a contract (providing the report you requested), our legitimate interests (security, improvement, aggregate analytics), consent (optional communications, where required), and legal obligation.

Compliance statuses are produced by a deterministic rules engine, not by a machine-learning model, and are informational only rather than a decision with legal effect. The explanation assistant sends the relevant contents of your report and the associated source records to a third-party language model provider to compose a plain-English explanation. We do not use your submissions to train our own models, and we instruct our providers not to use content submitted through the Service to train theirs, subject to their terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

• Service providers who host our database, storage, authentication, email delivery and AI inference, acting under contract and only as needed to provide the Service;
• Recipients you choose — anyone you give your report link to, including your counsel, insurer or regulator;
• Legal and safety disclosures when required by law, subpoena or court order, or to protect the rights, property or safety of Gopliancy, our users or the public;
• Business transfers in connection with a merger, financing, acquisition or sale of assets, subject to this Policy.

Aggregated or de-identified statistics that cannot reasonably identify you may be published or shared without restriction.

Each report is reachable through a unique, unguessable link rather than a login. Anyone with that link can view the report, so treat it as confidential. We can expire or revoke links, and administrators of Gopliancy can access reports and submitted photographs for support, quality and abuse-prevention purposes.

We use strictly necessary storage to keep your place in the checker and to keep administrators signed in, plus first-party analytics events described above. We do not use third-party advertising cookies or advertising pixels. Browser controls can block or clear local storage, though doing so may prevent the checker or sign-in from working. We honor Global Privacy Control signals where legally required.

Reports, the answers behind them and their rule-version snapshots are retained as a regulatory audit record for as long as we operate the Service, unless you ask us to delete them. Contact details are retained while you remain an active user and for a reasonable period afterward. Packaging photographs are retained no longer than necessary for the purposes described above. Security logs are retained for a limited period. We may retain information longer where required by law or to resolve disputes.

We use technical and organizational safeguards including encryption in transit, encrypted storage at rest with our infrastructure provider, row-level database access controls, private storage buckets with time-limited signed access, and role-restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Notify us promptly at security@gopliancy.com if you believe your data or report link has been compromised.

Depending on where you live, you may have the right to request access to, a copy of, correction of, or deletion of your personal information; to opt out of sale or targeted advertising (we do neither); to limit use of sensitive information; and to be free from discrimination for exercising these rights. Residents of California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws may also request information about categories of data collected and disclosed.

To exercise a right, email privacy@gopliancy.com from the address you used, or include your report link. We will verify your request and respond within the period required by applicable law. You may use an authorized agent where the law allows. Note that deleting a report removes your ability to view it, and we may retain limited records where law permits or requires.

The Service is operated from and intended for use in the United States, and information is processed and stored in the United States and other countries where our providers operate. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses. If you access the Service from outside the United States, you consent to this processing.

The Service is not directed to anyone under 21 and is not intended for children. We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it.

Government sources, vendors and other third-party destinations we link to have their own privacy practices, which we do not control and are not responsible for. Review their policies before providing information.

We may update this Policy from time to time. We will post the revised version with a new effective date and, where material, provide additional notice. Continued use of the Service after the effective date constitutes acceptance.

For privacy questions or requests, contact privacy@gopliancy.com. For terms and legal notices, see our Terms of Use.