Privacy Policy

1.Information We Collect

RegCompiler processes information strictly necessary to operate our statutory compilation and policy evaluation services:

• Account & Identity Information: Name, professional email address, organization identifier, and role privileges managed securely via Clerk.
• Regulatory Documentation: Legal text, statutory PDFs, regulatory amendments, and agency guidelines uploaded for compilation.
• System Evaluation Payloads: JSON, YAML, or architectural state payloads submitted to the /compliance/evaluate API for automated verification against compiled policies.
• Telemetry & Audit Logs: Cryptographic check hashes, evaluation timestamps, policy pass/fail metrics, and correlation IDs for troubleshooting.

2.How We Process Customer Payloads (Zero-Retention Guarantee)

Unlike traditional analytics vendors, we do not sell, monetize, or use your proprietary architectural payloads to train foundation artificial intelligence models.

When you run compliance verification against an active policy, the payload is evaluated against the compiled Abstract Syntax Tree (AST) in an isolated execution sandbox. Once the compliance status (PASS, FAIL, or PARTIAL) is registered in your organization's audit trail, the raw input payload is expunged from memory.

3.Public Statutory Gazettes & Scraped Data

Our 24/7 automated statutory surveillance engine monitors public government gazettes (e.g., FederalRegister.gov, Eur-Lex, FCA RSS, and Canada Open Data). This data is strictly public domain information and does not contain personal or proprietary data. Signals scraped from these sources are compiled into public regulatory catalogs accessible across the platform.

4.Data Storage, Encryption & Security Architecture

We implement comprehensive defense-in-depth security measures to protect your organization's compliance assets:

• Encryption at Rest: All PostgreSQL relational tables, vector embeddings, and policy ASTs are encrypted using AES-256.
• Encryption in Transit: All HTTP API traffic, webhook dispatches, and Redis Celery broker queues enforce TLS 1.3.
• Multi-Tenant Isolation: Strict row-level isolation and organization ID scoping prevent cross-tenant data leakage.
• Automated Audit Trails: Every policy update, probe trigger, and compliance check generates an immutable cryptographic audit record.

5.Sub-Processors & Infrastructure Providers

We partner exclusively with certified, enterprise-grade infrastructure providers:

6.Your Rights (GDPR, CCPA & Global Privacy)

Depending on your jurisdiction, you possess statutory rights regarding your personal data:

• Right to Access & Portability: Export all compiled policies, organization audit logs, and compliance records via JSON or PDF.
• Right to Erasure: Request permanent purging of your organization's workspace and associated audit logs.
• Right to Restriction: Halt automated policy evaluations or modify data retention settings at any time.

7.Data Protection Officer (DPO) & Contact

For questions regarding this Privacy Policy, data subject access requests, or to exercise your GDPR/CCPA rights, contact our Data Protection Officer: