Privacy notice

Who we are

Complly is run by Complly Construct Limited, a company registered in England and Wales (company number 17356591). Our registered office is 304 High Road, Benfleet, Essex SS7 5HB. We decide how and why your details are used, which makes us the “controller” of them under UK data protection law.

For anything about your data, email [email protected].

What this notice covers

This one notice covers our website (complly.ai), the Complly Risk app (complly.ai/risk), the emails we send, and anyone who opens a document someone has shared with them to review. The first part is about the website. The second part is about Complly Risk.

On our website: what we collect, and why

• The Talk to us form. Your name, work email and company, and, if you give them, your phone number, role and message, plus what you asked for (a demo, early access or a question). We use them to reply to you and to keep a record of the conversation.
• Document downloads. Your email address, so we can send the document and follow up about it.
• Updates. Only if you tick the box: occasional news about Complly. We reply to you, and send documents, whether or not you tick it. You can unsubscribe from any email.
• The Try the demo form. Your name and work email, your company if you give it, which product you picked, whether you ticked the updates box, and the campaign you came from if your web address carried one (see “Where you came from” below). We use them to open the demo for you and to follow up. The website keeps them for 90 days, and a copy goes into our customer records. While your demo is open (up to an hour), we also keep your name and email beside your demo pass, so the demo can fill in your email for you when you ask it to send you a document.
• What you do inside a demo. We record which demo screens you open and which buttons you press, in order, for 90 days. If you ask for a demo with your email on “Try the demo”, this is linked to you, so our team can follow up with you. If you start a demo without giving an email, we only count it, and it is not linked to anyone. We record the words on the buttons you press, never anything you type.
• Visits and clicks. We count these as daily totals, without cookies and without identifying you. See “How we count visits and clicks” below.

How we count visits and clicks

We count how the website is used so we can make it better. We count totals for each day. We do not count people.

• What we count. Page visits: which page, and the kind of site you came from (for example a search engine, ChatGPT, LinkedIn, or none). Presses of our main buttons: start a free trial, see the plan, register interest, contact sales and Ask Rodney. Whether you pick “subcontractor” or “main contractor”. And on the See it walkthroughs: started, watched for 10 seconds or more, reached halfway, finished, or left before 10 seconds. For “watched for 10 seconds or more” we also note the kind of site you came from.
• No cookies, no IP address, no ID. The counting does not use cookies, does not store anything on your device and does not give you an ID. It does not record your IP address. We cannot tell whether two visits came from the same person. The one exception is a choice you make yourself: see “Switch the counting off” below.
• Only real presses, once each. A button press counts only if a person made it, not a script. Each thing counts once per page. That is remembered only while the page is open, and forgotten when you leave or reload it.
• Automated traffic is taken out. Search engine crawlers and other tools that say what they are, and browsers that report they are being run automatically, are not counted as visits or clicks. We keep only a daily total of how many we took out, split by what they did (a page visit, a button, the subcontractor or main contractor choice, or a walkthrough) and by type (crawler or automated browser). To spot them we read the name your browser sends with each request. We do not keep it.
• Where the totals are kept, and for how long. In our own records, in the UK. They are not shared with anyone. Each day’s totals are deleted automatically two years after that day.

Switch the counting off

You can object to this counting at any time, free of charge. Press the button below and your visits on this browser are not counted. To remember your choice, your browser keeps one small marker. That marker is saved only if you press the button, and it is the only thing about counting we ever store on your device. If your browser sends the Global Privacy Control signal, we also do not count you, and you do not need to press anything. Pressing the button again switches the counting back on.

Your visits are counted as part of the daily totals.

Where you came from

If you arrive from one of our campaign links, or from a site we recognise such as ChatGPT or LinkedIn, the website carries the campaign name or that site’s type in the web address as you move between our pages. Nothing is stored on your device to do this, and nothing else in the address is carried. If you then start a Complly Risk free trial, it arrives with you at the sign-up page. If you use the Try the demo form, it is sent with your details to our customer records, so we know which campaign brought you.

If you then sign up, Complly Risk saves the campaign name, source and medium (letters and numbers only, shortened to 64 characters) with your sign-up record, from the first link you used, and passes them to our customer records. We use them only to see which campaigns bring people to try Complly Risk. If your link carried no campaign, it is recorded as “direct”.

What our pages store in your browser

• The Ask Rodney prompt. So the “Ask Rodney” prompt appears only once, your browser remembers a single marker until you close the tab. It holds nothing about you.
• The Try the demo form. If you fill it in, your browser remembers the details you typed so you do not have to type them again. They are used for up to a week. Press “Not you?” on the form to remove them.
• Your choice not to be counted. Only if you press “Don’t count my visits” (see above), one small marker that says so. It holds nothing about you and stays until you switch the counting back on.
• The demo pass. When you start a demo, the demo site puts one cookie, called cc_demo, in your browser. It is the pass that lets you into the demo. It lasts an hour and then stops working. It holds no name or email address. If you asked for the demo with your email, it also holds a reference number, so that what you do inside the demo can be linked to your request.
• Signing in to Complly Risk. When you sign in, your browser keeps the details that keep you signed in, and a few settings such as which screen you were on. These are needed for the app to work. We do not use advertising or tracking cookies anywhere.

The network in front of our website. Cloudflare delivers our website and protects it from attacks, so it handles the internet address of each visitor in order to do that. When we checked on 26 October 2026, no cookies were set on our main pages or on the Complly Risk sign-up page.

Stopping misuse

To stop our forms and Ask Rodney being flooded, we briefly count requests from each internet address. For the forms these counts are kept for about ten minutes (the daily limit on demo starts, for two days). For Ask Rodney we keep a scrambled version of the address, which cannot be turned back into it without our secret key, for seven days, so we can spot misuse. These counts are deleted automatically and are not used for anything else.

In Complly Risk: what we collect, and why

• Your account. Your name, work email, phone number if you give it, your trade, and your company’s details: its name, address and Companies House number. To fill these in for you, we look your company up on the public Companies House register and may read your company’s own public website. We use them to run your account and to tailor the documents we draft for you.
• Your documents. What you type, say or photograph to make a RAMS, COSHH assessment, toolbox talk or construction phase plan, including project, client and site details and the names of people on a briefing register. If you speak instead of typing, your recording is turned into text so it can go into the document.
• Sign-offs. When someone approves or signs a document we record their name, role, signature, the time, and the type of browser or device they used. This is printed on the document and kept with its record of who approved it.
• Reviewers. If someone sends you a document to review, the name and email you enter to open it, any comments you add, your sign-off if you give one, and whether you ticked the box to hear from us.
• How you use the app. Which features you use, so we can see what works and fix what doesn’t. These records are deleted automatically after 90 days.
• Technical records. Our systems keep short-lived technical logs to keep the service running and secure. They are deleted automatically after 90 days.

Please do not put sensitive details about identifiable people, such as their health, into a document unless the assessment genuinely needs them.

Rodney, inside Complly Risk

Rodney is the assistant that drafts your documents and answers your questions. What you type or say to Rodney, and what he replies, is kept as a conversation so you can come back to it. A conversation is deleted automatically 90 days after it was last used, or 30 days after you delete it. Rodney can also keep short notes about your company and your work, for example a reminder you asked for next month, so he does not have to ask again. Those notes are deleted automatically after 400 days.

Everything Rodney drafts is a draft. A competent person must check and sign it off before anyone relies on it. See our terms.

Improving the service (optional)

Two uses of your documents are separate from running your account. Both are optional and start switched off. A company admin can switch either one on, and off again, at any time in Settings:

• Improving our drafting. We may use de-identified documents to make the documents we draft more accurate.
• The anonymised example library. We may make an anonymised copy of an approved RAMS and add it to a library of examples that guides Rodney when he drafts documents for other Complly customers. Before an example is used we remove names, signatures, client and company names, site addresses, and project names and locations, and a member of our team checks each one. Rodney learns from the examples and is told not to copy them; we never share the library, or the documents in it, with anyone as documents. If you switch it off, your examples are removed from the library.

We only do either if your company switches it on. Our legal reason is your consent, which you can withdraw at any time by switching it off again.

Payments

When you subscribe, your payment is handled by Stripe. You type your card details into Stripe’s own form, and we never see or store your card number. Stripe tells us whether a payment worked and the state of your subscription, and we keep that with your account. Stripe also keeps its own records of the payment, as the law requires it to.

The emails we send

• Emails you need to use your account: setting your password, your trial ending, a payment that did not go through, a document shared with you. You cannot switch these off while you have an account, because the service cannot run without them.
• Tips while you try Complly Risk and occasional news. Every one of these has an unsubscribe link, and unsubscribing stops them straight away.

Our emails come from [email protected] (“Rodney at Complly”) and are sent through Microsoft 365.

When your company is in charge of the details

Some details in Complly Risk are about people your company works with, for example the people on a briefing register or the client named on a RAMS. Your company decides what goes into its documents and why. For those details we act on your company’s behalf, and your company should tell those people how it uses their details. Our terms set out how we look after those details for your company.

Our legal reasons for using your details

• To provide what you signed up for (your account, your documents, sign-offs, payments, the emails you need): because it is necessary for our contract with you.
• To reply to enquiries, follow up a demo, record reviewers, count visits, keep the service secure and improve it: our legitimate interests, which we have balanced against yours. You can object at any time.
• Updates and news, and the two optional uses above: your consent, which you can withdraw at any time.
• Records we must keep by law, for example payment and tax records: a legal obligation.

Who handles your details for us

We never sell your details. These services handle them for us, under contract, and only on our instructions:

• Amazon Web Services hosts our systems and records in London (the eu-west-2 region), turns spoken notes into text, and sends some of our automatic emails.
• Amazon Bedrock (part of Amazon Web Services) runs the Anthropic Claude model that powers Rodney, on an EU regional setting. What you type or say to Rodney, and the details used to draft a document, are sent there to be answered and may be processed in the European Economic Area rather than the UK.
• Microsoft 365 handles our email, including the emails Complly Risk sends.
• Stripe takes subscription payments.
• Cloudflare delivers the website and the app and protects them from attacks.
• Companies House (the public register) is searched when we look up your company.
• If you choose to bring a file in from OneDrive or Dropbox, that service passes us the file you pick.

We also share a document with the reviewer you choose to send it to. We may share details if the law requires us to.

Where your details are held

In the UK, except that Rodney’s drafting and answers may be processed in the European Economic Area (see above), and that Stripe, Microsoft and Cloudflare may handle some details outside the UK. Where details go outside the UK we rely on the UK’s adequacy regulations, or on the UK International Data Transfer Agreement or Addendum.

How long we keep it

• Your account and documents: while your account is open.
• Deleted documents: in your recycle bin for 30 days, then deleted for good.
• When a company account is closed: we delete the company and everything in it, except an archive of the documents that were approved or signed (RAMS, COSHH assessments, toolbox talks and construction phase plans), with the record of who approved or signed each one. Alongside it we keep the company name, the email of its first admin, the date it was closed and how many documents were archived. The archive is private and encrypted, only our own admins can read it, and it is deleted automatically after one year. You can ask us to delete it sooner.
• Rodney’s conversations: 90 days after last use (30 days after you delete one). Rodney’s notes: 400 days.
• Usage records and technical logs: 90 days. Backups of our database: 14 days.
• Website enquiries and demo requests in our customer records: 24 months after we last heard from you, then deleted.
• Website visit totals: two years. Demo activity: 90 days.
• Payment records: six years, for tax purposes.

Your rights

You can ask us for a copy of the details we hold about you, ask us to correct them or delete them, and object to how we use them. You can also ask us to limit how we use them, to give them to you in a form you can reuse, and to withdraw your consent where we rely on it. Email [email protected]. It is free, and we reply within one month.

If you are unhappy with how we have used your details, please tell us first at [email protected]. You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113.

Keeping it safe

We encrypt your details when they travel and where they are stored, limit who on our team can see them, and keep our systems up to date.

Changes to this notice

If we change this notice in a way that matters, we will tell you in Complly Risk and ask you to agree again where the law requires it.

Version 2026-10-26 · in force from 26 October 2026.