Privacy notice
Last updated 3 October 2026·Version 1.2
1. Who we are
Complyoo is a DPDPA compliance product for Indian founders, operated by Farvez Anzam (“we”, “us”, “our”).
2. Personal data we collect
Account data
- Data
- Name, email address, organisation name
- Purpose
- Creating and managing your account
- Basis
- Consent
Onboarding answers
- Data
- Company profile, tools used, categories of data collected, employee count, industry
- Purpose
- Generating your policies
- Basis
- Consent
Usage data
- Data
- Pages visited, features used, session duration
- Purpose
- Improving the product
- Basis
- Legitimate use
Technical data
- Data
- IP address, browser type, device type
- Purpose
- Security monitoring and fraud prevention
- Basis
- Legitimate use
Payment data
- Data
- Billing name and email. Card details are handled by Razorpay and never reach us.
- Purpose
- Processing subscription payments
- Basis
- Contract
We do not collect Aadhaar numbers, PAN, health data, financial account data, biometric data, or children’s personal data. Complyoo is not intended for anyone under 18.
3. Who processes data for us
These providers process personal data on our behalf, under contract, only for the purposes listed.
We do not sell your personal data. We do not use it for behavioural advertising or automated profiling.
4. Transfers outside India
Our hosting, database and sign-in providers store data outside India, as listed above. The DPDP Act permits such transfers unless the Central Government restricts a destination country. We will update this notice if any country we use is restricted.
5. How long we keep data
6. Your rights
- Access (Section 11). Ask for a summary of the personal data we hold about you.
- Correction and erasure (Section 12). Ask us to correct, complete or delete your data.
- Grievance redressal (Section 13). Complain to us and get a response.
- Nomination (Section 14). Nominate someone to exercise your rights if you cannot.
- Withdraw consent. As easily as you gave it, at any time.
Email privacy@complyoo.com with the right you want to exercise in the subject line. We acknowledge within 48 hours and respond within 30 days.
7. Grievances
8. Complyoo Guard (browser extension)
When an organisation installs Complyoo Guard for its people, that organisation is the Data Fiduciary and Complyoo processes the following on its behalf:
- The person's work email address from their Chrome profile, and the extension version
- Which supported AI tools were visited, at most once per tool per day
- When personal data was detected: the AI tool, which types of data and how many items, and what the person chose (redact, block, cancel or send)
Guard checks text on the person’s own device. The text being pasted or typed is never uploaded to Complyoo or stored. Guard activity is kept for 12 months and then deleted. People should contact their employer to exercise their rights over this data; we will help the employer respond.
9. Changes to this notice
We update this notice when our data practices or the law change. We email registered users about material changes at least 14 days before they take effect. The current version is always at complyoo.com/privacy.