Privacy Notice

• Account details — email, and any name, postal address or phone number you add to your letterhead. Used to create and operate your account.Contract
• Content you create — case details, timelines, files you upload, and the letters you generate. Used to provide the service.Contract
• Payment metadata — confirmation of payment, plan, renewal status. We never see or store your card details.ContractLegal obligation
• Technical and usage logs — IP address, device/browser info, timestamps, error logs. Used to keep the service secure, prevent abuse, and improve reliability.Legitimate interest
• Support correspondence — emails you send us. Used to respond and keep a record of the interaction.Legitimate interest

To draft your letter, the case information and any extracted text from files you upload are sent to our AI provider. That content is used only to generate your draft and is not used to train third-party models.

We use a small number of trusted service providers to run the service:

• Paddle (paddle.com) — our Merchant of Record, who handles payments, billing, tax compliance, invoicing, subscription management, and refunds. Paddle is an independent data controller for the personal data it processes for these purposes. See Paddle's privacy notice.
• Our hosting and database provider — application backend, authentication, and file storage.
• Our AI gateway and model provider — letter generation.
• Professional advisers (legal, accounting) and authorities where required by law.

We do not sell your data and we do not run advertising trackers.

Our providers may process data in the UK, EU, or US. Where data leaves the UK or EU, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

Your account and cases are kept while your account is active. If you delete your account, we delete your personal content within 30 days, except for limited records we must keep for legal or accounting reasons (typically up to 6 years for invoices).

You have the right to access, correct, delete, port, restrict, and object to our processing of your personal data, and to withdraw consent where we rely on it. We aim to respond to requests within one month. You can also complain to your local data protection authority — for example the UK ICO, your EU supervisory authority, or the Jersey Office of the Information Commissioner.

This section applies to California residents and supplements the rest of this notice. In the last 12 months we have collected the categories described above: identifiers (email, IP), account information, commercial information (purchase and subscription records), internet/network activity (technical logs), and the content you submit to draft your letters. We collect this data to provide, secure and improve the service, to process payments through our Merchant of Record, and to comply with legal obligations.

We do not sell or share your personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. We do not knowingly collect personal information of anyone under 16.

You have the right to know what we hold about you, to request deletion, to correct inaccurate data, to limit the use of sensitive personal information, and to be free from discrimination for exercising these rights. To exercise any of these rights, email dataprotection@complainly.app from the address on your account, or contact support@complainly.app. We will verify your request against your account details. Authorized agents may submit a request on your behalf with written proof of authorization.

We use encryption in transit, access controls, and per-user data isolation. No internet service is 100% secure — please use a strong, unique password.

Complainly is not for under-18s and we do not knowingly collect their data.

We may update this notice. Material changes will be notified by email or in-app.

Privacy questions or requests: dataprotection@complainly.app. Full trader and data controller details are set out in our Terms of Service.