Last updated: 2026-09-27. Applies to AI Disclosure on complyfort.com, part of the ComplyFort family of compliance tools.
ComplyFort is run by InnoDigital, the trading name of a sole proprietorship registered in Poland. The controller of your personal data under the GDPR is:
Adam Szydło (sole proprietorship, trading as InnoDigital)
Kościuszki 40/11, 46-320 Praszka, Poland
NIP 5761448946, REGON 524963224
Email: hello@innodigital.io
Write to that address about anything in this notice. We have not appointed a data protection officer; at our size the law does not require one, so the address above reaches the person who decides.
The free plan covers one site per account. The limit is counted per email address on your site registrations (section 3.1); we do not count free use against your IP address.
Legal basis: carrying out the service you asked for (GDPR Art. 6(1)(b)).
When you enter your email address (to receive a result, to buy, or to join a waiting list) we store it with what you asked for in the tool's own records and in our internal customer records (a CRM we host on our own servers), so we know who used which tool and can honour an opt-out or deletion request across all our products at once. Our application logs never contain your email address in readable form: they keep a pseudonymised identifier (a keyed hash of the part before the @) next to the email domain. The logs stay only on the server that runs the service, are not copied anywhere else, can be read only by the people who operate the service, and are deleted when the running service is replaced.
Legal basis: carrying out what you asked for (Art. 6(1)(b)) and our legitimate interest in keeping a record of who contacted us (Art. 6(1)(f)). You can object at any time.
Where a form offers product news, the checkbox is unticked by default. We add your address to that tool's mailing list at Brevo, our email provider, only when you tick it. When you tick the box we store a consent record in our own database: your email address, the time, the form you used and the wording of the checkbox you saw, so we can show later that you agreed. We keep it while you stay subscribed and for 3 years after you withdraw consent. If we cannot store that record, we do not add you to the list. If you leave the box unticked you get only the messages needed for what you asked for. Every product-news email has an unsubscribe link, and one unsubscribe covers all our products.
Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time without affecting what happened before.
Paid features are sold through Stripe Managed Payments. For each purchase Link, a Stripe company, is the merchant of record: Link is the seller on your receipt and card statement, collects and pays the VAT or sales tax, sends the receipt and handles refunds and payment disputes. Stripe collects your card details, billing address and, where relevant, your tax id on its hosted checkout page; we never see or store the card. Stripe and Link process that data as independent controllers under their own privacy policies.
After a successful payment Stripe tells us your email address, what you bought and the subscription or checkout id. We keep these to know which plan you are entitled to, to send you the plan confirmation and as evidence if a payment is disputed.
Legal basis: the contract with you (Art. 6(1)(b)) and our legal obligation to keep accounting records (Art. 6(1)(c)).
We send email through Brevo. A hidden copy (BCC) of every email we send goes to an internal company mailbox on Google Workspace, so we can check that our emails went out and handle replies and bounces. The copy contains what you received. It is not used for marketing.
Legal basis: our legitimate interest in running and checking our own email delivery (Art. 6(1)(f)).
Our edge server keeps a standard access log (IP address, the requested address including any query string, and the time) on our host in Finland. It is size-capped, so old entries are overwritten; in practice that is about a week. The application itself keeps no access log. Visitors from countries under EU or US sanctions (Iran, North Korea, Syria, Cuba, Russia, Belarus) are blocked at the edge based on their IP address.
Legal basis: our legitimate interest in keeping the service secure and in complying with sanctions law (Art. 6(1)(f)).
Two things happen when you view a page:
Page-view statistics are kept for 10 years. The analytics script sets no cookies; it writes one random identifier into your browser's local storage and, while replay runs, one flag into session storage. There is no opt-out switch on the site yet; a browser content blocker that blocks analytics.complyfort.com stops the script, and the tools work without it.
Legal basis: our legitimate interest in understanding how the tools are used and improving them (Art. 6(1)(f)). You can object at any time by writing to us.
When you register a site we store your email address, the domain you entered, the site key we issue for the embed snippet, the evidence token that protects your evidence log, your plan and the date. If you buy a plan we also store the subscription id and the plan. We use this to serve your site's configuration, to show the notice without the "AI notice" backlink on paid plans, to let you read your evidence log and to contact you about the service. Section 2.2 applies to your email address; the product-news checkbox on the registration form is unticked by default (section 2.3).
If you try to register more sites than your plan allows, the request is refused and nothing about you is created: no contact record and no mailing-list entry. We only count, without any personal data, that the limit was reached.
Legal basis: the contract with you (Art. 6(1)(b)); for paid plans also our legal obligation to keep accounting records (Art. 6(1)(c)).
When a page with the widget loads, the visitor's browser makes up to three requests to our server: it loads the script, fetches the site's configuration and, when a notice is shown, sends a short evidence beacon. The beacon contains the site key, the names of the AI tools detected on the page and the language the notice was shown in. The widget does not read page text or chat messages, and it sets no cookies and writes nothing to the visitor's browser storage.
We keep each evidence entry (site key, detected AI tools, language, timestamp) for 400 days as the site owner's Article 50 evidence log. It contains no IP address and no browser string. A widget load is counted as a bare number: we derive nothing from the visitor's IP address or browser, not even a daily hash, and those requests do not reach our analytics.
Because these requests reach our server, it receives the visitor's IP address and browser string. The application does not log them; our edge server records the IP address in its size-capped access log for security (section 2.6).
The site owner is the controller for their own visitors, and we process the evidence log on the site owner's behalf as their processor. For our security logs we are an independent controller, on the basis of our legitimate interest in keeping the service secure (Art. 6(1)(f)).
We do not sell your data and we do not share it with advertisers. These service providers process it for us, or receive it as independent controllers where noted:
| Recipient | Role | What | Where |
|---|---|---|---|
| Hetzner Online GmbH | hosting (processor) | all application data, databases, analytics and logs | Helsinki, Finland |
| Amazon Web Services EMEA SARL | backup storage (processor) | encrypted daily backups, kept 30 days (35 days for the customer-records database) | Frankfurt, Germany |
| Link, LLC and Stripe (Stripe Managed Payments) | merchant of record and payment processor (independent controllers) | card details, billing address, tax id, email, payment history | US (Link, LLC) and Ireland (Stripe Technology Europe, Limited), with Stripe group companies in the US |
| Sendinblue SAS (Brevo) | email delivery and mailing lists (processor) | email address, email content, delivery events | France |
| Google Ireland Ltd (Google Workspace) | internal mailbox for the copy of outgoing email (processor) | copies of the emails we send | EU, with Google group companies in the US |
| Cloudflare, Inc. | DNS only; our pages are not proxied through Cloudflare | DNS lookups for complyfort.com made by your resolver | global |
Where a provider transfers data outside the European Economic Area (Link, Stripe and Google group companies in the US), the transfer relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
| Data | Kept for |
|---|---|
| Site registration (email, domain, site key, evidence token, plan) | while the site is registered, then 24 months after your last contact with us; paid plans as purchase records below |
| Widget evidence log (site key, detected AI tools, language, timestamp) | 400 days |
| Email address and lead record | 24 months after your last contact with us |
| Product-news subscription | until you unsubscribe or withdraw consent |
| Consent record (email, time, form, checkbox wording) | while you stay subscribed, then 3 years |
| Purchase and entitlement records | the life of your purchase or subscription, then 5 years for Polish accounting rules |
| Edge access log | size-capped, in practice about a week |
| Application logs (pseudonymised identifier and email domain) | until the running service is replaced (a fixed 30-day limit is being set up) |
| Analytics page views | 10 years |
| Session replay recordings | 30 days |
| Backups of the databases above | 30 days (35 days for the customer-records database) |
We delete the widget evidence entries after 400 days and replay recordings after 30 days automatically. The other periods in this table are applied by a manual review we run at least once a quarter.
You can ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. You can withdraw the product-news consent at any time. Write to hello@innodigital.io; we may ask you to confirm the email address the request concerns.
We handle requests manually and answer within one month, as the GDPR requires. Deleting your data means removing your records from the tool and from our internal customer records and taking you off any mailing list, except records the law requires us to keep. Backups expire on their own within 35 days. To delete what Stripe and Link hold, contact them as well; they will tell us.
You can also complain to a data protection authority. Ours is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl; you can also contact the authority where you live or work.
Giving us your data is voluntary. Without an email address we cannot register your site or send you a plan confirmation. Visitors of a site that embeds the widget give us nothing themselves.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
AI Disclosure sets no cookies of its own. The widget sets no cookies and writes nothing to the browser storage of your visitors. The analytics script writes one random identifier into local storage and, while replay runs, one flag into session storage, as described in section 2.7. Stripe sets its own cookies on its checkout pages under Stripe's cookie policy.
We will post any change on this page with a new "last updated" date. The terms cover the rest of how the service works.