Legal · v1.2
Effective date: 11 July 2026 · Last updated: 26 October 2026
InTheValley LLC, under the name ComplyEdge (“we”, “us”), operates the Service at complyedge.io, eu.api.complyedge.io, api.complyedge.io, dashboard.complyedge.io, trust.complyedge.io, and related properties. InTheValley LLC is a limited liability company organized in Wyoming, United States (filing no. 2026-002075401; registered office 30 N Gould St Ste N, Sheridan, WY 82801, USA). For privacy and support requests, and to exercise any of the rights in section 8, contact support@complyedge.io.
Depending on the processing activity, we act as an independent controller (account administration, website and product analytics, billing) or as a processor (evaluating content you submit through the API on your instructions). Processor terms may be set out in a Data Processing Agreement for enterprise customers. Where a DPA is required, it is executed offline (email countersign), not as an in-product clickwrap.
text_hash, HMAC-SHA-256 with a key per account, held in AWS KMS) in standard production audit rows: we do not persist raw prompts/outputs unless a separate written agreement says otherwise. Records written before the keyed hash reached production carry a plain SHA-256 until they expire. Application logs do not include request text or a hash of ituser_id / session_id are stored as keyed pseudonyms (p1:…), never as sent. Records written before pseudonymisation reached production may hold the identifier as sent until they expire. user_role is stored as sent and must not hold a namesubject) and the exchange id (correlation_id) are stored as keyed pseudonyms (p1:…), never as sent. The other context fields are stored as sent: the deciding system version, purpose reference, data categories, legal basis, works agreement reference, whether the person is an employee, source reference, decision mode, the notice given, explanation inputs, withheld and escrow references. They should hold references and categories, not namesWhere GDPR applies, legal bases include contract performance, legitimate interests (security, product improvement, B2B communications with opt-out), consent where required, and legal obligation.
We do not sell personal data. We use infrastructure and vendors to run the Service, including:
use_semantic_fallback is set to true for that request, or when the account's Layer 2 setting is on, and the month's model budget covers it. If that budget is used up, it does not run. On sensitivity detection that request flag does nothing. A model runs there only on a paid plan when the account setting is on and the month's model budget covers it, after the TrustLint rules come back clean. That endpoint does not run the injection check. The API and SDK default is false, so the wider review is off unless turned on. A missing answer on the injection check denies the request.Vendors process data under contract and only on our instructions. Paddle is the exception by design: as merchant of record it is the seller of your subscription and an independent controller of the billing data you give it at checkout, not our processor.
Which of these are DPA sub-processors. AWS, OpenAI, Brevo, Cloudflare (the sign-in bot check) and Paddle may process customer personal data through the Service, so they appear in the sub-processor table of the DPA and carry its notice and objection rights. Cloudflare's hosting of the dashboard and trust portal, GitHub, api.ada-tool.com and Sectigo are not sub-processors under that DPA. They relate to frontend hosting, source-code hosting, analytics on our own properties and timestamping a hash, where we act as an independent controller, which is why they are named here and not in the DPA table.
Accounts in the US region have their submitted content processed (it is checked, never stored) and their audit records stored in the United States, and the exceptions listed below are processed where those vendors operate. Where required, we use appropriate safeguards (e.g. Standard Contractual Clauses) for transfers from the EEA/UK.
Accounts in the EU region have their submitted content processed (it is checked, never stored) and their audit records stored in the EU. Exceptions: the injection meaning check (OpenAI, US) on a paid plan after a clean phrase pass, when the month's model budget covers it, and the wider legal review (OpenAI, US) when you enable it; transactional email (Brevo); billing (Paddle), which never receives content; subscription-plan and account-identity metadata (plan tier, status, account email) exchanged between regions to route billing and sign-in; and the sign-in bot check (Cloudflare), which receives the signing-in user's IP address and browser signals.
We use industry-standard controls appropriate to a cloud API product (TLS in transit, access controls, secret management, auditability). No method of transmission or storage is perfectly secure; please protect your API keys and rotate them if you believe they are compromised.
Depending on your location, you may have rights to access, correct, delete, restrict, or port personal data, and to object to certain processing or withdraw consent. Contact support@complyedge.io. You may also lodge a complaint with your local supervisory authority.
If we process data as your processor, we will assist you in responding to data-subject requests as required by your DPA and applicable law.
Strictly necessary. We use cookies or local storage for authentication and session continuity on the dashboard. These are required for the Service to function and are set without a separate analytics consent step.
Analytics preference. On marketing pages, on AI Trust Center pages and on the dashboard we also store your analytics Accept/Decline choice in local storage so we can honour it. Remembering a refusal is necessary to honour it.
Marketing analytics, consent required. On our marketing pages (complyedge.io) we use an analytics service operated on our behalf at api.ada-tool.com to measure which pages are read. It stores a randomly generated session_id and user_id in your browser's local storage and sends the page URL (including any query string), path and timestamp to that domain. That server also records your IP address, browser user agent and the device type, operating system and browser read from it, your browser language and the referring page, and uses your IP address and browser language to recognise a returning visitor. It does not load, and nothing for that pixel is stored, unless you accept it when first asked. Declining is remembered and you are not asked again on that browser (except on local development hosts used for product testing). Because the data is transmitted to a domain other than complyedge.io we describe it as a third-party recipient under this Policy.
Dashboard product analytics, consent required. On the dashboard we can send product-funnel events (for example sign-in and first dashboard view) to the same api.ada-tool.com operator so we can improve onboarding. Those events use the same identifiers and fields, and the server records the same IP address and browser details. The dashboard asks separately, because it is a different site from complyedge.io, and it sends nothing and stores no identifier unless you accept.
AI Trust Center analytics, consent required. AI Trust Center pages (trust.complyedge.io) use the same api.ada-tool.com service, with the same identifiers, fields and recorded IP address and browser details, to measure which trust pages are read. They are a different site from complyedge.io, so they ask separately, and nothing loads and no identifier is stored unless you accept.
Changing your choice. Use Analytics settings at the bottom of any page, on complyedge.io, on AI Trust Center pages or on the dashboard. It reopens the same choice, so you can withdraw consent with one click, the same way you gave it. Declining removes the analytics identifiers from your browser. We do not use advertising trackers, and we do not perform cross-site ad retargeting anywhere. Marketing pages may load fonts or CSS from third-party CDNs (for example Google Fonts) for presentation only.
The Service is built for professional / organizational use and is not directed to children under 16. We do not knowingly collect their personal data.
We may update this Policy. Material changes will be posted with a new “Last updated” date. Continued use after the effective date constitutes acceptance where permitted by law.
Use of the Service is also subject to our Terms of Service. Where we act as your processor, see the Data Processing Agreement.