Privacy Policy

1. Who we are

Komply is a service operated by Growtal. We help UK venue managers prepare for the Terrorism (Protection of Premises) Act 2025 (Martyn's Law). Our registered address and ICO registration number will appear here before launch.

2. What data we collect

• Account data: email address, organisation name, and password hash (stored by Supabase Auth).
• Venue data: site name, address, venue type, expected occupancy, and compliance assessment responses.
• Evidence documents: PDFs, images, and other files you upload as compliance evidence.
• Billing data: subscription status and payment history. Card details are held by Stripe. We never store card numbers.
• Visit counts: on our public pages (the home page, the scope check, the guides and the legal pages) we count page views, and on the free scope check we count when a check is started and finished, with the tier it gave (for example “standard”), and when a result is emailed, with the same tier. This uses Vercel Web Analytics, which sets no cookies. With each view Vercel records the page, the website you came from, your browser and device type, and an approximate location worked out from your connection, and it tells visits apart without storing your IP address. We do not put your answers, your capacity figure, your name or your email address in these counts, and the pages inside your account are not counted. We also keep our own count of free checks started and finished, in our own database: for each one, whether it started or finished, the tier for a finished check, and the time. Nothing else, not your IP address and not your answers.
• Free scope check, if you ask us to email your result: your email address, and your name and venue name if you give them; your answers and the result they gave; and whether you ticked the box for updates, with the sentence beside it and the time you sent the form. The check itself needs none of this. Without the email, a check sends us nothing but the counts above.
• If a trade body, insurer, broker or similar organisation sent you to us: a short code that says which one, kept against your organisation when you create it. We use it only to count how many people each organisation has sent us and to see which member rate applies. That organisation is told a count, never who you are, your venue or your answers.

3. How we use your data

• To provide the Komply compliance readiness service
• To generate action plans and compliance reports automatically from your assessment answers
• To send transactional emails (receipts, reminders about your assessment, billing notices)
• To improve the service and fix bugs
• To understand how many people use our public pages and the free scope check
• To email you the result of a free scope check when you ask, and, only if you tick the box, to send you occasional updates about Martyn's Law and Komply

4. Legal basis for processing (UK GDPR)

• Contract: processing necessary to deliver the service you subscribed to, or to do something you ask for before subscribing, such as emailing you your free scope check result
• Legal obligation: retaining billing records
• Legitimate interest: security monitoring and fraud prevention, counting visits to our public pages, and counting how many people each organisation that recommends Komply has sent us
• Consent: optional reminder emails, and updates about Martyn's Law and Komply if you tick the box on the free scope check (you can unsubscribe at any time)

5. Where your data is stored and processed

Your account details, assessment answers and uploaded evidence are held in our Supabase database and file storage, in London, United Kingdom. Evidence documents are encrypted at rest (AES-256) and are never reachable through a public URL. Download links are signed and expire after 15 minutes for evidence files, and 60 minutes for generated compliance reports.

We require multi-factor authentication (MFA) on all accounts, and all data in transit is encrypted with TLS 1.3.

Some of our suppliers process data outside the UK. Our application runs on Vercel, and its server-side requests are currently processed in the United States. Error diagnostics are sent to Sentry in the European Union. Files you upload as evidence are checked against VirusTotal's known-malware database by cryptographic hash. The file itself is never sent.

6. Suppliers who process data for us

• Supabase: database, authentication, and file storage
• Vercel: application hosting, content delivery and cookieless visit counts
• Sentry: error monitoring (European Union)
• Upstash: background job queue and rate limiting; receives record identifiers and, to stop misuse, IP addresses and a scrambled form of an email address typed into the free scope check (made with a key only we hold); never document contents
• Stripe: payment processing
• Resend: transactional email delivery, including the free scope check result email
• Anthropic: generating your action plan and Section 7 statements from your assessment answers
• Voyage AI: generates the search embeddings that retrieve relevant statutory guidance for your action plan and Section 7 statements; receives question and guidance text, not your venue or assessment data
• VirusTotal: checks uploaded evidence files against its known-malware database by cryptographic hash; the file itself is never sent

7. Your rights

Under UK GDPR, you have the right to:

• Access your data: available via Account > Download my data
• Erasure: available via Account > Delete my account
• Rectification, portability, objection, and restriction of processing
• If you used the free scope check without an account, email info@komply.uk for a copy of what we hold, or to have it deleted
• Lodge a complaint with the ICO: ico.org.uk

8. Data retention

We retain your data for as long as your account is active. When you delete your account, your organisation's data is disabled immediately and you have 30 days to restore it yourself if you change your mind. After that window, it is permanently deleted on our next scheduled purge. Financial records of what you were charged are kept afterwards (de-linked from your organisation, not deleted) to satisfy our own financial record-keeping obligations. If a consultancy you worked with deletes its account, you keep a record that a consultancy had access to your organisation and the dates. It does not name the consultancy or its staff.

Free scope check details: if you did not tick the box for updates, we delete your details 30 days after we send the email (within a week of that day, when our weekly clear-out runs). If you ticked it, we keep them for 24 months from the day you asked for the email, and delete them within a week after that. Unsubscribing, with the link in your result email, stops any updates. If you unsubscribe while we still hold your details, we keep them for 24 months from the day you asked for the email, whether or not you ticked the box, so that we do not email that address about the free check again. Once they are deleted, the link has nothing left to act on, so if anyone sends that address another free check result and you want it stopped, email us. To have your details deleted sooner, email info@komply.uk.

9. Contact

Data protection enquiries: info@komply.uk