Privacy Policy

1. Introduction

ComplyCore (“ComplyCore,” “we,” “us,” or “our”) respects your privacy and is committed to handling personal data responsibly.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you visit our website, create an account, use our developer tools, connect a repository, subscribe to our Services, communicate with us, or otherwise interact with us.

ComplyCore is operated by Lexia Technologies Limited, with its registered address at 78, Bode Thomas Street, Surulere, Lagos State.

This Policy is intended to support transparency under applicable data protection laws, including the Nigeria Data Protection Act 2023 (NDPA), and, where applicable, the General Data Protection Regulation (GDPR) and other relevant privacy laws.

2. Our Role in Data Processing

Our role depends on the circumstances.

• When we manage our own business relationship with you: We generally act as a data controller or equivalent entity, determining why and how account, billing, support, and website-related personal data is processed.
• When a customer uses ComplyCore to analyse its software or systems: The customer may determine the purpose and scope of the analysis. Depending on the data involved and the service configuration, ComplyCore may act as a processor on the customer’s behalf.
• When roles are shared or different: The parties’ actual activities, applicable law, and any relevant contract determine their respective responsibilities.

Where required, we will enter into a data processing agreement with customers and provide additional information about the processing we perform on their behalf.

3. Personal Data We May Collect

The data we collect depends on how you interact with ComplyCore and which features you use.

3.1 Account and profile information

This may include:

• Name and email address.
• Organisation or company name.
• Job title or professional role, if provided.
• Authentication and account preferences.
• Team membership, roles, and workspace settings.

3.2 Subscription and transaction information

If you purchase a paid plan, we may process subscription tier, billing status, transaction references, invoices, billing contact details, and payment history.

Payment card or other sensitive payment details may be collected directly by our payment processor rather than stored by ComplyCore. The actual handling depends on the payment method and provider used.

3.3 Product and technical information

When you use our Services, we may collect:

• Feature usage and interactions.
• Scan requests, scan status, findings, severity classifications, and remediation status.
• Project identifiers, repository metadata, configuration information, and activity logs.
• Diagnostic data, error reports, performance information, and version details.
• Device, browser, operating system, IP address, and timestamps, where collected.

3.4 Source code and repository information

Certain ComplyCore features may require access to source code, repository content, configuration files, dependency information, or infrastructure definitions.

The information processed depends on the features you enable and the permissions you grant.

Important: Before using a feature that transmits code or repository content to ComplyCore or an external service, review the applicable product notice and configuration. We will describe the relevant data flows and processing purposes in the product documentation or applicable agreement.

Do not connect repositories or submit content unless you have the necessary authority and permissions.

3.5 Communications and support

If you contact us, request a demonstration, submit feedback, or participate in a pilot, we may process your contact details, messages, meeting notes, support requests, and information you choose to provide.

3.6 Website and cookie information

We may collect information about visits to our website through cookies and similar technologies. See our Cookie Policy for details.

3.7 Information from integrations

If you connect a third-party service, we may receive information permitted by the integration and the permissions you approve. This may include account identifiers, repository metadata, pull-request information, or workflow events.

3.8 Information we do not intentionally seek

Unless a feature expressly supports the relevant processing and you have a lawful basis to use it, do not submit special-category personal data, sensitive personal information, production credentials, private keys, passwords, or unrelated personal data through ComplyCore.

4. How We Use Personal Data

Subject to applicable law, we may use personal data to:

• Create and administer accounts and workspaces.
• Provide scans, findings, dashboards, reports, and other requested features.
• Authenticate users and manage permissions.
• Process subscriptions, invoices, and payments.
• Respond to questions, provide customer support, and communicate service notices.
• Maintain, secure, troubleshoot, and improve the Services.
• Detect misuse, investigate incidents, and enforce our Terms & Conditions.
• Send product updates, invitations, and marketing communications where permitted.
• Meet legal, accounting, regulatory, and contractual obligations.
• Establish, exercise, or defend legal claims.

We will not use personal data for a materially different purpose that is incompatible with the original purpose unless permitted by law and, where required, after providing additional notice or obtaining consent.

5. Legal Bases for Processing

Where the NDPA, GDPR, or another applicable law requires a legal basis, we will rely on an appropriate basis for the relevant processing activity. Depending on the circumstances, this may include:

• Contract: To provide requested Services, manage your account, or take steps at your request before entering into a contract.
• Legitimate interests: To secure, maintain, improve, and administer our Services, prevent misuse, and manage business operations, where those interests are not overridden by your rights.
• Consent: For processing activities where consent is required or where we choose to rely on consent, such as certain marketing or non-essential cookie activities.
• Legal obligation: To comply with applicable legal, tax, accounting, or regulatory requirements.
• Legal claims or other permitted grounds: Where recognised by applicable law.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal or processing that has another valid legal basis.

6. Source Code and AI-Assisted Analysis

ComplyCore is designed to help developers identify potential compliance risks. The precise handling of source code and related technical data depends on the product features and configuration.

Where AI-assisted analysis is enabled, code snippets, findings, metadata, prompts, or other relevant inputs may be processed to generate explanations or recommendations.

Before enabling or using such features, you should review the relevant in-product notice to understand:

• What information is transmitted.
• Whether processing occurs locally, on ComplyCore infrastructure, or through a third-party provider.
• The purpose and duration of processing.
• Which service providers may receive the information.
• Whether any separate configuration or consent is required.

We will not claim that code remains exclusively on your device unless that is accurate for the specific feature you are using.

Model training: The use of customer source code or confidential customer content to train general-purpose AI models must be governed by a clearly disclosed policy and the applicable customer agreement. ComplyCore will not treat submission of code for compliance analysis, by itself, as permission to use that code for unrelated model training.

Customers remain responsible for ensuring that code and data submitted for analysis may lawfully be processed.

7. How We Share Personal Data

We may disclose personal data to the following categories of recipients, where necessary and subject to appropriate safeguards:

• Hosting and infrastructure providers: To host, store, operate, and secure the Services.
• AI or analysis providers: Where required for an enabled feature and disclosed in the relevant product notice or agreement.
• Payment and billing providers: To process transactions and manage subscriptions.
• Authentication, communication, and support providers: To enable sign-in, send service communications, and manage support.
• Analytics and monitoring providers: To understand website or product performance where enabled and lawful.
• Professional advisers: Such as lawyers, auditors, and accountants, subject to appropriate confidentiality obligations.
• Authorities and other parties: Where required by law, valid legal process, or to protect legal rights and safety.
• Business transaction parties: In connection with a proposed or completed merger, financing, restructuring, or sale of relevant business assets, subject to appropriate protections.

We do not sell personal data in exchange for money. If our practices regarding advertising, data sharing, or monetisation change, we will update this Policy and obtain consent where required.

We will identify or describe relevant service providers in our product documentation, contractual materials, or a supplementary subprocessor list where appropriate.

8. International Data Transfers

Our service providers or infrastructure may be located outside Nigeria or your country of residence. As a result, personal data may be transferred to or accessed from other jurisdictions.

Where a transfer is subject to legal restrictions, we will implement the safeguards required by applicable law. These may include an adequacy mechanism, contractual protections, or another legally recognised transfer mechanism.

You may contact us for additional information about relevant international transfers and safeguards, subject to applicable law and security considerations.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining security, resolving disputes, enforcing agreements, and meeting legal obligations.

Retention periods depend on the type of data and how it is used. For example:

• Account information may be retained while your account is active and for a reasonable period afterward.
• Billing and transaction records may be retained for the period required by tax, accounting, or other laws.
• Security and diagnostic logs may be retained for a limited period appropriate to security and operational needs.
• Scan results, reports, and repository-related information may be retained according to your plan, workspace settings, product configuration, or enterprise agreement.
• Support communications may be retained for a reasonable period to resolve issues and maintain service records.

When personal data is no longer required, we will delete, anonymise, or securely dispose of it, subject to legal obligations, legitimate dispute requirements, and appropriate backup deletion cycles.

If you require specific retention or deletion arrangements, contact us or consult your enterprise agreement.

10. Data Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction.

Depending on the service and deployment, safeguards may include access controls, authentication mechanisms, encryption, monitoring, secure development practices, and restricted access to operational systems.

No system or method of transmission is completely secure. We cannot guarantee absolute security, but we will take measures appropriate to the risks and our legal obligations.

If a personal data breach occurs, we will assess and respond to it in accordance with applicable law and any contractual obligations, including notifications to affected parties or authorities where required.

11. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of personal data in appropriate circumstances.
• Request restriction of or object to certain processing.
• Request portability of eligible data.
• Withdraw consent where processing is based on consent.
• Object to direct marketing.
• Lodge a complaint with the relevant data protection authority.
• Seek review of certain automated decisions where applicable law provides such a right.

These rights are subject to legal exceptions and may differ depending on the applicable jurisdiction and our role in the processing.

To exercise a right, contact us using the details in Section 16. We may need to verify your identity before responding. We will respond within the period required by applicable law.

If ComplyCore processes information on behalf of one of our business customers, you may need to direct your request to that customer. Where appropriate, we will assist the customer in responding.

12. Children’s Privacy

ComplyCore is intended for professional and business use and is not designed to target children. We do not knowingly collect personal data from children in circumstances where such collection is prohibited by law.

If you believe a child has provided personal data to us inappropriately, contact us so that we can assess the matter and take appropriate action.

13. Third-Party Websites and Services

Our website or Services may contain links to third-party websites or integrate with third-party services. Their privacy practices are governed by their own policies.

We are not responsible for the privacy, security, or content practices of services that we do not control. Review their privacy notices before providing personal data or enabling an integration.

14. Marketing Communications

We may send service-related messages, such as account confirmations, security alerts, billing notices, and important product updates.

Where permitted, we may also send product announcements, event invitations, and other marketing communications. You can opt out of marketing emails using the unsubscribe mechanism or by contacting us. Opting out of marketing will not prevent us from sending essential service or legal notices.

15. Changes to This Privacy Policy

We may update this Policy as our Services, processing activities, or legal obligations change.

We will publish the revised Policy with an updated “Last Updated” date. Where required by law, we will provide additional notice or seek consent for material changes.

16. Contact Us and Privacy Requests

For privacy questions, data subject requests, or complaints, contact:

Lexia Technologies Limited
Privacy Contact: contact@getcomplycore.cm
Website: https://getcomplycore.com/

If you are dissatisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority, including the Nigeria Data Protection Commission where applicable.