Privacy Notice
Effective November 3, 2026
This notice explains what information Compliwright collects, why, and what we do with it. Our approach is data minimization: we keep what we need to run your license and your compliance records, and we don't retain sensitive compliance inputs after document generation.
What we keep
- Account information: your email address, your organization's name and state, your team members' email addresses, and your license status.
- Compliance records you choose to save in the portal (for example audit logs, checklists and trackers). These are encrypted when stored and visible only to your organization.
- A basic company profile for the DBE kit: company name, state, certification type and trade, so next year's documents can be pre-filled.
- Security and audit records: events such as sign-ins, license activations and changes to records (not their contents), kept to protect accounts and investigate problems.
What we don't keep
- DBE personal narratives and personal net worth figures are used to generate your documents and are not retained afterwards.
- The portal is designed not to store Social Security numbers, immigration document numbers, patient details or personal financial figures, and it rejects many entries that look like them.
- We don't see or store your payment card details; payments are handled by Lemon Squeezy.
- We use no advertising or analytics trackers. The portal sets one cookie, needed to keep you signed in.
Service providers
We use a small number of providers to run the Service, each only for its stated purpose:
- Cloudflare: hosting, database and network security.
- Lemon Squeezy: checkout, payments, sales tax and license keys (merchant of record).
- Resend: sending sign-in links and account emails.
- Zoho: our business email inbox, if you write to us.
We don't sell or rent personal information.
How long we keep it
Account and license information is kept while you have a license and as long as needed afterwards for legal, tax and security purposes. Stored records stay available for a limited period after a license ends (see the terms), then may be deleted. Records you delete are removed from the active database; our hosting provider's backups may retain them for a limited time before they expire.
Your choices
You can ask for a copy of your information, a correction, or deletion of your account and records by emailing hello@compliwright.com from the email address on your account.
Security
Sign-in uses single-use email links. Sessions expire automatically. Stored records are encrypted. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you as required by law.
Changes
We will post updates on this page with a new effective date.