Privacy Policy

This is not an audit and not legal advice. This page describes, in plain language, how the ComplianceForge software service processes personal data.

Operator: UGS Ltd — Universal Global Services Ltd, registered in England and Wales, Company No. 17423506 · Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom · VAT registration applied for; not yet valid · Last updated: 22 September 2026

1. Who we are

ComplianceForge (Compliance-as-a-Service), operated by Universal Global Services Ltd ("UGS", "we", "us"), a company registered in England and Wales (Company No. 17423506) with registered address 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, is the controller for the personal data described on this page. Contact: [email protected].

2. What data we process

Account data: your name and email address, received when you sign in with Google.
Service data: your readiness check answers and results, generated documents and their version history.
Audit data: action log entries that record what happened in your account (for traceability).
Technical data: authentication sessions and operational logs needed to run and secure the service.
Billing data: plan, charges and payment status handled by our payment provider (we do not store full card numbers).

3. Why we process it

To provide the service you request (performance of a contract), to keep the service secure and reliable (legitimate interest), and to meet legal obligations. We do not sell personal data and we do not use it for advertising.

4. Third-party service providers (sub-processors)

We use the following categories of service providers to run ComplianceForge. Each processes data only for the stated purpose and under our instructions where applicable:

Google (Google OAuth) — sign-in / authentication (account data: name, email).
Stripe — payments and billing (plan, charges, VAT handling at checkout; we do not store full card details).
LiteLLM (AI gateway) — routing of AI-assisted gap analysis and AI assistant requests (prompts and results stored with your account for traceability).
PostgreSQL — our database (stores account data, service data, audit logs) on EU-hosted infrastructure.
EU-hosted infrastructure provider(s) — hosting of the application and website in the EU.
Transactional mail (local SMTP relay) — sending service emails (sign-in, billing, support replies).

A current sub-processor list is available on request at [email protected].

5. AI processing

AI gap analysis is an assistive feature. Prompts and results are stored with your account for traceability (model, cost, timestamp). AI output is advisory, is not legal advice, and must be reviewed by a qualified professional before it is relied on.

6. Sharing and location

Sign-in is provided through Google OAuth. Payments are provided through Stripe. The service is hosted in the EU. We use service providers under data processing agreements; we do not transfer personal data for advertising purposes.

7. Retention

We keep personal data only as long as needed for the purposes above, and then delete or anonymise it. You can request deletion of your account data at any time.

8. Your rights

You have the right to access, rectify, erase, restrict, port and object. Contact [email protected]. You may also lodge a complaint with your supervisory authority.

9. Changes

Material changes are announced on this site. This page is not legal advice to you: have your own privacy documentation reviewed by a qualified professional.