CompliGUARD compliance platform logoCompliGUARD

    Privacy Policy

    Effective: 19 April 2026 — Version 1.1

    1. About CompliGUARD

    CompliGUARD is operated by CompliGUARD Pty Ltd (ACN 697 118 228) ('CompliGUARD', 'we', 'our', or 'us'). We provide AI-assisted compliance infrastructure for the Australian vitamins, dietary supplements, and complementary medicine (VDS) market. Our platform assesses health marketing content against the TGA Advertising Code 2021, FSANZ Food Standards Code, ACCC guidelines, and AHPRA Advertising Guidelines.

    We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

    2. About This Privacy Policy

    This Privacy Policy applies when you access or use the CompliGUARD platform, visit compliguard.com.au (Website), interact with our compliance assessment workflows, or otherwise communicate with us.

    It explains what personal information we collect, how we collect it, why we collect it, how we use it, who we share it with, and how you can exercise your privacy rights.

    3. Personal Information We Collect

    3.1 How We Collect Personal Information

    Most of the personal information we collect is obtained directly from you when you:

    • create an account with us;
    • use the CompliGUARD platform;
    • visit our Website;
    • submit Customer Content (as defined in clause 3.3); or
    • contact us via phone, email, letter, social media, or any other platform.

    In some circumstances, we may obtain personal information from third parties, such as payment processors and service providers, as well as from publicly available sources where relevant.

    We may also collect personal information automatically through your use of our Website and platform, including through cookies, analytics providers and similar technologies. Cookies are small data files stored on your device that help us improve functionality, analyse usage, and enhance user experience.

    We may use:

    • essential cookies to enable core platform functionality; and
    • analytics cookies to understand how users interact with our Website and platform.

    You can control or disable cookies through your browser settings. However, disabling cookies may affect the functionality of our Website or platform. For more information about cookies, please visit oaic.gov.au or youronlinechoices.com.

    3.2 Account and Contact Information

    When you register for or use CompliGUARD, we collect:

    • Name and email address
    • Company or brand name, job title, and industry
    • Billing address and payment information (processed via Stripe — we do not store card details)
    • Any other information you voluntarily provide when contacting us

    3.3 Content You Submit for Assessment

    Our core service requires you to submit marketing content for compliance review. This may include:

    • Advertising copy, product claims, and promotional materials
    • Product names, product identifiers, and ingredient information
    • URLs and digital channel information (social media, email, web)

    This content is referred to as 'Customer Content'. We process Customer Content solely to deliver compliance assessments. We do not use Customer Content to train AI models, and our AI provider (Anthropic) applies a Zero Data Retention policy, meaning Customer Content is processed for the purposes of generating assessments and is not retained by Anthropic after processing.

    3.4 Usage and Technical Data

    We automatically collect technical information when you use our platform, including:

    • IP address, device type, browser type, and operating system
    • Session activity, pages visited, and feature interactions
    • Date and time of access

    This data is used for platform security, performance monitoring, and product improvement.

    3.5 Payment Data

    Payments are processed by Stripe. We receive transaction status and billing reference information only. We do not store, process, or have access to your full card or bank details.

    4. How We Use Your Personal Information

    4.1 Purpose

    We collect and use your personal information to:

    • Provide access to and operate the CompliGUARD platform
    • Deliver compliance assessment services you have subscribed to
    • Manage your account, billing, and subscription
    • Communicate with you, including responding to inquiries and providing support
    • Send compliance reports, alerts, and platform notifications
    • Respond to support requests and inquiries
    • Improve and develop the CompliGUARD platform to ensure platform security, prevent fraud and performance monitoring
    • Comply with our legal and regulatory obligations
    • Communicate product updates and relevant compliance information (you may opt out of marketing communications at any time)

    If you do not provide certain personal information, we may not be able to provide our services, process your requests, or respond to your inquiries.

    4.2 Legal Bases

    We process your personal information based on:

    • contractual necessity (to deliver the service);
    • legitimate interests (security, fraud prevention, platform improvement);
    • compliance with legal obligations; and
    • where required, your consent.

    5. How Long We Keep Your Information

    We retain personal information for as long as necessary to fulfil the purposes set out in this policy, subject to the following:

    • Account information: retained for the duration of your subscription
    • Customer Content (submitted marketing materials): retained for the duration of your subscription, then generally deleted within 30 days of account closure unless you request earlier deletion
    • Usage and technical data: retained for 12 months for security and performance purposes
    • Financial records: retained for 7 years to comply with Australian tax obligations

    6. When and With Whom We Share Your Information

    6.1 AI Processing — Anthropic

    Compliance assessments are powered by Claude, an AI model developed by Anthropic. Customer Content is transmitted to the Anthropic API solely for assessment processing. Anthropic:

    • Is prohibited from using Customer Content for model training
    • Applies a Zero Data Retention policy — content is not logged or stored after processing
    • Processes data under appropriate data processing agreements

    6.2 Workflow Automation, Code Hosting and Frontend — n8n, Airtable, GitHub and Lovable

    Our assessment workflow uses n8n (workflow automation) and Airtable (intake and record management). Our regulatory knowledge base and automated compliance alerts pipeline are hosted on GitHub (operated by Microsoft Corp.), which stores regulatory reference documents only and does not process Customer Personal Data. Our platform frontend is hosted by Lovable Technologies. All providers process data under service agreements and are bound by appropriate data protection obligations.

    6.3 Payment Processing — Stripe

    Payment processing is handled by Stripe. Stripe's privacy policy governs how payment data is handled. We recommend reviewing Stripe's policy at stripe.com/au/privacy.

    6.4 Email Delivery and Internal Operations

    Compliance reports, regulatory alerts, and transactional emails are delivered via Loops, Inc., our email delivery provider. We use industry-standard TLS encryption for all email communications. Internal team operations and notifications are managed via Slack (operated by Salesforce). Slack has access to limited operational data only and does not process Customer Content submitted for compliance review.

    6.5 Legal Disclosures

    We may disclose your information if required by law, court order, or a regulatory authority, including the TGA, ACCC, or Australian Privacy Commissioner. We will notify you of any such disclosure to the extent permitted by law.

    6.6 Business Transfers

    In the event of a merger, acquisition, or sale of assets, your personal information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

    7. International Transfers

    Some of our service providers operate outside Australia.

    Where personal information is transferred internationally, we take reasonable steps to ensure that those recipients handle Personal Information in a manner consistent with Australian Privacy Principle 8, including through contractual arrangements and data protection safeguards.

    8. Security

    We implement industry-standard security measures to protect your personal information, including:

    • AES-256 encryption at rest and TLS encryption in transit
    • Access controls and role-based permissions
    • Supabase authentication infrastructure
    • Regular security reviews and penetration testing

    No system is completely secure. If you believe your account has been compromised, please contact us immediately at privacy@compliguard.com.au.

    9. Your Privacy Rights

    Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

    • Access the personal information we hold about you
    • Request correction of inaccurate, incomplete, or outdated information
    • Request deletion of your personal information (subject to legal retention obligations)
    • Withdraw consent to marketing communications
    • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

    To exercise any of these rights, contact us at privacy@compliguard.com.au. We will respond within a reasonable period, and generally 30 days. We may need to verify your identity before processing your request.

    10. Children

    CompliGUARD is a business-to-business service. We do not knowingly collect personal information from individuals under the age of 18. If you believe we hold information about a minor, please contact us immediately.

    11. Links to Third-Party Services

    Our platform may contain links to third-party websites and services. This Privacy Policy does not apply to those services. We encourage you to review the privacy policies of any third-party services you access.

    12. AI-Specific Disclosures

    In accordance with the Australian Government's Guidance for AI Adoption (October 2025), we disclose the following about our AI systems:

    • CompliGUARD uses Claude (Anthropic) to generate compliance assessments. Claude is a large language model (LLM).
    • AI-generated assessments are informational outputs, not legal advice. Your organisation is responsible for reviewing all assessments and should not rely on them without appropriate human review before making compliance decisions.
    • Our AI assessments are based on the regulatory frameworks in effect at the time of assessment. Regulatory changes may not be immediately reflected.
    • Customers retain full accountability for their regulatory compliance. CompliGUARD assessments constitute evidence of due diligence, not a guarantee of compliance.
    • We maintain human oversight of AI system performance and regularly review assessment quality.
    • We do not use Customer Content to train or fine-tune our AI models without your explicit consent, and our AI providers are contractually restricted from using such data for training purposes.

    13. Contact Us

    For privacy-related inquiries, requests, or complaints:

    Email: privacy@compliguard.com.au

    Website: compliguard.com.au

    If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by phone on 1300 363 992.

    14. Updates to This Policy

    We may update this Privacy Policy from time to time. Material changes will be communicated via email or a platform notification at least 14 days before taking effect. The current version is always available at compliguard.com.au/privacy.