This Privacy Policy describes how CheckCalm ("we", "us", or "our") collects, uses, and protects your personal information when you use our compliance automation platform at
checkcalm.com and
app.checkcalm.com.
1. Information We Collect
Information you provide directly
- Account information: Name, email address, company name when you register
- Documents: PDF, DOCX and other files you upload for compliance analysis
- Communications: Messages you send us via support@checkcalm.com or our contact form
Information collected automatically
- Log data: IP address, browser type, pages visited, timestamps
- Usage data: Features used, documents analyzed, compliance scores
- Device data: Browser version, operating system type
2. How We Use Your Information
We use your information to:
- Provide, maintain and improve the CheckCalm platform
- Verify your email address and authenticate your account
- Process your documents through AI analysis to map compliance controls
- Generate personalized security policies tailored to your business
- Send transactional emails (verification, password reset, system notifications)
- Respond to your support inquiries
- Detect and prevent fraud and abuse (rate limiting, security monitoring)
- Analyze usage trends to improve our service
- Comply with legal obligations
We do not sell your personal information, use it for advertising, or share it for marketing purposes.
3. AI Processing
CheckCalm uses AI to analyze your compliance documents. Here is how it works:
- Documents you upload are processed by Anthropic's Claude API for compliance analysis
- Document text is converted into embeddings using OpenAI's API for semantic search
- Document content is stored in our database (hosted on AWS in EU Ireland) and used only to provide the service to your organization
- We do not use your document content to train AI models
- AI-generated results (control mappings, policy drafts) are stored in your account
You can opt out of AI processing by contacting us at support@checkcalm.com. Note that opting out will significantly limit platform functionality.
4. Third-Party Service Providers
We share data with the following service providers solely to operate our platform:
| Provider | Purpose | Data shared | Location |
|---|
| Amazon Web Services (AWS) | Cloud hosting, file storage (S3) | All platform data | EU (Ireland) |
| Anthropic | AI document analysis (Claude API) | Document content | USA |
| OpenAI | Text embeddings for semantic search | Document text chunks | USA |
| Resend | Transactional email delivery | Email address | USA |
All third-party providers have data processing agreements in place and are obligated to protect your data.
5. Data Security
We implement industry-standard security measures:
- HTTPS/TLS encryption on all connections
- Passwords stored as bcrypt hashes (never in plain text)
- Authentication tokens stored in HttpOnly cookies to prevent XSS
- Files stored in private AWS S3 buckets with time-limited presigned URLs
- Rate limiting to prevent brute force attacks
- Server located in AWS EU (Ireland) — eu-west-1 region
No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
6. Data Retention
We retain your personal information for as long as your account is active. When you delete your account:
- Your personal information is deleted within 30 days
- Uploaded documents are removed from our storage
- Some data may be retained in backups for up to 90 days
- We may retain certain information as required by law
7. Your Rights
Depending on your location, you may have the following rights:
- Access: Request a copy of your personal data
- Correction: Update inaccurate information via account settings
- Deletion: Request deletion of your account and data
- Portability: Receive your data in a machine-readable format
- Objection: Object to certain processing of your data
- Restriction: Request restriction of processing in certain circumstances
To exercise any of these rights, contact us at support@checkcalm.com or use our contact form. We will respond within 30 days.
8. Cookies
We use only essential cookies necessary for the platform to function:
- Authentication cookie: HttpOnly cookie containing your refresh token — required to keep you logged in
- Session cookie: Temporary session identifier
We do not use tracking cookies, analytics cookies, or advertising cookies. For more details, see our Cookie Policy.
9. GDPR & International Transfers
Our primary servers are located in the EU (AWS Ireland, eu-west-1). If you are located in the European Economic Area (EEA), we process your data under the following legal bases:
- Contract performance: To provide the services you signed up for
- Legitimate interests: Security, fraud prevention, service improvement
- Legal obligation: Where required by applicable law
Some data is transferred to the USA (Anthropic, OpenAI, Resend). These transfers are covered by Standard Contractual Clauses (SCCs) and the providers' data processing agreements.
10. Children's Privacy
CheckCalm is a B2B platform intended for business use only. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that a minor has provided us with personal information, we will delete it immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Updating the "Last updated" date at the top of this page
- Sending an email notification to your registered email address
Continued use of CheckCalm after changes constitutes acceptance of the updated policy.
For privacy-related questions, requests, or complaints:
We aim to respond to all privacy requests within 30 days.