1. Who is responsible
The ComplyWise platform ("the Platform") is operated by Opuswise Limited (Hong Kong), referred to here as "we" and "us". Questions about this policy or about your data go to support@complywise.io.
We play two different roles, and it matters which one applies to a given piece of data:
- We are the controller for the data we hold about you as an account holder, member or link recipient, for the operation and security of the Platform, and for our own communications with you (sections 3, 5 and 6).
- We are a processor for the content an organisation stores in its workspace. The organisation that runs the workspace decides what goes in and why, and it is the controller of any personal data in it. We process that content on its instructions to provide the Platform (section 4). If your personal data is in a workspace because an organisation uploaded it, that organisation is the first place to direct questions, and we will help it respond.
2. The data in short
| Whose data | What | Why we hold it |
|---|---|---|
| Account holders and members | Name, email address, password (stored only as a hash), role, workspace memberships, profile details you add such as a photo, time zone or saved signature, sign-in and activity records | To run your account, to secure the Platform and to keep the audit trail an organisation relies on |
| People whose details an organisation stores in its workspace | Whatever the organisation records: directors, owners and their identity documents, counterparties, signatories, customers, comments and notes | Processed for the organisation, on its instructions |
| Link recipients | Email address where the sender recorded it or you entered it, one-time codes (hash only), IP address, browser details, what you viewed, uploaded, signed or downloaded, and when | To operate the link, to prove who accessed what, and to protect the sender |
| Account requesters | Name, organisation, work email, jurisdiction, IP address and browser details | To review the request and to protect the form from abuse |
| Support contacts | Name, email and the message you send | To answer you |
We do not buy personal data, we do not sell it, and we do not use it for advertising.
3. Account holders and members
What we collect. When an organisation invites you, we receive your email address and the role you have been given. When you accept, you set a password, which we store only as a cryptographic hash, and you may add a display name, photo, time zone, notification preferences and a saved signature image. As you use the Platform we record what you do inside a workspace (for example that you uploaded a document, approved a review or sent an envelope) with a timestamp and your network address, because the organisation you work for relies on that trail.
Why and on what basis. We process this data to perform our agreement with you and your organisation (the Terms of Service), to keep the Platform secure, to comply with legal obligations, and in our legitimate interest in running and improving the service.
Visibility. Your name and email are visible to the other members of the workspaces you belong to, and your actions in a workspace are visible to its administrators through the workspace audit log. Our own staff can see them when providing the service.
4. Content stored in workspaces
Organisations use the Platform to hold business verification documents, details of their owners, directors and signatories, relationships with customers, suppliers and payment providers, screening results, contracts, questionnaires, audit responses and related notes. Much of this is personal data, and some of it is identity data of the kind a bank or regulator asks for.
For this content the organisation is the controller and we are its processor. We:
- process it only to provide the Platform and as the organisation instructs through the features it uses;
- keep it separated from every other organisation's data by workspace, enforced in our database;
- pass it to third parties only where a feature the organisation chooses to use requires it (section 7);
- keep it for as long as the organisation keeps it, subject to the retention rules in section 8;
- help the organisation respond to requests from the people whose data it holds.
If you believe an organisation holds your personal data on the Platform and you want to exercise your rights, contact that organisation. If you cannot identify it, write to support@complywise.io and we will help.
5. People who open links
Organisations send links to people outside their workspace: to view a document pack, to upload requested documents, to sign a document, or to read an audit pack. If you open such a link:
- the sender may have recorded your name and email address, and some links only open for that address;
- you may be asked to enter your email address and a one-time code sent to it. We store the address and only a hash of the code;
- we record the time, your IP address and browser details, the documents you viewed or downloaded, the files you uploaded and, for signatures, your consent, the signature you adopted and the document's cryptographic hash;
- a session cookie keeps you signed in to the link for a limited time.
We hold this data because it is the evidence the sender relies on. It is visible to the organisation that sent the link. Uploaded files become part of that organisation's workspace content (section 4). Signed documents and their completion certificates are kept by the organisation as records of the agreement.
6. Account requests, support and email
Account requests are reviewed by our staff. We keep the request, the outcome and the reviewer's note. Requests are protected by a bot-detection service (section 7), which processes your IP address and browser details.
Support messages sent through the help center are emailed to our support inbox and answered from there.
Email we send. We send invitations, one-time codes, signing requests, notifications and digests that you or your organisation have triggered or opted into. Notification preferences are yours to change in your profile. We do not send marketing email from the Platform.
7. Third parties who process data for us
We use the following providers to run the Platform. Each acts on our instructions under a written agreement, and we share only what the feature requires.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database, authentication and file storage | All Platform data, encrypted at rest |
| Vercel | Hosts the application and runs its scheduled jobs | Requests to the Platform and the data needed to serve them |
| Resend | Sends email | Recipient address and the content of each message |
| Cloudflare Turnstile | Bot detection on the public forms | IP address and browser details of form visitors |
| OpenRouter and the model providers it routes to | AI assistant, document review, questionnaire drafting | The prompt and the passages of workspace documents a user attaches or the feature retrieves; only models with a zero-data-retention route are allowed, and no fallback to other routes is permitted |
| Voyage AI | Text embeddings for document search | Chunks of indexed workspace documents; the account is set not to use inputs for training |
| Hugging Face and the inference hosts it routes to | Automatic document checks and text recognition on scanned documents | Page images of the documents an organisation submits for checking |
| OpenSanctions | Sanctions, politically exposed person and watch-list screening | The name and identifying details of the party being screened |
| Elliptic | Blockchain analytics for wallet screening | The wallet address only |
| Google Cloud | Converts Word documents to PDF on request | The document being converted, for the duration of the conversion |
Some of these providers, or the hosts they route to, are outside the country where your data is stored. Where personal data leaves the European Economic Area or the United Kingdom we rely on the provider's standard contractual clauses or an adequacy decision. Ask support@complywise.io if you need the current list of transfer mechanisms.
We also disclose data where the law requires it, to professional advisers under confidentiality, and to a successor if our business is transferred, on notice to you.
8. How long we keep data
| Data | How long |
|---|---|
| Active workspace content | For as long as the organisation keeps it |
| Removed or replaced document versions | 730 days after removal by default, then permanently deleted; an organisation can shorten or lengthen this in its settings, and a legal hold pauses deletion |
| Workspace audit log | 6 years by default, adjustable by the organisation; a legal hold pauses deletion |
| Link access records and one-time-code sessions | Access records for as long as the link's audit trail is kept by the organisation; code and session records for 30 days after they expire |
| Notifications | 90 days |
| Account data | For as long as your account exists, then anonymised in the audit trail |
| Account requests and support messages | For as long as needed to handle them and to keep a record of our decision |
When an organisation asks us to close its workspace we delete its content, except where the organisation or we must keep records to meet a legal obligation such as anti-money-laundering record-keeping, in which case we keep only what the obligation requires and only for as long as it lasts.
9. Security
All traffic to the Platform is encrypted in transit and all stored data is encrypted at rest. Each organisation's data is isolated by workspace in the database, and file storage enforces the same boundaries. Sensitive operations run only on the server, links carry one-time secrets that are stored only as hashes, public forms are rate-limited and bot-protected, and the Platform ships with a strict content security policy. Our staff's access to workspaces is logged. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as the law requires.
10. Cookies
The Platform uses only the cookies it needs to work:
- a session cookie that keeps you signed in;
- for link recipients, a cookie tied to the specific link that holds your verified session and, briefly, the address a code was sent to.
They are set by us, they are not used to track you across other sites, and they expire when your session or the link does. We do not use advertising cookies. We may measure anonymous, aggregate page performance to keep the Platform fast.
11. Your rights
Depending on where you live you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to complain to a data protection authority. Where we act as processor for an organisation, we will refer your request to that organisation and help it respond. To exercise your rights, write to support@complywise.io. We may need to verify your identity first.
12. Children
The Platform is a business tool and is not directed at anyone under 18. We do not knowingly collect personal data from children.
13. Changes to this policy
We may update this policy. The effective date and version appear at the top of the page. For material changes we will tell workspace administrators by email or by a notice in the Platform before the change takes effect.
14. Contact
Opuswise Limited, Hong Kong. Email: support@complywise.io.