Privacy policy

Last updated: 14 October 2026

Clause Ten Consulting ("we", "us") is the controller of the personal data described here. Contact: contact@clausetenconsulting.com

The software does not upload your documents

Complyvane runs on your own computer. Your policies, procedures and records – including any staff records inside them – stay on that computer. We never receive them.

The only times the software connects to the internet are:

• Licence activation. When you click Activate (and when you Deactivate) the software sends us your licence key, the email address the licence was issued to, a computer identifier (a one-way code, not your hardware serial number) and your computer's name. We use these to check the key and to count how many computers use it. We keep them while the licence is active and for 12 months afterwards.
• Standards updates. Once a day the software downloads the latest requirement set from our website. Nothing about you or your documents is sent – it is a plain download.
• Optional AI checking or drafting. Only if you switch it on and tick the consent box, short excerpts of the relevant document are sent to the AI provider you choose (for example Anthropic's Claude API) under that provider's terms. You can switch this off at any time.

Our website and booking form

When you book a demo, ask for a quote or contact us, we receive the details you enter: your name, company, email, phone number, the standards you are interested in, your preferred times and your message. We use them to arrange the demo or quote and to reply to you (legitimate interests, and steps before a contract). The booking is sent to us by email through Brevo, our email provider. We keep enquiries for up to 24 months, or longer if you become a customer.

Payments

Payments are taken by Stripe. We receive your name, email address, billing address and the product you bought; we never see your full card details. We keep payment records for six years to meet tax and accounting rules.

The client portal (app.complyvane.com)

Consultants who subscribe to the portal add-on can share action plans, evidence checklists and documents with their clients. For portal data the consultant (or their client) is the controller and we act as their processor under a data processing agreement. The portal stores the names and email addresses of invited people, what they upload, their typed signatures on document approvals and a log of changes. It uses one essential cookie to keep you signed in. Files are stored with Cloudflare in the EU/UK. The consultant can delete a client's portal data at any time.

Deleting your portal account

Portal accounts are set up by your consultant (or your organisation's portal administrator). To delete your account and the personal data linked to it, ask them to remove you, or email contact@clausetenconsulting.com from the address you sign in with and we will delete it within 30 days. Records your organisation must keep (for example signed document approvals) are kept by your organisation as controller; we delete everything else, including your login, name and email address. Removing the Android app from your phone does not delete your account.

Sign in with Google and Google Drive

If you choose Sign in with Google, Google tells us your name, email address and whether that email is verified. We use the email only to find your portal account and sign you in; we do not receive your Google password.

If you use Choose from Google Drive, Save to Google Drive or Open with Clause Ten in Google Drive, the portal asks for Google's *drive.file* permission. That lets it see only the files you pick or create with it – never the rest of your Drive. The file you pick is copied into the portal as evidence, exactly as if you had uploaded it from your computer. The access token stays in your browser for up to an hour and is not stored by us. You can remove access at any time at myaccount.google.com › Security › Third-party apps.

We do not sell Google user data, use it for advertising, or use it to train AI models. Clause Ten's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who else handles data for us

• Cloudflare – hosts our booking, licence and software pages.
• Stripe – processes payments.
• Brevo – sends booking, confirmation, sign-in and portal reminder emails.
• Google – only when you choose Sign in with Google or Google Drive (see above).
• Wix – hosts our main website.

Some of these providers may process data outside the UK; where they do, they use safeguards approved under UK data protection law, such as the UK International Data Transfer Addendum.

Cookies

Our booking, licence and software pages do not set cookies or use tracking. The client portal uses only essential sign-in cookies. Our main website (hosted by Wix) may use cookies, as explained on that site.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict its use. Email contact@clausetenconsulting.com and we will reply within one month. If you are unhappy with our reply you can complain to the Information Commissioner's Office (ico.org.uk).