Privacy Policy
What personal information we collect, why we collect it, and the choices you have.
About this Privacy Policy
What personal information complead Inc. collects, why we collect it, how long we keep it, and the choices and rights you have, including under U.S. state privacy laws and the GDPR.
Applies to: complead.ai, the complead Fusion platform, and related complead products and services. Controller: complead Inc., a Delaware corporation, 1401 Pennsylvania Ave., Unit 105, Wilmington, DE 19806, New Castle County, United States.
1. About this Privacy Policy
complead Inc. (“complead,” “we,” “us,” or “our”) is a corporation incorporated in the State of Delaware, United States, with its registered office at 1401 Pennsylvania Ave., Unit 105, Wilmington, DE 19806. We operate the complead.ai website and provide the complead platform for financial crime compliance, risk, and fraud prevention (together, the “Service”).
This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to:
- visitors to complead.ai and our free tools, blog, knowledge base, and events pages;
- prospects, customers, partners, and their personnel who interact with us;
- job applicants; and
- users of the complead platform, subject to Section 3 below.
Terms used here have the same meaning as in our Terms and Conditions, unless otherwise defined.
If you do not agree with this policy, please do not use the Service.
2. Contact us
| Purpose | Contact |
|---|---|
| Privacy inquiries | privacy@complead.ai |
| Postal address | complead Inc., 1401 Pennsylvania Ave., Unit 105, Wilmington, DE 19806, United States |
| Notices and legal service | Reggae Registered Agents Inc. (registered agent), 1401 Pennsylvania Ave., Unit 105, Wilmington, DE 19806, United States |
| Data Protection Officer (if appointed) | dpo@complead.ai |
| EU/UK representative (Art. 27 GDPR) | Sanction Scanner LTD, acting as our representative for the UK and EEA; write to privacy@complead.ai, marked “Art. 27 Representative” |
| Security and vulnerability reports | security@complead.ai |
3. Our two roles: controller and service provider
This distinction matters, because different parts of this policy apply to different data.
When we act as a controller (business). We decide why and how personal information is processed. This covers website visitors, marketing contacts, prospects, customer administrators and their users’ account data, partners, job applicants, and event attendees. This Privacy Policy governs that processing.
When we act as a service provider (processor). Our customers are regulated businesses that use complead to screen and monitor their own customers, counterparties, and transactions. The personal information they submit or that we retrieve on their instruction (“Customer Data”) is processed only on their documented instructions, under the agreement and data processing addendum we sign with them. In that case:
- our customer, not complead, is the controller or business;
- we do not use Customer Data for our own marketing, product training, or profiling except as permitted by the agreement;
- if you are an individual whose data was screened by one of our customers, direct your access, correction, or deletion request to that customer. If you contact us directly, we will refer you to the relevant customer or, where required, assist them in responding.
Public source data. Our sanctions, PEP, watchlist, and adverse media databases are built from publicly available and licensed sources, including government sanctions lists, regulatory enforcement notices, official gazettes, court and corporate registries, and news media. Processing this data is necessary for us and our customers to comply with anti-money laundering, counter-terrorist financing, and sanctions obligations, and to perform a task carried out in the substantial public interest. Section 12 explains how to contact us about a record.
4. Personal information we collect
4.1 Information you give us
- Identity and contact data: name, job title, employer, business email address, business phone number, country.
- Account data: username, credentials, authentication factors, role and permissions, preferences.
- Commercial data: demo requests, trial sign-ups, procurement and security questionnaires, contract and billing contacts, purchase history.
- Support and communications: emails, chat messages, call notes, ticket contents, and recordings of demo or support calls where we tell you in advance and, where required, obtain your consent.
- Marketing data: newsletter subscriptions, webinar and event registrations, content downloads, survey responses.
- Recruitment data: resume, work history, education, right-to-work information, and anything else you include in an application.
4.2 Information we collect automatically
- Device and connection data: IP address, browser type and version, operating system, device identifiers, language, time zone.
- Usage data: pages viewed, referring and exit pages, clicks, search terms used on our site, session duration, feature usage in the platform, timestamps.
- Log and security data: authentication events, API calls, error logs, and records generated for fraud prevention, abuse detection, and audit purposes.
- Cookies and similar technologies: see Section 8 and our Cookie Policy.
4.3 Information from third parties
- business contact and firmographic data from B2B data providers and enrichment services;
- publicly available professional profiles and company registries;
- referrals from partners and resellers;
- identity verification, anti-fraud, and payment processing providers;
- our customers, where their personnel use the platform under an account.
4.4 Information we do not want
Do not send us sensitive personal information (for example, Social Security numbers, government ID numbers, precise geolocation, health data, or financial account numbers) through website forms, email, or chat. If you need to transmit such data, use the controls provided in the platform or contact us first.
5. Why we use personal information
We use personal information to:
- provide, operate, secure, and maintain the Service, including authentication and account administration;
- process transactions, invoicing, and collections;
- respond to demo requests, questions, and support tickets;
- send service and administrative messages, including security notices and changes to terms;
- send marketing communications about products, research, webinars, and events, subject to Section 9;
- measure and improve our website, content, and products, including analytics and A/B testing;
- develop and improve detection models and product features, using aggregated or de-identified data or, for Customer Data, only where the customer agreement allows it;
- prevent, detect, and investigate fraud, abuse, security incidents, and misuse of the Service;
- comply with legal obligations, including anti-money laundering, sanctions, export control, tax, and accounting requirements;
- establish, exercise, or defend legal claims, and carry out corporate transactions such as financings, audits, and mergers;
- evaluate job applications.
6. Automated decision-making
The complead platform generates risk scores, alerts, and match suggestions. These outputs are designed to support human review by our customers’ compliance teams; complead does not make decisions about any individual’s access to financial services. Where our customer uses platform output in automated decision-making, that customer is responsible for meeting the applicable transparency, human-review, and contestation requirements. We do not carry out automated decision-making with legal or similarly significant effects in our role as a controller.
7. Legal bases (EEA, UK, and Switzerland)
Where the GDPR or UK GDPR applies, we rely on:
| Purpose | Legal basis |
|---|---|
| Providing the Service, account administration, support | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, product improvement, B2B marketing to business contacts | Legitimate interests (Art. 6(1)(f)) |
| Screening databases and compliance processing | Legal obligation (Art. 6(1)(c)) and substantial public interest (Art. 6(1)(e), Art. 9(2)(g) and 10 where applicable) |
| Non-essential cookies, certain marketing emails, call recording | Consent (Art. 6(1)(a)) |
| Tax, accounting, AML, and sanctions record-keeping | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You may object at any time (Section 12).
8. Cookies and similar technologies
Cookies are small files placed on your device. We use them in four groups:
Essential. Required for the site and platform to work: session management, login, load balancing, security, and fraud prevention. These cannot be switched off.
Functional (the customizers). Remember your preferences, such as language, region, and interface settings.
Performance and analytics. Tell us how many people visit, which pages they use, and where they encounter problems, so we can improve the Service.
Advertising and targeting. Placed by us and by third-party advertising partners to deliver relevant content and measure campaign effectiveness across sites. These may build a profile of your interests.
You can manage non-essential cookies through our cookie banner and preference center, and through your browser settings. Blocking some cookies will affect how the site works.
Global Privacy Control. We honor the Global Privacy Control (GPC) signal where required by law. When our site receives a GPC signal, we treat it as a request to opt out of sale and sharing of personal information for the browser and device concerned.
Do Not Track. Our site does not currently respond to browser “Do Not Track” signals, because no common standard exists. Use the cookie preference center or GPC instead.
9. Marketing communications
We send B2B marketing only to business contacts, and only where permitted by law or with your consent where consent is required. Every marketing email includes an unsubscribe link, and you can also email privacy@complead.ai. You cannot opt out of transactional and service messages while you hold an account. If you receive SMS messages from us, message and data rates may apply and you can reply STOP to opt out.
10. How we share personal information
We disclose personal information to:
- Service providers and subprocessors that host, secure, analyze, support, or deliver the Service on our behalf under written contracts limiting their use of the data: cloud hosting and infrastructure, CRM and marketing automation, analytics, support ticketing, email delivery, payment processing, and professional advisers. A current list of platform subprocessors is available at our Trust Center or on request.
- Affiliates within the complead group, including Sanction Scanner LTD and Codevist Teknoloji A.Ş., for the purposes described in this policy.
- Partners and resellers where you engaged with us through them, or where you asked us to share your request.
- Data and identity providers as needed to run screening, verification, and enrichment on instruction.
- Authorities, regulators, and legal parties where we are required to disclose, or where disclosure is necessary to protect our rights, our users’ safety, or to investigate fraud or security incidents.
- Acquirers in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality protections and continued application of this policy.
We do not disclose Customer Data except as instructed by the customer or required by law.
11. Sale and sharing of personal information (U.S.)
We do not sell personal information for money.
Under the California Consumer Privacy Act as amended by the CPRA, and under similar laws in other U.S. states, the use of advertising and analytics cookies that pass identifiers to third parties may be treated as a “sale” or as “sharing” for cross-context behavioral advertising. To the extent it is, you may opt out at any time through our cookie preference center, by sending a GPC signal, or by emailing privacy@complead.ai.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
We do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit under applicable law.
12. Your privacy rights
12.1 U.S. state privacy rights
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, Kentucky, or another state with a comprehensive privacy law, you may have the right to:
- know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients;
- obtain a portable copy of your personal information;
- correct inaccurate personal information;
- delete personal information, subject to exceptions;
- opt out of sale, sharing, targeted advertising, and certain profiling;
- limit the use of sensitive personal information, where applicable;
- not be discriminated against or retaliated against for exercising these rights.
How to exercise them. Email privacy@complead.ai or write to the postal address in Section 2. We verify requests by matching the information you provide against our records, and may ask for additional information where the request concerns sensitive or high-risk data. An authorized agent may submit a request on your behalf with written permission and, for California residents, proof of authority.
Timing and appeals. We respond within 45 days, extendable once by a further 45 days where necessary, and we will tell you if we need the extension. If we decline your request, you may appeal by replying to our response or emailing privacy@complead.ai with “Appeal” in the subject line. We will respond to the appeal within 60 days, or within the period your state’s law requires, and will tell you how to contact your state attorney general if you disagree with the outcome.
Shine the Light (California Civil Code § 1798.83). California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.
12.2 GDPR and UK GDPR rights
If you are in the EEA, the UK, or Switzerland, you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests or to direct marketing. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
You may lodge a complaint with your local supervisory authority, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner.
12.3 Other jurisdictions
Individuals in Brazil (LGPD), Canada (PIPEDA), Turkey (KVKK), and other jurisdictions may have equivalent rights. Contact privacy@complead.ai and we will handle the request under the applicable law.
13. International data transfers
complead Inc. is based in the United States and uses service providers in the United States, the European Union, the United Kingdom, and Turkey. Personal information may therefore be transferred outside your country of residence, including to jurisdictions that may not offer the same level of protection.
For transfers from the EEA, the UK, or Switzerland, we rely on:
- the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with transfer impact assessments and supplementary technical measures; and/or
- the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, if and when complead Inc. is self-certified with the U.S. Department of Commerce. We will update this section and publish our certification details at the Trust Center once certification is complete.
Where we process Customer Data, hosting region options and transfer terms are set out in the customer agreement and data processing addendum.
You can request a copy of the relevant safeguards by emailing privacy@complead.ai.
14. How long we keep personal information
We keep personal information only as long as necessary for the purposes described, then delete or de-identify it.
| Category | Typical retention |
|---|---|
| Website analytics and cookie data | Up to 14 months, or as set in the cookie preference center |
| Marketing contacts | Until you unsubscribe, plus 24 months of suppression records so we do not contact you again |
| Prospect and CRM records | 24 months after the last meaningful interaction |
| Customer account and platform audit logs | Term of the agreement plus 12 months, unless the agreement says otherwise |
| Contracts, invoices, tax and accounting records | 7 years from the end of the relationship, or longer where U.S. federal or state law requires |
| AML, sanctions, and compliance records | 5 years after the end of the relationship, or longer where required by law or regulator instruction |
| Security and incident records | 24 months, or longer where an investigation or legal claim is open |
| Job applications | 12 months after the decision, unless you agree to a longer period |
Customer Data is retained and deleted according to the customer agreement. On termination, we delete or return Customer Data within the period stated there, except where law requires retention.
15. Security
We maintain an information security program aligned with ISO/IEC 27001 and covering encryption in transit and at rest, role-based access control, multi-factor authentication, network segmentation, logging and monitoring, vulnerability management, penetration testing, secure development practices, vendor due diligence, business continuity, and incident response with defined notification timelines.
No system is completely secure. If you believe your account has been compromised, contact security@complead.ai immediately.
Where a breach affecting your personal information occurs, we notify affected individuals, customers, and regulators as required by applicable U.S. state breach notification laws, the GDPR, and our customer agreements.
16. Children’s privacy
The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us with personal information, contact privacy@complead.ai and we will delete it.
17. Third-party websites and integrations
Our site links to third-party sites, and the platform connects to third-party systems that you or your organization choose to integrate. We are not responsible for their privacy practices. Review their policies before providing personal information.
18. Changes to this Privacy Policy
We may update this policy. We will post the new version here with a revised “Last updated” date, and where the changes are material we will notify you by email or through the Service before they take effect. Continuing to use the Service after the effective date means you accept the updated policy.
19. Previous versions
Prior versions of this policy are available on request at privacy@complead.ai.