Privacy Policy

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, last name, username or similar identifier.
• Contact Data includes email address and telephone numbers.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location.
• Usage Data includes information about how you use our website, products and services.

When you sign in with an email address at your company’s own web address, or type your company’s website on your account page, we look at that website’s home page for your logo and keep the logo pictures we find there for 90 days. Anyone else who signs in at that web address, or types it, is offered the same pictures, so the next person from your company is not kept waiting. They are pictures your website shows to anyone, and they are kept apart from your account.

The Defra Receipt of Waste spreadsheet checker sends the spreadsheet you choose to our server, checks it there and sends the result and any corrected workbook straight back to you. The checker does not save a copy of the file, its name, its contents or your results. It does not submit the workbook to Defra.

To stop the checker being overused, checks are counted per connection against a one-way scrambled code made from your IP address. This counter does not store the original IP address. Hosting and security services also process connection information when serving requests.

The separate feedback endpoint accepts only the email, optional organisation, feedback purpose and broad outcome entered by the sender. It rejects workbook bytes, filenames, workbook values, issue details and other extra fields. The record adds only a timestamp and DWT feedback source; it stores no request path, user-agent or connection address.

RAMS Review reads your PDF in your browser; the file stays on your device. It sends the text of the pages to our server and on to Microsoft (Azure OpenAI) or OpenAI (Quick and Full review) or Anthropic (Max review), and at every level to OpenAI for a quick check that it is a RAMS. Once a review is written, OpenAI also receives the titles and actions of the points it found and the documents it asks for, to merge any that repeat. They process it for us as service providers and may do so outside the UK, including in the United States.

If you are signed in, the result, which quotes the document, is kept in your account for 30 days (12 months on Pro and Team) until you delete it, and is then deleted from our servers within 24 hours; if you are not, it is deleted within 24 hours. Signed in, a review form you download is also kept with the review, so it can be downloaded again on any device, and is deleted when the review is. We keep a record of each review without the text (level, page count, timing, cost and how many points it found) and any rating or comment you send. Microsoft, OpenAI and Anthropic may keep the text up to 30 days (longer only if it is flagged for misuse or the law requires it) and don’t train on it.

Full and Max reviews need a ComplyOnSite account; we store your email address and send sign-in codes through Cloudflare. Free Quick reviews are counted with a random code in a cookie and a one-way scrambled code made from your IP address.

We use this information to provide reviews, apply limits and prevent misuse, and we use de-identified information to run and improve the service.

Paper form to digital form needs a ComplyOnSite account to copy a form. The photos you choose are made smaller on your device (JPEG images at most 2,576 pixels on the long edge), then sent to our server and on to OpenAI, which reads them to copy the form. OpenAI processes them for us as a service provider, may do so outside the UK, including in the United States, and may keep them up to 30 days (longer only if they are flagged for misuse or the law requires it). We do not keep the photos.

The copy, which includes the form’s printed words and any logo or picture cut from your photo, is kept in your account for 30 days (12 months on Pro and Team) so you can fill it in again without paying again, until you delete it, and is then deleted from our servers within 24 hours. We keep a record of each copy without the photos or the form (how many photos, timing, cost and credits). Changes you make to the boxes and what you fill in, with signatures and photos you add, stay in your browser, as section 13 describes, and are not sent to us. The sample form needs no account and sends nothing.

Prepare reads your weighbridge files in your browser. To work out a new file layout, your browser sends the whole file as read, every sheet and cell, to our server, with the details you entered for the site. Our server sends on to the AI provider named in section 5 the column headings, a sample of rows and, for a column with 20 or fewer different values, each value and how often it appears; the provider processes them for us. The file is not kept on our server. A layout already kept for your workspace is used without sending the file anywhere.

Signed in, your workspace keeps its file layouts, its sites with their carriers and materials, the values you typed at each site so they can be offered again, and each report: the loads in it, the loads held back with the cells that explain them, the file names, and Defra’s answers. Each layout also keeps a short profile of the last eight files read with it (their most common carrier, producer, vehicle and waste wordings), and the ticket numbers and first and last receipt times of the files read with it, up to about 150 KB, with a short code standing for each load that had no ticket of its own, so a load already reported or a column that changed is caught next time. Each site keeps the ticket numbers it has sent, by month. All of this is kept until you delete your account. To delete a report or a site sooner, email support@complyonsite.com.

Where sending to Defra is offered, you can send ready loads from Prepare straight to Defra’s Receipt of Waste service instead of uploading the workbook. You give your organisation’s Defra API code once for each site; it is kept encrypted on your account and only its last four characters are shown again. Each load is sent with the same details the workbook holds for it, including carrier, producer, vehicle registration, waste, weights and your ticket number, from our server to Defra, which keeps them under its own privacy notice. We keep Defra’s answer for each load (its Waste Tracking ID, refusal or warnings) in the report, and each ticket sent in the site’s list, so a load is never recorded twice. When a send needs a person, our support mailbox gets an email naming the site, report and tickets, never the API code. A receipt Defra has accepted stays with Defra: deleting it from ComplyOnSite, or deleting your account, does not withdraw it. Correct or withdraw it with Defra.

To improve Prepare, we record which decisions you make on your loads (the Defra field, the kind of change, the finding answered, the reason Defra gave) and who made them, without the values in your files. Anonymised examples are also used to improve Prepare: a waste description, weight, date or Defra code from a load you correct, a column heading, a material wording with the EWC code you chose, and Defra’s message. An example is used only when it is plain letters, figures and ordinary punctuation and every word in it is on our fixed list of waste and Defra words, taken from the List of Waste, Defra’s own lists and common trade wordings, with names, places and brands we found removed. Anything else, such as an address, a postcode, a vehicle registration, a phone number, an email address, a ticket number, or a name or company not on the list, means the whole example is left out. A name that is also an ordinary waste word, such as Wood or Green, cannot be told apart from that word. Your browser checks each example before it is sent and our server checks it again. Values from identifying fields, such as ticket numbers and registrations, are never sent, not even as a comparison between an old and new value. An admin can turn examples off for the workspace on the account page; after that, your browser sends no new ones and our server keeps no new ones. Examples already being sent at that moment may still reach our server. Examples already kept are deleted 30 days after examples are turned off, or sooner if you ask support@complyonsite.com, and every example is deleted 12 months after it was kept. Deleting your account deletes the examples you gave in any workspace, and the decisions are kept without your name or your deleted workspace.

On Pro and Team, Prepare also keeps a masked copy of each file you upload, so it reads that site’s files, and files from similar weighbridge systems, better next time. This is on unless an admin turns it off. The copy keeps the sheets, headings, units, number formats, dates, EWC codes and any value that is only a number, such as a weight, but also a ticket or account number made only of figures. Other text is replaced letter for letter by its shape, so names, addresses, vehicle registrations, phone numbers and email addresses do not stay. Copies are encrypted and kept against your workspace and the person who uploaded the file, at most the latest 200 for a workspace. An admin can turn this off on the account page: no new copy is kept from then on, and those already kept are deleted 30 days later, or sooner if you ask support@complyonsite.com. Every copy is deleted 12 months after it was kept at the latest, and at once when you delete your account.

A postcode you enter for a site is checked against postcodes.io, an open postcode service, through our server. Our server keeps the answer for 90 days, without saying who asked.

The MCP server at mcp.complyonsite.com lets AI assistants and other software use ComplyOnSite’s calculators and reference data. It needs no account, key or sign-in, sets no cookies and is read-only: no tool stores, changes or sends anything. The server does not log the arguments sent to a tool or the answers it returns.

When you ask an assistant to fill in a waste transfer note, it sends the details you gave it to the server: names, company names, addresses and registration numbers. The server uses them to check the note and return a link holding them, and doesn’t store them. Opening the link puts them into the note in your browser. What your assistant keeps of the conversation is covered by its provider’s own terms.

Each request’s IP address is used to count requests against the rate limit. For 10% of requests, chosen at random, Cloudflare keeps a log and trace on our behalf for 7 days. It records the time, IP address and the approximate location and network Cloudflare derives from it, the request headers and the response status. The headers include the client name (user agent) and, from clients that send them, the MCP method and the name of the tool called. The request body is not logged. We use these records to keep the server working and to stop abuse. There is no analytics.

The MCP server documentation lists every tool and what it accepts.

RAMS Builder, SDS to Excel, RAMS Review and Prepare can connect to your Google Drive if you choose; Drive needs no ComplyOnSite account of its own. They ask Google only for the drive.file permission, which covers files you pick in Google’s file picker and files the tool creates, not the rest of your Drive.

• Save to Google Drive (RAMS Builder) sends the finished PDF from your browser to a folder called ComplyOnSite in your Drive. The tool creates that folder the first time and finds it again later, even if you rename or move it.
• Choose from Google Drive (SDS to Excel, RAMS Review and Prepare) downloads the one file you pick from Google into your browser. The tool then handles it as it would a file from your device: a RAMS Review sends its text as section 5 describes, and Prepare as section 6 describes.
• Your browser also asks Google for the email address of the connected account, so the tool can show which Drive it is using. Your browser remembers that address, so the next visit connects to the same account. It is forgotten when you disconnect Drive, sign out of ComplyOnSite or someone else signs in on that browser.

Picking and saving go directly between your browser and Google. We do not receive or store your Drive details, that email address or the Google access token. The token is kept only in the open page and is gone when you close or reload it. Your editable RAMS draft is not sent to Google or Microsoft.

We use Google Drive data only to carry out your chosen file action. We do not sell it, use it for advertising, or use it to train AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can revoke access in Google Account settings. Files already saved in Drive remain yours to manage there.

If you choose Google sign-in, we request Google’s openid, email and profile permissions. Google supplies your account identifier, name, email address, email verification status and profile picture, where available. We also receive sign-in tokens and their expiry information.

We use these details to create or identify your ComplyOnSite account, verify your identity, link an eligible existing account and give you access to your workspace. We store the account details and Google account link in our account database. Sign-in tokens support this authentication process; they are not used to read your Google files or messages. These permissions do not give us access to Gmail, Google Drive, Calendar or Contacts.

The same tools can connect to OneDrive if you choose, with a personal Microsoft account or a work or school account; OneDrive needs no ComplyOnSite account of its own. Microsoft asks you to approve each permission the first time a tool needs it; on a work or school account, your organisation may require an administrator to approve it.

• Save to OneDrive (RAMS Builder) asks for Files.ReadWrite.AppFolder, which reaches only the app folder Microsoft creates for ComplyOnSite (Apps/ComplyOnSite in your OneDrive), not the rest of your files. The finished PDF goes from your browser into that folder.
• Choose from Microsoft (SDS to Excel, RAMS Review, Prepare and Form Copy) opens Microsoft’s own file picker. To show your files there, Microsoft asks for read access to them: Files.Read on a personal account, and on a work or school account read access to the OneDrive and SharePoint files you can already open. The tool downloads only the one file you pick into your browser and handles it as a file from your device.
• Your browser asks Microsoft for your profile (User.Read) to show which account is connected and, on a work or school account, where its OneDrive is. Your browser remembers that email address and your Microsoft directory ID so the next visit connects to the same account, and forgets them as it does for Google Drive.

Picking and saving go directly between your browser and Microsoft. We do not receive or store your OneDrive details, that email address or the Microsoft access token, which is kept only in the open page. We use OneDrive data only to carry out your chosen file action; we do not sell it, use it for advertising, or use it to train AI models.

If you choose Microsoft sign-in, we request Microsoft’s openid, email and profile permissions. Microsoft supplies your account identifier, name, email address, your Microsoft directory ID and whether Microsoft has verified that email address. We also receive sign-in tokens and their expiry information. We use these details as we do Google’s, and store the Microsoft account link in our account database. These permissions do not give us access to your OneDrive, Outlook, calendar or contacts.

You can remove ComplyOnSite’s access to a personal Microsoft account at account.live.com/consent/Manage, and to a work or school account at myapps.microsoft.com, where your organisation allows it. Files already saved in OneDrive remain yours to manage there.

Signing in also creates a session record, which can include your IP address and browser information, and a necessary session cookie. Sessions expire after 30 days unless renewed through continued use. Signing out ends access through that session; it does not delete your account.

Featurebase provides the support messenger on the production website and hosts the ComplyOnSite help centre, feedback board and product updates. When you visit complyonsite.com, your browser connects to Featurebase to load the messenger. We do not identify you to Featurebase or configure the integration with your ComplyOnSite account details, document contents, file names, form entries or tool results.

Featurebase receives the URL and title of pages visited while the messenger is loaded, along with connection and device information needed to provide and protect the service, such as your IP address and browser user agent. The integration may use browser storage for its workspace settings, anonymous visitor identifier and messenger state.

If you choose to use the messenger or Featurebase portal, Featurebase also processes the message, feedback, vote, and any name, email address or other details you enter.

Featurebase processes this information for us so that we can answer support requests, maintain help articles, understand feedback and publish product updates. Do not send documents, confidential site records or special-category personal data through these channels.

Free guides download directly; nothing is asked for first. After a download, you can give your email address to get the next guide and occasional emails about RAMS and site compliance. When you do, we email that address a link to confirm it; nothing more happens until the link is used. On confirming, our server sends Sequenzy the address, the guide you downloaded, the page used, the times you signed up and confirmed and the words you agreed to, and Sequenzy adds you to our marketing list. A link not used within 7 days stops working and nothing is kept.

When you create an account, our server sends Sequenzy your email address, first name and account ID, and tells it when the account is made, and when a RAMS Review finishes or your credits run out. We use this to send you emails about getting started and tips about the tools you use. If you tick “Don’t email me tips or offers” when you sign up, Sequenzy is told nothing about your account; if you tick it when you sign in later, Sequenzy is told nothing more. You can unsubscribe from any of these emails at any time, or ask support@complyonsite.com to stop them. Deleting your account deletes your Sequenzy record.

Sequenzy processes this information for us to manage subscribers and send these emails. Sequenzy is operated by Nic Tech Solutions, LLC in the United States and uses service providers in several countries. Its Data Processing Agreement uses the UK transfer addendum and standard contractual clauses for transfers outside the UK or EEA. Sequenzy keeps subscriber data while our account is active and keeps bounced and unsubscribed addresses in suppression lists so they are not emailed again.

You can unsubscribe using the link in any of these emails. You can also ask us to remove your sign-up data using the contact details in section 12.

Cloudflare hosts the website and accounts and processes the account database and stored documents on our behalf. Google and Microsoft process the sign-in you request under their own privacy policies. Google and Microsoft account data is used for account and workspace access, not advertising, and is not sold. Microsoft (Azure OpenAI), OpenAI and Anthropic process RAMS Review text, and OpenAI processes photos of paper forms, as described in section 5. Featurebase processes support and feedback data as described in section 9. Sequenzy processes guide requests, account emails and marketing choices as described in section 10. Stripe processes payments for paid plans and holds your card details, which we never see. Cal.com, Inc., in the United States, runs the calendar on the Book a demo page: your browser loads it from Cal.com only on that page, and if you book a call, Cal.com processes the name, email address and notes you enter so the call can be arranged. Defra receives the loads you choose to send to it from Prepare, as described in section 6. Amazon Web Services stores a second copy of our encrypted backups in London. We do not offer EU data residency.

We use PostHog’s EU service to count page views, visits to our tools and steps such as downloading a template, starting or making a document, creating an account, starting a trial and first paying, without cookies or browser storage. We send the page path, the SDK version, the website you came from (its address without the page or query) and any campaign tags in the link you followed, so we can see which channels bring people here. With a step we send the kind of document and template, which catalogue job a RAMS step was for, the file format, whether a template was changed or given a logo, how the account was created or the plan chosen. We also record waste code finder searches, the region selected, the results offered and code selection or copying, to improve the finders. Search text is limited in length and obvious contact details and links are replaced before sending, but it may still contain personal data. Please do not enter personal details in these search boxes. These events follow our analytics retention settings. We do not send other query values, fragments, other form entries, document contents, file names, account identities or session recordings. PostHog receives connection information, including your IP address and browser user agent, and uses it to group anonymous visits on its servers. We do not create person profiles.

Connections use HTTPS. Access to account and workspace records requires authentication and permission checks. Google and Microsoft sign-in access and refresh tokens are encrypted before database storage; the free tools' Drive and OneDrive tokens are never sent to our servers. Our hosting and security services process request information to deliver and protect the service. The cookie policy explains session cookies, security cookies and website measurement.

Account details, the Google or Microsoft account link and stored authentication tokens remain in the account database until removed; they are not automatically deleted when you sign out or when a token expires. When you delete your account or ask us to delete your data, it is deleted from our servers within 24 hours, apart from the records described below. We keep encrypted backups of the account database, workspace logos and the files kept in accounts (review forms, signed copies, photos and PDFs) for up to 400 days, with Cloudflare and with Amazon Web Services in London, so we can recover from a failure. Data you delete stays in those backups until they expire, and we never use it from them. If we ever restore a backup, deleted accounts, with their photos and PDFs, and deleted RAMS reviews are deleted again automatically. A Prepare file layout deleted on its own could come back if we restore a backup made before you deleted it.

Your work details. When you are signed in and choose Keep after saving a waste transfer note, your account keeps the details you chose: who hands the waste over (name, company, address, roles, registration numbers and SIC code) and your usual loads (description, codes, container and how much). Nothing is kept unless you choose Keep. Each person’s details are their own within a workspace; your company details are read from your workspace, not copied. You can see, change, download or clear them on your account page under Your work, and they are deleted with your account. When you search Companies House on a transfer note, signed in or not, the letters you type go to our server and on to Companies House; the answers, with your search, are kept for a day so the same search is not asked twice.

When something fails on our side, our server records the error with the request it came from, such as the page address, your workspace and the time, and emails it to our support mailbox. These records are deleted after 30 days; the emails stay in that mailbox. They are not deleted with your account.

A RAMS Review result, and a copy of a paper form, is kept in your account for 30 days (12 months on Pro and Team) until you delete it, then deleted from our servers within 24 hours; without an account a RAMS Review result is deleted within 24 hours. Review records, credits, ratings and comments remain until you ask us to delete them, and billing records for as long as tax law requires.

Deleting your account from your account page deletes your sign-in, name and email address, company details, logo, saved reviews, copies of paper forms, ratings and comments, work details, your workspace’s Prepare layouts, sites, Defra API codes, reports, kept copies and the examples you gave, and your workspace’s Site Diary, Site Issues, Site Progress Report and Site Register records with their photos, PDFs, sites and sign-ins. Copies kept in a browser on your devices stay there until you clear that browser’s site data. We keep billing records, including your customer record at Stripe, and review and credit records without your name or email. We also keep a one-way scrambled code made from your email address, so the free sign-up credits are given to each address once. When free credits are claimed, we keep one-way scrambled codes made from your IP address and email domain for 30 days, to stop free credits being claimed over and over or by automated sign-ups.

You can remove ComplyOnSite’s connection in your Google Account settings, or for Microsoft as section 8 describes. This stops future access through that connection; it does not erase information already held by ComplyOnSite.

Email hi@complyonsite.com to request access, correction or deletion of your personal data, including Google or Microsoft sign-in data, or to ask a privacy question. Include the email address used for your account. We may need to verify your identity before acting and will explain any information that must be retained for a legal obligation or an organisation’s records. You can also raise a data protection complaint with the UK Information Commissioner’s Office.

Some tools keep your work in your browser on your device, not on our servers. Anyone who uses that browser can see it. It stays until you delete it in the tool or clear this site’s data in your browser; deleting your account removes only what is listed as removed below, and only in the browser you delete it from.

• Waste notes and RAMS Builder drafts, with their signatures, until you delete them.
• RAMS Review: your reviews, the PDFs you reviewed and the forms you issued, until you delete the review, and the reviewer name, role and company you last used. Deleting your account removes your account’s reviews, PDFs and reviewer details from this browser.
• Paper form to digital form: the changes you make to a copy’s boxes and what you fill in, with signatures and photos you add, until you clear this site’s data, so a form can be filled in again on this device. Photos you choose before signing in are kept for up to an hour, so they are still there when you come back, only for the person who chose them, and are removed the next time you open the site after that.
• Prepare: a file you chose before signing in or paying is kept for up to an hour, so it is still there when you come back, and is removed the next time you open the site after that. A report or site your account hasn’t taken yet is kept until it has, and shown only to the person it belongs to; one saved before you signed in waits for you to add it to your workspace. Deleting your account removes your reports waiting in this browser.
• Connected Google Drive or OneDrive: the email address of the account (and, for OneDrive, its Microsoft directory ID), as section 8 describes.
• Your work details: while you are signed in, a copy of the work details your account keeps, so a waste transfer note can offer them with no signal. It is removed when you sign out.
• Settings: the review level you last chose, and notes that a message or offer has been shown, so it isn’t shown again, and how often you chose Not now when a transfer note offered to keep your details.