Complipath's privacy page is written from the code and configuration that move the data, not from policy templates. Each section names the recipient, what it receives, and the file or setting it was measured from. Where we have not read a provider's terms, that is stated as unread rather than guessed — the unread list at the end is rendered from the same register the build checks on every run. A separate page names every party that processes what you put into the product, with the fields that reach each one.
Complipath is built by Yobel Tzegai in Gothenburg, Sweden. Questions about anything on this page: hello@complipath.io.
Written 2026-08-11. The register behind the unread list is reviewed on a six-month cadence; each entry carries its own date.
If you have never contacted us and we email you about the EU AI Act, we did not get your details from you. We got your name, job title, work email address and employer from business contact databases — Apollo.io and Clay — and from what your employer publishes on its own website and in its public job advertisements.
We rely on legitimate interests under Article 6(1)(f) GDPR. The interest is telling businesses within the scope of Regulation (EU) 2024/1689 that they are within it. We wrote down the balancing test before sending anything, and we will send you a copy if you ask.
We hold your name, title, work email address, employer, sector and what your employer publishes about its AI. Nothing about your private life. We do not track whether you opened anything we sent.
You can tell us to stop, and that is the end of it — reply "stop" to any message, or write to hello@complipath.io. We keep your email address on a suppression list after that, and only so that we do not write to you again.
If you never reply, we delete your record twelve months after the last message. Bounced addresses are deleted within thirty days.
You can ask us what we hold, have it corrected or deleted, and object to direct marketing at any time — an objection to marketing is absolute and we do not weigh it against anything. Write to hello@complipath.io. You can also complain to Integritetsskyddsmyndigheten, the Swedish data protection authority.
Measured from: The outreach system in the private content repository, read 2026-08-15: it names the contact databases the addresses come from, its verification rule, and its link rules — which forbid tracking links, shortened links and UTM parameters. It creates drafts in Gmail and never sends ("Den skapar utkast. Den skickar aldrig."), which is what supports the sentence about not tracking opens.
The classification form on the app's /check page runs entirely in your browser — the engine is pure TypeScript delivered to the page. The form's own words, shipped beside the field: "Your answers never leave your browser. Your domain is used once to fetch your public pages — we don't store it or log it."
The optional reading step is the one part that touches our server: the domain you type travels in the request body — deliberately not in the URL, because request logs record URLs. The server keeps two things from a run, and both are listed on this page: a row with an outcome code, two duration measurements and the running commit id — nothing you typed is in it — and the rate-limit counter the next section quotes in full.
Measured from: App repository at commit 8bebc71, read 2026-08-11: app/check/check-flow.tsx (CHECK_FORM_TAGLINE), app/api/check-read/route.ts, lib/check-read/run-log.ts (the insert carries outcome, fetch_ms, model_ms, served_commit — nothing else).
The reading step keeps one counter, and the /check page says so in these words: "When you use the check's reading step, we keep one counter: the date, a salted daily hash of your IP address, and a count. It exists to rate-limit the feature. The hash cannot be joined across days, and it contains neither your domain nor any of your answers. Nothing else about your visit is kept."
This page and that sentence describe the same code, so here is the construction, exactly: the hash is SHA-256 of the day and your IP address together, truncated to 32 hex characters. The day is the salt — it rotates the hash daily, which is what makes yesterday's value useless; it is not a secret key. The table's columns are the date, that hash, and a count — a test in the app reads every migration touching the table and fails if a column is ever added beside them.
Measured from: App repository at commit 8bebc71, read 2026-08-11: lib/public-check.ts (CHECK_COUNTER_LINE, quoted verbatim), lib/check-read/limits.ts (ipBucket: sha256(`${day}:${ip}`), first 32 hex characters).
When you run the reading step, the domain you typed and the text of the public pages it fetched are sent to Anthropic's API, which suggests likely AI systems from what those pages say. That is the whole payload — your answers to the classification questions are never in it, because they never leave your browser.
We have not read Anthropic's API retention terms. Until someone does and records what they read, this page says so instead of guessing.
Measured from: App repository at commit 8bebc71, read 2026-08-11: lib/check-read/read.ts (buildReadPrompt receives the domain and the fetched pages).
Vercel hosts both complipath.io and the app. Serving a page over HTTP means Vercel receives your IP address and the URL you requested — that is how any host works, and it is why the check's domain travels in the request body instead of the URL.
The application runs in Frankfurt: the project's function region reads "Frankfurt, Germany (West) - eu-central-1 - fra1", and the deployment configuration pins regions to fra1. Where Vercel's request logs are stored, and for how long, we have not read.
Measured from: Vercel project settings, read by Yobel Tzegai 2026-08-10 (verbatim above); app repository vercel.json ("regions": ["fra1"]), read 2026-08-11.
This site uses Vercel Web Analytics. Vercel's own privacy documentation, read 2026-08-10, says it works "without using any third-party cookies" and that visitors are "identified by a hash created from the incoming request", discarded within 24 hours — so the hash cannot follow you across days or sites. Note the first quotation precisely: no third-party cookies is not the same claim as no cookies, and we repeat only what the source says.
Where Vercel stores the analytics rows is a different question from what they collect, and we have not read the answer. It is on the unread list below.
Measured from: content/analytics.json (three verbatim quotations from https://vercel.com/docs/analytics/privacy-policy, read 2026-08-10 by Yobel Tzegai; register entry analytics-privacy, review due 2027-02-10).
If you arrive through a partner's link that carries a partner code (?ref= followed by three to twenty capital letters or digits), this site keeps that code in your browser's session storage until you close the tab, and adds it to the links that take you to the app's sign-up and check pages. This site sets no cookie for it. A code of any other shape is ignored.
Measured from: build.mjs REF_SCRIPT, the inline script every page of this site carries since pass 57 (2026-10-09), and tools/ref-code.mjs, which runs that script on the delivered pages in a real browser and fails the build if it sets a cookie or accepts a code of another shape.
Customer accounts and their register live in a Supabase database: your email address, name, role and organisation, and the AI systems and assessments your workspace records. The project's region is eu-central-1 — read directly out of Supabase's management API, not off a marketing page — and Supabase's own region list names eu-central-1 as Frankfurt.
Where database backups are stored, and for how long, we have not read. That gap is named below rather than papered over with "your data stays in the EU" — two measured regions prove two regions, nothing more.
Measured from: Supabase Management API, read 2026-08-11 in this session (project complipath, region eu-central-1, status ACTIVE_HEALTHY); app repository lib/database.types.ts for the account fields; register entry data-location-database.
The app sends email through Resend. A feedback note you write in the app travels by email from hello@complipath.io to hello@complipath.io: the note's text, the page it was written on, the system and organisation names, and — only if you chose to give one — your reply address. The corpus-watch notification, the other sender, reports changes in the law and carries no visitor data.
From which region Resend sends, and where email rests in transit, we have not read.
Measured from: App repository at commit 8bebc71, read 2026-08-11: lib/feedback-delivery.ts and lib/email/feedback-note.ts (FEEDBACK_FROM, FEEDBACK_TO, feedbackText fields), app/api/snapshot/route.ts.
The booking link is on this site: 43 anchors on 34 pages —
The booking itself happens on calendly.com, and nothing you type there passes through us. The link to it names the page of this site you left from (utm_source=site and utm_content in the address), and Calendly passes that back with the booking. We receive the booking you make. How Calendly stores and processes what you enter is governed by Calendly's terms, which we have not read; that too is on the list below.
Measured from: every page in dist/, walked 2026-09-06: five anchors to calendly.com on two delivered pages — index.html three times (after "Who this is for", after the FAQ, in the closing block) and pricing/index.html twice (Growth, Scale). The pricing pair is not also at home: /pricing/ is CUT OUT of the built home page. This said three until 2026-09-06, naming two of the home page's three and dropping the FAQ anchor the same pass added; tools/config-prose.mjs (G4) derives the count from dist now. tools/cta-guard.mjs holds the label and the declared placements in content/call-to-action.json; tools/one-action.mjs (G6, added 2026-09-06) holds the booking to neither of the home page's two ranked forms.
Mail to hello@complipath.io lands in a mailbox at a provider this page does not name, because neither repository's code states it — an honest gap rather than a guessed answer, and on the unread list until the MX records and that provider's terms are read.
Measured from: Measured absence: no mailbox provider appears in either repository's code or configuration, read 2026-08-11.
Each item below becomes a section above the day someone reads the source and records what it says, with a date. Until then the honest state is this list — rendered from the same register the build prints on every run, so the page and the register cannot disagree.
What this page does not do, so the silence is a decision and not an oversight: it makes no claim about encryption (struck from the site 2026-08-10 until a provider statement is read and recorded), no claim about retention periods for the services above, and no sentence of the shape "your data stays in the EU" — the two regions named above are the two that were measured.