Complipath's privacy page is written from the code and configuration that move the data, not from policy templates. Each section names the recipient, what it receives, and the file or setting it was measured from. Where we have not read a provider's terms, that is stated as unread rather than guessed — the unread list at the end is rendered from the same register the build checks on every run. A separate page names every party that processes what you put into the product, with the fields that reach each one.
Complipath is built by Yobel Tzegai in Gothenburg, Sweden. Questions about anything on this page: hello@complipath.io.
Written 2026-08-11. The register behind the unread list is reviewed on a six-month cadence; each entry carries its own date.
If you have never contacted us and we email you about the EU AI Act, we did not get your details from you. We got your name, job title, work email address and employer from business contact databases — Apollo.io and Clay — and from what your employer publishes on its own website and in its public job advertisements.
We rely on legitimate interests under Article 6(1)(f) GDPR. The interest is telling businesses within the scope of Regulation (EU) 2024/1689 that they are within it. We wrote down the balancing test before sending anything, and we will send you a copy if you ask.
We hold your name, title, work email address, employer, sector and what your employer publishes about its AI. Nothing about your private life. We do not track whether you opened anything we sent.
You can tell us to stop, and that is the end of it — reply "stop" to any message, or write to hello@complipath.io. We keep your email address on a suppression list after that, and only so that we do not write to you again.
If you never reply, we delete your record twelve months after the last message. Bounced addresses are deleted within thirty days.
You can ask us what we hold, have it corrected or deleted, and object to direct marketing at any time — an objection to marketing is absolute and we do not weigh it against anything. Write to hello@complipath.io. You can also complain to Integritetsskyddsmyndigheten, the Swedish data protection authority.
Measured from: The outreach system in the private content repository, read 2026-08-15: it names the contact databases the addresses come from, its verification rule, and its link rules — which forbid tracking links, shortened links and UTM parameters. It creates drafts in Gmail and never sends ("Den skapar utkast. Den skickar aldrig."), which is what supports the sentence about not tracking opens.
The classification form on the app's /check page runs entirely in your browser — the engine is pure TypeScript delivered to the page. The form's own words, shipped beside the field: "Your answers never leave your browser. Your domain is used once to fetch your public pages — we don't store it or log it."
The optional reading step is the one part that touches our server: the domain you type travels in the request body — deliberately not in the URL, because request logs record URLs. The server keeps two things from a run, and both are listed on this page: a row with an outcome code, two duration measurements and the running commit id — nothing you typed is in it — and the rate-limit counter the next section quotes in full.
Measured from: App repository at commit 8bebc71, read 2026-08-11: app/check/check-flow.tsx (CHECK_FORM_TAGLINE), app/api/check-read/route.ts, lib/check-read/run-log.ts (the insert carries outcome, fetch_ms, model_ms, served_commit — nothing else).
The reading step keeps one counter, and the /check page says so in these words: "When you use the check's reading step, we keep one counter: the date, a salted daily hash of your IP address, and a count. It exists to rate-limit the feature. The hash cannot be joined across days, and it contains neither your domain nor any of your answers. Nothing else about your visit is kept."
This page and that sentence describe the same code, so here is the construction, exactly: the hash is SHA-256 of the day and your IP address together, truncated to 32 hex characters. The day is the salt — it rotates the hash daily, which is what makes yesterday's value useless; it is not a secret key. The table's columns are the date, that hash, and a count — a test in the app reads every migration touching the table and fails if a column is ever added beside them.
Measured from: App repository at commit 8bebc71, read 2026-08-11: lib/public-check.ts (CHECK_COUNTER_LINE, quoted verbatim), lib/check-read/limits.ts (ipBucket: sha256(`${day}:${ip}`), first 32 hex characters).
When you run the reading step, the domain you typed and the text of the public pages it fetched are sent to Anthropic's API, which suggests likely AI systems from what those pages say. That is the whole payload — your answers to the classification questions are never in it, because they never leave your browser.
We have not read Anthropic's API retention terms. Until someone does and records what they read, this page says so instead of guessing.
Measured from: App repository at commit 8bebc71, read 2026-08-11: lib/check-read/read.ts (buildReadPrompt receives the domain and the fetched pages).
Vercel hosts both complipath.io and the app. Serving a page over HTTP means Vercel receives your IP address and the URL you requested — that is how any host works, and it is why the check's domain travels in the request body instead of the URL.
The application runs in Frankfurt: the project's function region reads "Frankfurt, Germany (West) - eu-central-1 - fra1", and the deployment configuration pins regions to fra1. Where Vercel's request logs are stored, and for how long, we have not read.
Measured from: Vercel project settings, read by Yobel Tzegai 2026-08-10 (verbatim above); app repository vercel.json ("regions": ["fra1"]), read 2026-08-11.
This site uses Vercel Web Analytics. Vercel's own privacy documentation, read 2026-08-10, says it works "without using any third-party cookies" and that visitors are "identified by a hash created from the incoming request", discarded within 24 hours — so the hash cannot follow you across days or sites. Note the first quotation precisely: no third-party cookies is not the same claim as no cookies, and we repeat only what the source says.
Where Vercel stores the analytics rows is a different question from what they collect, and we have not read the answer. It is on the unread list below.
Measured from: content/analytics.json (three verbatim quotations from https://vercel.com/docs/analytics/privacy-policy, read 2026-08-10 by Yobel Tzegai; register entry analytics-privacy, review due 2027-02-10).
Customer accounts and their register live in a Supabase database: your email address, name, role and organisation, and the AI systems and assessments your workspace records. The project's region is eu-central-1 — read directly out of Supabase's management API, not off a marketing page — and Supabase's own region list names eu-central-1 as Frankfurt.
Where database backups are stored, and for how long, we have not read. That gap is named below rather than papered over with "your data stays in the EU" — two measured regions prove two regions, nothing more.
Measured from: Supabase Management API, read 2026-08-11 in this session (project complipath, region eu-central-1, status ACTIVE_HEALTHY); app repository lib/database.types.ts for the account fields; register entry data-location-database.
The app sends email through Resend. A feedback note you write in the app travels by email from hello@complipath.io to hello@complipath.io: the note's text, the page it was written on, the system and organisation names, and — only if you chose to give one — your reply address. The corpus-watch notification, the other sender, reports changes in the law and carries no visitor data.
From which region Resend sends, and where email rests in transit, we have not read.
Measured from: App repository at commit 8bebc71, read 2026-08-11: lib/feedback-delivery.ts and lib/email/feedback-note.ts (FEEDBACK_FROM, FEEDBACK_TO, feedbackText fields), app/api/snapshot/route.ts.
There is no booking link on this site. A call is arranged by email or from inside the product, and the booking itself happens on calendly.com — nothing you type there passes through us. We receive the booking you make. How Calendly stores and processes what you enter is governed by Calendly's terms, which we have not read; that too is on the list below.
Measured from: every page in dist/: not one links to calendly.com, enforced by tools/cta-guard.mjs on every build, which inverted that assertion on 2026-08-21 when the booking stopped being a call to action. The event type was renamed on 21 August 2026, the same day the last link left this site: it carried the retired programme's name, which mattered more once the link moved into email and into the product, where nobody proofreads it.
Mail to hello@complipath.io lands in a mailbox at a provider this page does not name, because neither repository's code states it — an honest gap rather than a guessed answer, and on the unread list until the MX records and that provider's terms are read.
Measured from: Measured absence: no mailbox provider appears in either repository's code or configuration, read 2026-08-11.
Each item below becomes a section above the day someone reads the source and records what it says, with a date. Until then the honest state is this list — rendered from the same register the build prints on every run, so the page and the register cannot disagree.
What this page does not do, so the silence is a decision and not an oversight: it makes no claim about encryption (struck from the site 2026-08-10 until a provider statement is read and recorded), no claim about retention periods for the services above, and no sentence of the shape "your data stays in the EU" — the two regions named above are the two that were measured.
Complipath is EU AI Act compliance software for AI-heavy software companies without a compliance team — an AI system register, deterministic risk classification, the obligations that follow, and the evidence behind every decision.
Complipath is built by Yobel Tzegai in Gothenburg, Sweden.
Complipath provides legal information, not legal advice. Every guide cites its source on EUR-Lex — Regulation (EU) 2024/1689, and Regulation (EU) 2026/1744 where that has amended it; where the law is still settling, the guide says so.
We measure page views with Vercel Web Analytics. It uses no third-party cookies. Visitors are identified by a hash derived from the incoming request, which is discarded after 24 hours, and no identifier is stored that could follow a visitor to another site. What is collected: the time of the visit, the URL, the referring page, filtered query parameters, city-level location, operating system, browser and device type.