Privacy Policy
Last updated: August 7, 2026
1. Overview
ComplyFlow AI provides automated e-invoice compliance validation for KSA (ZATCA Phase 2) and UAE (FTA) rulesets. This policy explains what we collect, how we use it, and your rights.
2. Data We Collect
Account data: your email address and encrypted password, managed securely by Supabase Auth. Invoice data: files you upload (XML, PDF, images) for validation. Payment data: handled by independent processors (Wise or bank transfer) — we never see or store card numbers.
3. Invoice Processing & Retention
Uploaded invoices are scanned in memory only. We do not retain invoice contents after processing unless you explicitly save a result to your account. Only scan metadata (date, jurisdiction, risk score) is kept to power your dashboard.
4. GCC Data-Protection Alignment
Our practices align with the KSA Personal Data Protection Law (PDPL) and UAE Federal Decree-Law No. 45 of 2021 on data protection. We collect only what is necessary and never sell your data.
5. Third-Party Services
We use Supabase (database & authentication), Vercel/Railway (hosting), and Wise (payments). Each provider processes data under its own privacy policy.
6. Security
All traffic is encrypted via TLS. Database rows are isolated per tenant using Row-Level Security, so only you can see your scans.
7. Your Rights
You may request access, correction, or deletion of your personal data at any time via WhatsApp or email. We respond within 30 days.
8. Contact
Questions? Chat with us on WhatsApp using the floating button, or email support@complyflow.ai.