Privacy, terms, security & data ownership

We collect only what the product needs to work: your account email, the documents you upload, and the metadata extracted from them (document type, counterparty, dates, obligations).

Documents are only sent to an AI provider for analysis when you explicitly tick the analysis consent box on upload. If you skip it, the file is stored and never leaves your account for processing.

We do not sell data, and we do not use your documents to train models.

HakikiComply is a tracking and reminder tool. It does not provide legal advice, and AI-extracted dates or obligations should be reviewed by you before you rely on them.

You are responsible for the accuracy of what you upload and for having the right to store it.

Plans are billed monthly and can be cancelled at any time; access continues to the end of the paid period.

Every database table is protected by Row Level Security so rows are readable only by the account that owns them. There are no anonymous read grants on application data.

Files live in a private storage bucket scoped to your user folder. Viewing or downloading a document issues a short-lived signed URL from the server — there are no permanent public file URLs.

Uploads are restricted by file type and size, filenames are sanitised, and upload, analysis and renewal actions are rate limited.

Sensitive actions — sign in, failed sign in, password reset, upload, view, download, delete, role change — are written to an append-only audit log you can review in Settings. Roles (owner, admin, compliance manager, employee, viewer) are enforced in the database, not in the interface.

Security headers including Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy are applied to every response.

We do not hold SOC 2, ISO 27001 or any third-party certification, and we do not claim one.

Your documents and extracted data remain yours. You can download any file at any time and delete documents individually.

Deleting a document removes its record and its stored file. Closing your account removes your profile, documents and settings.

Audit log entries are retained and cannot be edited or deleted by ordinary users — that is what makes them useful as a record.