Privacy Policy

• Account data — email address, name you provide, authentication credentials and two-factor enrolment details.
• Policy content — documents you upload or paste (PDF, DOCX, TXT, MD), the text extracted from them, and any drafts or revisions you save.
• Grading output — scores, criteria breakdowns, framework alignment, recommendations and version history generated for your policies.
• Billing data — subscription status and plan. Card details are handled by our payment provider and never reach our servers.
• Team and directory data — member emails, roles and provisioning records where you enable team seats, SSO or SCIM.

Where the UK GDPR, EU GDPR or a comparable law applies, we rely on these grounds:

• Performance of a contract — creating and running your account, grading your policies, storing results and version history, operating team seats, and managing your subscription.
• Legitimate interests — keeping the service secure, preventing fraud and abuse, diagnosing faults, and improving the product, balanced against your rights.
• Legal obligation — retaining billing and tax records and responding to lawful requests from authorities.
• Consent — any optional marketing email or non-essential cookie, which you can withdraw at any time.

We use your data to authenticate you, run gradings, store and version your results, operate team and subscription features, and keep the service secure and available. We do not sell your data and we do not use your policy documents for advertising.

Grading is performed by a third-party large language model provider. The policy text you submit, plus the sector and policy type you select, are sent to that provider to produce the grading result. Do not upload material you are not permitted to share with a processor outside your organisation.

We share data with: a managed cloud platform for hosting, database and file storage; an AI model provider for grading; Paddle.com, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing; professional advisers such as legal and accounting; and authorities where the law requires it. Each processes data only to deliver those functions.

Our providers are located in the United States and elsewhere, so your data may be transferred outside the UK and EEA. Where that happens we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

Policies, gradings and revisions remain available while your account is active. Deleting a policy removes it and its grading history. Deleting your account from Account settings permanently removes your profile, policies, gradings and version history. Records we are required to keep for billing or tax purposes are retained by our payment provider under its own terms.

Access to your data is restricted to your account through row-level database policies. Two-factor authentication is required on every PolicyChekr account. You can sign out of all devices at any time from Account settings.

You can access, correct, export and delete your data directly in the app: update your profile and email in Account settings, export gradings as PDF, CSV or JSON, and delete individual policies or your entire account. Depending on where you live you also have the rights to access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent, plus the right to complain to your local supervisory authority. Contact us for anything you cannot do in the app and we will respond within one month.

We use strictly necessary cookies and equivalent browser storage to keep you signed in and to secure the session. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.

PolicyChekr is a business tool and is not intended for anyone under 16.

If we change how we handle data we will update this page and the date above. Continued use after a change means you accept the updated notice.

Questions about this notice or your data can be sent to the account owner contact listed on your subscription invoice.