How we handle data.

Conformant (conformant.eu) is the data controller for account, billing, and marketing data. For compliance workspace content your agency enters, Conformant acts as a data processor on your instructions — see our Data Processing Agreement.

When you use Conformant, we collect information needed to run the product — things like your name, email, organization details, and the compliance data you enter (AI systems, classifications, deadlines, and documents).

If you use the Compliance Advisor, we store your messages. If you upload evidence files, we store the files you choose to attach. Optional scan-result emails store the address you provide.

We use account and billing data to provide the service you signed up for. We keep security and fraud-prevention logs because we need to protect the platform. We only send marketing emails or optional scan-result emails with your consent where that is required. Workspace compliance data is processed to run the product — we act as your processor for that content, and your agency remains responsible for having a valid reason to upload what you put in the workspace.

We use your information to provide the service, improve the product, send important account updates, and — if you opt in — deadline reminders by email.

We do not sell your personal data. We do not use workspace content to train public AI models.

You control what enters your workspace. Conformant is built for AI compliance metadata — inventories, classifications, obligations, and audit evidence. Do not upload candidate CVs, personal hiring records, or other personal data unless necessary for a specific obligation and you have a lawful basis. You are responsible for what your team uploads and exports.

When you use the Compliance Advisor, we send a sanitized snapshot of your workspace (no emails, secrets, or raw evidence files) to Anthropic to generate replies. Messages are stored in your workspace. Do not paste personal candidate data into Advisor chats.

Conformant is built for EU agencies. Your workspace data is hosted in the EU. We work with trusted providers for authentication, data storage, and billing who process data on our behalf under appropriate agreements.

View sub-processors list

We keep workspace data while your subscription or trial is active. Expired anonymous scan sessions are deleted automatically. Expired client share links are removed after 90 days. When you delete your workspace, we remove database rows and stored files within a reasonable period, except billing records we must retain for law.

We set a language preference cookie and, during the free scan, a short-lived scan session cookie. These are strictly necessary for the service. We do not use advertising or analytics cookies.

Workspace admins can export workspace data from Settings. You may request access, correction, or deletion of your personal data, or object to certain processing, by emailing us.

hello@conformant.eu

We may update this page from time to time. If we make meaningful changes, we will let you know through the product or by email.

Last updated: July 2026