Privacy Policy
Version 2, approved 2 Nov 2026
Bluetrino SA PTY Ltd (registration number 2014/096242/07, 70 Rosmead Ave, Cape Town, Western Cape, 7708, ZA) runs ComplianceThing. We are the responsible party for account and billing information. For documents and other content that customers put into ComplianceThing, the customer is the responsible party and we act as its operator, under our Data Processing Agreement.
Our Information Officer is Chad Faurie. Contact them at support@bluetrino.com.
What we collect, and why
| Information | Why we use it | Basis |
|---|---|---|
| Name, email, password (hashed), authenticator enrolment, timezone | To create and secure your account and send you notices | Contract; our legitimate interest in security |
| Organization details: legal and trading name, registration, VAT and regulator numbers, address, contact details | To set up the workspace and fill organization details into documents | Contract |
| Sign-in records, IP address, bot-check results, the security audit log | To prevent fraud and investigate misuse | Legitimate interest; legal obligation |
| Usage records (features used, AI tokens) | To apply plan limits and bill | Contract |
| Documents, versions, assessments, chat history, signatories | To provide the service, as the customer's operator | The customer's instructions |
Who we share it with
We share information only with the service providers listed as sub-processors in the Data Processing Agreement. They host the service, send email, check for bots, report errors and run AI features. We don't sell personal information. We don't let AI providers train on it.
Where it is processed
We store and process your information in Ireland, in the European Union, where the GDPR applies. Two providers receive information in the United States:
- OpenAI. To run AI features, we send the relevant document text and your questions to OpenAI, L.L.C. OpenAI processes it under a data processing agreement with us. It may not use the text to train its models, and it does not keep our responses. Abuse-monitoring logs are kept for up to 30 days and are then deleted.
- Sentry. Sentry receives error reports to help us fix faults. We switch off user details and request contents in those reports.
Each provider is bound by a data processing agreement that protects your information in a way substantially similar to POPIA, as section 72 requires.
How long we keep it
- Account information is kept while the account is active.
- Security and audit records are kept while the organization's account is active.
- Customer content is kept as the customer instructs.
- When an account or organization closes, we delete its information as soon as the closure is confirmed. Backups follow their normal expiry cycle.
Security
Every user signs in with an authenticator app, and changing a password signs out their other sessions. Each organization's data is isolated at the database level. Data is encrypted in transit and at rest by our hosting providers.
Your rights
Under POPIA you may ask to see the personal information we hold about you, have it corrected or deleted, and object to its processing. Email support@bluetrino.com. If your request concerns your organization's documents, we will pass it to that organization. You may also complain to the Information Regulator (South Africa).