Effective Date: September 1, 2026
This Privacy Policy explains how Comply45 (“Comply45,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information in connection with the Comply45 websites, portals, referral program, communications, CPSC eFiling workflows, document-processing services, and related offerings (collectively, the “Services”).
This Policy applies to information relating to website visitors, prospective and current customers, customer personnel and authorized users, referral partner applicants and approved partners, brokers and other designated recipients, laboratory/manufacturer/supplier personnel whose information appears in submitted records, and other individuals whose information is processed through the Services.
It does not apply to information that is not personal information under applicable law or to third-party services governed solely by their own privacy policies.
1. WHO CONTROLS YOUR INFORMATION
For information collected directly through Comply45’s website, accounts, referral program, billing, support, and business operations, Comply45 generally acts as the business/controller responsible for determining how the information is used.
For information a customer submits about its employees, laboratories, manufacturers, suppliers, brokers, or other third parties in order for Comply45 to perform a filing or related service, Comply45 may act as a service provider/processor on the customer’s behalf to the extent applicable law recognizes that role.
Some information is also transmitted to independent recipients such as CPSC, payment processors, designated brokers, and other parties that may separately determine how they process the information they receive.
2. INFORMATION WE COLLECT
Depending on how you interact with Comply45, we may collect the following categories of information.
A. Account and contact information
• name;
• company or organization;
• job title or role, if provided;
• business or personal email address;
• telephone number;
• mailing or business address;
• authentication and account identifiers;
• account preferences and configuration data; and
• records of authorized users associated with an account.
B. Customer, product, and compliance information
To perform CPSC eFiling and related services, we may process information contained in or derived from:
• certificates of compliance;
• laboratory and test reports;
• manufacturer, supplier, importer, private labeler, and laboratory names and contact information;
• product identifiers, SKU/item numbers, descriptions, model information, manufacturing information, and testing information;
• shipment, broker, or customs-related references supplied by the customer;
• applicable standards and regulatory fields;
• CPSC Certifier IDs, Product IDs, Version IDs, Product Collection information, statuses, and related records;
• customer notes, instructions, responses, and corrections;
• documents and attachments uploaded, emailed, or otherwise provided to us; and
• filing results, certificates, PDFs, acknowledgments, and audit records.
These records may contain personal information about individuals who do not themselves have a Comply45 account, such as laboratory contacts, manufacturer personnel, suppliers, brokers, or customer employees.
C. CPSC access and credential information
Where a customer grants Comply45 access to a CPSC Product Collection or related environment, we may process:
• invitation and membership information;
• CPSC account or collection identifiers;
• assigned roles and permissions;
• API tokens, secrets, credential-expiration information, and related technical authentication data; and
• records showing when access was established, renewed, rotated, verified, or revoked.
We use such credentials only for authorized operational purposes and apply access controls appropriate to their sensitivity.
D. Billing and transaction information
We may collect or receive:
• credit-package selections;
• amounts charged, refunded, adjusted, or credited;
• transaction IDs and payment status;
• limited payment-method metadata supplied by our payment processor, such as card brand and last four digits where available;
• credit-ledger activity;
• auto-replenish preferences; and
• purchase and invoice history.
We do not intentionally store full payment-card numbers when those are handled directly by our payment processor.
E. Referral partner and application information
If you apply to or participate in the Comply45 referral program, we may collect:
• company and contact name;
• email address and optional phone number;
• website, if provided;
• requested or assigned referral code;
• information about how you intend to refer customers;
• application status and internal review notes;
• approved discount, commission rate, commission duration, and program status;
• referred-customer attribution;
• qualifying purchase amounts and commission amounts;
• payout status, payout references, and payout history; and
• communications relating to the partner relationship.
Approved partners may receive a read-only portal showing their own code, commercial terms, aggregate referral information, commission lines, earned amounts, paid amounts, and outstanding amounts. The partner portal is not intended to expose customer filing data.
F. Broker and designated-recipient information
If a customer asks Comply45 to send records to a broker or other third party, we may collect that recipient’s company, contact name, email address, phone number, delivery preference, and related instructions.
G. Communications and support information
We may retain emails, support requests, messages, replies, call notes, issue descriptions, document requests, filing questions, and records showing whether and when communications were sent or delivered.
H. Website, device, and usage information
We and our service providers may automatically collect information such as:
• IP address;
• browser and device type;
• operating system;
• approximate location derived from IP address;
• pages or features viewed;
• referring or exit pages;
• timestamps and session information;
• authentication, security, error, and diagnostic logs; and
• cookie or similar technology identifiers.
Comply45 currently uses Google Analytics to understand website and feature usage. Google Analytics may use cookies or similar technologies and may receive information such as device and browser information, IP-derived approximate location, pages viewed, referral information, and interaction data.
I. Audit, security, and integrity records
Because the Services involve regulated filing workflows, we may maintain records such as:
• versions of filing data presented for review;
• customer approval and certification timestamps;
• the identity/account associated with an approval;
• the exact attestation text and version used;
• API request and status histories;
• document-access events;
• notification records;
• administrative changes;
• payment and credit-ledger entries; and
• fraud, security, abuse, or access-control logs.
3. HOW WE COLLECT INFORMATION
We collect information:
• directly from you when you visit the site, create an account, make a purchase, submit a referral application, communicate with us, or use the Services;
• from your company, employer, coworkers, or other authorized users;
• from documents and records customers submit;
• from laboratories, manufacturers, suppliers, brokers, consultants, or other parties participating in a customer’s compliance process;
• from CPSC and other governmental systems when authorized;
• from payment processors and other service providers;
• automatically from browsers, devices, systems, and security logs; and
• from referral links, codes, and attribution mechanisms.
4. HOW WE USE INFORMATION
We may use personal information to:
• create, authenticate, secure, and administer accounts;
• process purchases, credits, refunds, adjustments, and auto-replenishment;
• receive, organize, review, extract, classify, compare, and prepare compliance records;
• determine whether additional information appears necessary;
• evaluate whether an existing filing remains usable or a new/updated filing appears necessary;
• prepare customer review materials;
• record customer approvals, certifications, and audit evidence;
• transmit customer-approved filings to CPSC;
• retrieve and store CPSC statuses, identifiers, and results;
• send records to customers and customer-designated brokers or recipients;
• establish, verify, renew, rotate, or revoke authorized CPSC access and credentials;
• communicate about filings, missing information, account issues, security matters, service updates, and support;
• administer referral applications, referral attribution, commissions, payouts, and partner portals;
• detect, investigate, prevent, and respond to fraud, misuse, unauthorized access, security incidents, or violations of our Terms;
• maintain operational, accounting, compliance, audit, and legal records;
• improve, test, troubleshoot, secure, and develop the Services;
• analyze service performance and usage;
• enforce agreements and protect our rights or the rights of others; and
• comply with law, regulation, court orders, subpoenas, and governmental requests.
5. AUTOMATION AND ARTIFICIAL INTELLIGENCE
Comply45 uses or may use automated systems, rules-based tools, machine-learning systems, and artificial-intelligence-assisted agents to support document extraction, classification, comparison, workflow routing, filing preparation, issue identification, communication drafting, and other operational tasks.
Information submitted to the Services may therefore be processed by such systems and by vendors that provide infrastructure or AI/automation functionality to Comply45, subject to applicable contractual, security, and privacy controls.
Automated outputs may contain errors. Comply45’s workflow is designed to include procedural controls, customer review, and/or human review where appropriate before consequential filing actions.
Comply45 does not authorize customer documents, filing data, or other customer content to be used to train generalized artificial-intelligence models. We configure and select AI and automation services with the intent that customer content is processed only to provide or support the Services, subject to applicable vendor terms, settings, and contractual controls.
6. HOW WE DISCLOSE INFORMATION
We may disclose personal information to the following categories of recipients when reasonably necessary.
A. CPSC and governmental authorities
We may transmit approved filing information, certification data, product information, identifiers, and related records to CPSC. We may also disclose information to regulators, courts, law enforcement, or other governmental authorities when required or permitted by law.
B. Customer-designated brokers and recipients
At a customer’s direction, we may provide filing records, certificates, identifiers, or other information to a broker, freight provider, consultant, employee, contractor, or other designated recipient.
C. Service providers and contractors
We use service providers to support functions such as cloud hosting, database infrastructure, authentication, payment processing, email, document storage, workflow automation, AI-assisted processing, analytics, security, customer support, and professional services. These providers receive information only as reasonably necessary for their functions and are subject to applicable contractual restrictions.
Current categories may include services supplied by platforms such as payment processors, cloud/database platforms, Google Workspace, automation/workflow providers, and application-development or hosting infrastructure. Because vendors can change, this Policy describes categories rather than guaranteeing a static vendor list.
D. Comply45 personnel and contractors
Authorized employees, contractors, consultants, and operational agents may access information where needed to provide, support, secure, administer, or improve the Services.
E. Business advisers and transaction participants
We may disclose information to lawyers, accountants, auditors, insurers, lenders, investors, and advisers under appropriate confidentiality obligations. If Comply45 is involved in a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, information may be disclosed or transferred as part of that transaction subject to applicable law.
F. Referral partners
Comply45 does not intend to expose customer filing data to referral partners. An approved partner may receive limited information necessary to administer commissions, such as aggregate referral counts, qualifying purchase dates/amounts or commission lines, and payout status. The partner portal should not display customer names or filing data unless we expressly change the product and update this Policy as appropriate.
G. With your direction or consent
We may disclose information when you direct us to do so, authorize an integration, or otherwise consent.
7. SALE, SHARING, AND TARGETED ADVERTISING
Comply45 does not sell customer compliance documents, filing data, or personal information for money. Comply45 does not currently use personal information for cross-context behavioral advertising or targeted advertising. If our advertising or analytics practices change in a way that constitutes a “sale,” “sharing,” or targeted advertising under applicable law, we will update this Policy and provide any legally required notice or opt-out mechanism.
8. COOKIES AND SIMILAR TECHNOLOGIES
Comply45 and its providers may use cookies, local storage, pixels, or similar technologies for authentication, security, preferences, fraud prevention, analytics, and site functionality.
At present, Comply45 uses cookies and similar technologies for necessary site functionality, authentication, security, preferences, and Google Analytics. We do not currently use advertising cookies for cross-context behavioral advertising. We may add or change technologies as the Services evolve and will update this Policy and provide consent or preference controls where required by applicable law.
9. LEGAL BASES FOR PROCESSING
Where a law such as the GDPR requires a legal basis, we may process personal information because:
• processing is necessary to perform a contract or take requested pre-contractual steps;
• processing is necessary for our legitimate interests in operating, securing, improving, and supporting the Services, where those interests are not overridden by applicable rights;
• processing is necessary to comply with legal obligations; or
• you have provided consent, where consent is the appropriate basis.
The Services are offered to importers and related business users in the United States and other countries in connection with U.S. regulatory and CPSC compliance workflows. Where applicable law requires a legal basis for processing, including the GDPR or UK GDPR, Comply45 relies on the bases described above and will provide additional notices or protections where legally required.
10. DATA RETENTION
We retain information for as long as reasonably necessary for the purposes described in this Policy, including to provide Services, maintain filing and certification evidence, administer accounts and referral commissions, process payments, satisfy contractual obligations, resolve disputes, prevent fraud, enforce agreements, and comply with legal, tax, accounting, security, and regulatory requirements.
Retention periods vary by data type. In particular:
• filing, certification, CPSC identifier, and audit records are generally retained for up to seven years after the relevant filing or account activity, and longer where reasonably necessary for legal, regulatory, evidentiary, or dispute purposes;
• transaction, credit-ledger, referral commission, and payout records are generally retained for up to seven years for tax, accounting, fraud, audit, and dispute-resolution purposes;
• operational and security logs are generally retained for up to two years, subject to system capabilities, security needs, investigations, and legal holds;
• draft filings and associated uploads that are deleted before submission are generally removed or made inaccessible within 30 days, subject to backups, security logs, technical limitations, and legal holds; and
• deleted or archived accounts may continue to have historical records preserved where deletion would undermine legal, regulatory, financial, security, or audit requirements.
11. SECURITY
Comply45 uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, loss, misuse, or disclosure. Depending on the system, controls may include authenticated access, role-based permissions, private storage, encrypted network transmission, encryption at rest supplied by infrastructure providers, expiring or signed document links, secret-management controls, audit logs, and tenant-access restrictions.
No system can be guaranteed completely secure. You are responsible for protecting your own email account, devices, authentication links, passwords or credentials, and authorized-user access.
If you believe your Comply45 account or information has been compromised, contact hello+privacy@comply45.com promptly.
12. YOUR PRIVACY CHOICES AND RIGHTS
Depending on where you live and subject to applicable exceptions, you may have rights to:
• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion of certain information;
• request a portable copy of certain information;
• object to or restrict certain processing;
• opt out of certain sale, sharing, targeted advertising, or profiling practices where applicable;
• withdraw consent where processing depends on consent; and
• appeal certain privacy-request decisions where required by law.
To exercise a privacy right, contact hello+privacy@comply45.com. We may need to verify your identity and authority before completing a request.
If you submit a request on behalf of another person, we may require proof of authorization. If your information is held solely on behalf of a Comply45 customer, we may direct your request to that customer or assist the customer in responding as appropriate.
We will not unlawfully discriminate against you for exercising applicable privacy rights.
13. U.S. STATE-SPECIFIC DISCLOSURES
Residents of certain U.S. states may have additional rights concerning access, correction, deletion, portability, opt-out, limitation of sensitive-data use, or appeals.
For purposes of state privacy laws, the categories of personal information collected, purposes of use, and categories of recipients are described throughout this Policy.
Comply45 currently operates below the $25 million annual-revenue threshold associated with certain state privacy-law tests and does not currently expect to process personal information at the scale that independently triggers broad consumer-privacy obligations in many states. Applicability depends on the particular law and may also turn on data volume, business model, and other thresholds. Comply45 will reassess these obligations as the business grows.
14. CALIFORNIA NOTICE AT COLLECTION
If the California Consumer Privacy Act, as amended, applies to Comply45, this Policy is intended to serve in part as a notice at collection. Categories potentially collected include identifiers, customer records, commercial information, internet/network activity, professional or employment-related information, and in limited circumstances information that may qualify as sensitive personal information, such as account credentials or precise authentication secrets.
Comply45 does not use CPSC API secrets or similar credentials to infer characteristics about individuals. Such credentials are used for operational authentication and security.
Comply45 will supplement this California notice if and when the California Consumer Privacy Act, as amended, becomes applicable to Comply45 based on applicable statutory thresholds or business practices.
15. CHILDREN
The Services are intended for businesses and adults acting in commercial or professional capacities. They are not directed to children under 13, and Comply45 does not knowingly collect personal information directly from children under 13 through account registration or referral applications. If you believe a child has provided personal information to us inappropriately, contact hello+privacy@comply45.com.
16. INTERNATIONAL DATA TRANSFERS
Comply45 and its service providers may process information in the United States and other countries where they operate. Those countries may have privacy laws different from those in your jurisdiction.
Because Comply45 may serve importers and related business users located outside the United States, personal information may be transferred to and processed in the United States and other countries where our service providers operate. Where applicable law requires a transfer mechanism or other safeguard for international transfers, Comply45 will use an appropriate mechanism or protection.
17. THIRD-PARTY LINKS AND SERVICES
The Services may link to or interoperate with third-party services, including CPSC, payment processors, email services, brokers, or other external platforms. Their privacy practices are governed by their own notices, not this Policy, except to the extent Comply45 separately controls the processing.
18. EMAIL AND COMMUNICATION PREFERENCES
Comply45 sends transactional and operational emails concerning accounts, purchases, referral applications, filing status, missing information, review and certification, submissions, completion, security, and similar matters. These communications are necessary to provide the Services and generally cannot be opted out of while maintaining the relevant account or transaction.
If Comply45 sends promotional marketing emails, you may opt out using the unsubscribe mechanism provided. Opting out of marketing does not stop transactional or service communications.
19. CHANGES TO THIS POLICY
We may update this Privacy Policy to reflect changes in law, technology, vendors, products, or business practices. We will post the updated Policy and change the “Last Updated” date. If changes are material, we may provide additional notice through email, the Services, or another reasonable method.
20. CONTACT US
Comply45
8876 Spanish Ridge Ave, Ste 204
Las Vegas, NV 89148
General: hello@comply45.com
Privacy/Security: hello+privacy@comply45.com
Legal: hello+legal@comply45.com