Privacy Policy
Last updated: November 2026
1. What We Collect
We collect account information you provide (name, email, company name, phone number), and the compliance data you create within the platform (risks, audits, policies, documents, vendor records, and related metadata).
2. How We Use Your Data
Your data is used to operate the Service: authenticating your account, scoping data to your organization (tenant), generating compliance reports and dashboards, and sending you operational notifications (e.g. approvals, reminders).
3. Data Isolation
Regulane is a multi-tenant platform. Every organization's data is logically isolated and scoped to that organization; users from one organization cannot access another organization's records.
4. Third-Party Processors
We use the following providers to deliver the Service. Each processes data only as needed to provide its service to us. Google Firebase: sign-in and account credentials. Prisma (Prisma Postgres): the database holding your workspace records. Vercel: application hosting, with our application servers in Singapore, and storage of the files you upload. Resend: transactional email such as verification, password reset and assignment notifications. Anthropic: when someone in your workspace uses an AI feature, the question and a summary of the relevant workspace records are sent to Anthropic's Claude to produce the answer; nothing is sent if AI features are not used. For REGUBOT, the in-app companion, that is the question, the recent messages of that conversation, the name of the page it was asked on, the person's chosen name and explanation style, and only the records REGUBOT's tools read to answer that question (for example the titles, scores and due dates of open risks); colleagues are not named. REGUBOT's help search and navigation make no AI request. Cashfree Payments: online payment processing; card and bank details are entered with Cashfree and never reach us.
4a. Google Workspace Integration
If a company administrator connects Google Workspace, Regulane reads, through Google's Admin SDK with read-only access, the user directory of that Workspace: each account's email address, whether it is suspended or archived, whether it is an administrator, whether 2-Step Verification is enrolled and enforced, and when it was created and last signed in. It also records the email address of the administrator who connected. This is used only to run the security checks shown on the Integrations screen (2-Step Verification, administrator accounts and unused accounts) and to keep them current with a daily check. The access token is stored encrypted. Check results, including the email addresses of accounts that fail a check, are kept for up to 90 days. Disconnecting revokes Regulane's access at Google and deletes the stored results. Data received from Google is not sold, not used for advertising, not used to train any model, and not sent to Anthropic or any other AI provider. Regulane's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4b. GitHub Integration
If a company administrator connects GitHub, the Regulane GitHub App is installed on that GitHub organisation with read-only permissions, and only for the repositories the organisation's owner chooses. Regulane reads: whether the organisation requires two-factor authentication; the usernames of members and owners and which of them lack two-factor authentication; the usernames of outside collaborators; and, for each shared repository, its name and whether its default branch requires a pull request. Regulane does not read source code, issues or pull requests, and cannot change anything. It also records the GitHub username of the person who connected. No GitHub password or token is stored: access tokens are created for each daily check and expire within an hour. Check results, including the usernames and repository names that fail a check, are kept for up to 90 days. Disconnecting uninstalls the app from the organisation and deletes the stored results. Data received from GitHub is not sold, not used for advertising, not used to train any model, and not sent to Anthropic or any other AI provider.
4c. Coding Agents
A company administrator or manager can create agent tokens that let coding assistants (such as Claude Code, Cursor, GitHub Copilot, Codex, Windsurf or Gemini CLI) connect to Regulane. The coding assistant runs on your developer's machine under your agreement with its provider, and Regulane does not send it your code or receive your code from it. Regulane sends it the workspace name and Regulane's secure-coding rules. The assistant reports back the repository name or address, branch, commit, which assistant it is, a one-line description of what was checked, the rules checked and, for each finding, a file path, a line number and a one-sentence summary. Before a report is stored, credentials in a repository address and anything in it that looks like a secret, email address, card, Aadhaar or PAN number are replaced. Only a fingerprint of each agent token is stored. The latest 50 checks of each repository are kept, and all of them are deleted with the workspace. Reports are not sent to Anthropic or any other AI provider by Regulane. A coding assistant can also connect without a token, for a free check by anyone: Regulane sends it the same rules and turns its report into a scorecard that it sends straight back, and stores none of it. The connecting IP address is used, in the server's memory only, to limit repeated requests; Regulane does not save it with anything.
4d. Free DPDP Act Check
Anyone can check a website against the DPDP Act on regulane.com without an account. The website address you enter (and a privacy notice address, if you give one) is sent to Regulane, which reads up to six public pages of that site: its robots.txt, its home page, its privacy notice and, if the notice links to one, its grievance page. It honours robots.txt and identifies itself as Regulane in each request. The result is sent back to your browser and is not stored; Regulane keeps the address and result in the server's memory for up to ten minutes so that a repeat check does not request the site again, and saves neither. Your answers to the questions in the check are scored in your browser and are never sent to Regulane. Your IP address is used, in the server's memory only, to limit repeated checks; Regulane does not save it with anything. If you share the result, you choose where it goes.
5. Data Retention
While your workspace is active, its records are kept until someone in your workspace deletes them; Regulane does not delete them on a schedule. Results from connected integrations (Google Workspace, GitHub) are kept for up to 90 days and deleted when the integration is disconnected. When a workspace is closed it is first archived: nobody can sign in, nothing is deleted, and it can be restored. On your request, after at least 24 hours in the archive, it is permanently deleted: every record, every uploaded file, and every member's sign-in account, and any integration access is revoked at the provider. This cannot be undone. Any backup copy of the database is encrypted and kept for no more than 30 days, so deleted data leaves backups within 30 days of deletion. Payment records are also held by Cashfree, our payment processor, under its own legal retention obligations. A company administrator can download a complete copy of the workspace's records at any time from Workspace settings; only the most recent export file is kept, and it is deleted with the workspace. Audit packages prepared for an auditor are kept for 30 days and then deleted. REGUBOT conversations are visible only to the person who had them and are deleted 90 days after their last message; each person can delete their own sooner from REGUBOT's settings, and feedback on an answer is deleted with it. When REGUBOT cannot answer a question from Regulane's help, it may record the topic in general words, with names, figures and contact details removed, so that Regulane can write a help article; only the topic and how many workspaces raised it are kept, not the question or which workspace asked. A company administrator can turn this off in REGUBOT's settings. The workspace's audit trail (who changed what, and when) cannot be edited or deleted while the workspace exists; it is deleted with the workspace. It records free text, such as notes and descriptions, only as its length and a fingerprint, not the words, so personal data written in a record can be corrected or erased there.
5a. Where Your Data Is Stored
Regulane's application servers run in Singapore. Your workspace records are held in a Prisma Postgres database in the United States (AWS us-east-1, North Virginia), and your uploaded files in Vercel Blob storage. Data in a workspace is therefore transferred outside India, which the Digital Personal Data Protection Act, 2023 permits except to countries the Government restricts by notification. Sign-in accounts are held by Google Firebase, email passes through Resend, and AI requests, when used, are processed by Anthropic; these providers may process data in other countries, including the United States, under their own data-protection terms. Data is encrypted in transit (TLS) between your browser, our servers and each provider.
6. Security
We use industry-standard safeguards including encrypted connections (TLS), hashed/managed credentials, and role-based access controls. No method of transmission or storage is 100% secure, but we work to protect your data using currently accepted industry standards.
7. Your Rights
Under the Digital Personal Data Protection Act, 2023 you have the right to obtain a summary of the personal data we process about you and of what we do with it; to have it corrected, completed, updated or erased; to have a grievance answered; and to nominate someone to exercise these rights for you. To make a request, write to support@regulane.com from the email address on your Regulane account, or tell us that address if you write from another one; we need nothing else to identify you. We answer every request within 30 days. A company administrator can also export the workspace's records at any time. Records inside a workspace (risks, policies, vendor records and the like) are created and controlled by the company that owns the workspace, and we process them on its behalf: if you ask us about personal data in those records, we pass your request to that company and tell you we have done so. Depending on where you are, you may have further rights under other data protection law, such as the GDPR.
7a. Withdrawing Your Consent
You gave consent by creating an account or by sending us a form, and you can withdraw it as easily: write to support@regulane.com, or ask your company administrator to remove you from the workspace. Deadline reminder and regulatory alert emails can also be switched off on their own, from the link at the foot of each one or in your profile. Once you withdraw, your account is deactivated: you can no longer sign in and we stop sending you email. Your name stays on the records you created, approved or acknowledged in your company's workspace, because those records are your company's audit trail; they are deleted with the workspace (section 5). Personal data we hold for our own purposes, such as a form you sent us, is erased unless the law requires us to keep it, as with billing records. Withdrawing does not undo processing that was lawful before it.
7b. Grievances and the Data Protection Board
If you have a grievance about how we handle your personal data, write to our Grievance Officer at support@regulane.com. We answer every grievance within 30 days. The same person answers any question about how we process your personal data. If you are not satisfied with our answer, or we do not answer within that time, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023. The Act asks you to use our grievance route first.
8. Cookies
We use a minimal, functional session cookie to keep you signed in, and two preference cookies that remember your light or dark theme and whether the sidebar is collapsed. REGUBOT keeps where you have moved it, whether it is tucked away and how often it greets you in your browser's local storage, on that device only. We do not use third-party advertising cookies on the application itself.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice.
10. Contact
Questions about this Privacy Policy or your personal data go to our Grievance Officer at support@regulane.com, who answers questions about how we process personal data. The same address handles everything else.
Also see our Terms of Service.