PRIVACY POLICY

Last updated October 3, 2026

THE SHORT VERSION

You can check an image without an account, and without telling us who you are. The image you upload is stored privately and deleted 24 hours after your last check, along with the record of the check.

If you create an account, the only personal detail we ask for is an email address. We do not ask for your name, date of birth, address or phone number, and we never see your card details.

We do not sell personal information, and we do not share it with advertisers.

WHO WE ARE

ComplianceKit ("we", "us") operates compliancekit.app, a tool that checks product images against Amazon's published listing requirements and fixes some of the problems it finds.

We are based in California, United States. You can reach us at support@compliancekit.app about anything on this page, including any request covered by Your rights below.

CHECKING AN IMAGE WITHOUT AN ACCOUNT

When you check an image without signing in, we handle four things:

The image itself. It is stored in a private bucket that is not publicly listable or readable. It is used to run the check and, if you ask for it, to produce the fixed version.
Measurements of the image — its width, height, file size, format, and the result of each rule we check. These are numbers about the file, not about you.
A random session identifier, held in a cookie, so the result you are shown is yours and not someone else's.
A one-way hash of your IP address. We do not store the address itself. It is put through a keyed HMAC-SHA256 and only the hash is kept, which lets us rate-limit abuse without being able to recover the original address.

If you ask us to email you a fixed file, we also store the email address you type, because we need it to send the link and to honour the free-fix limit.

ACCOUNTS

Signing in is by email approval: you enter an address, we email a link, and approving it signs you in. There is no password to choose.

For an account we store:

your email address;
a username generated from that address, used internally to identify the account;
your plan and usage counters — which tier you are on, whether it is active, and how many checks and fixes you have used;
identifiers issued by Stripe for your customer and subscription records.

Our database schema carries some unused fields inherited from an earlier product. We do not ask for, collect or display them, and for ComplianceKit accounts they are left empty.

When you choose to share a fixed image, we publish a page at compliancekit.app/s/… and copy the images it shows onto that page. If you choose the before-and-after layout, that page also publishes the original image you uploaded — the one our check rejected — next to the fixed one, together with why it was rejected (for example, that its background wasn't pure white). Anyone with the link can see the page, and it stays up until you turn it off with Stop sharing on your dashboard, or delete your account. Shared pages are excluded from search engines. Social networks that have already fetched the preview may keep their own copy, which we cannot remove. Only signed-in accounts can share; images checked anonymously are still deleted 24 hours after the last check and are never published.

PAYMENTS

Payments are processed by Stripe. Card details are entered on Stripe's own checkout page and are never sent to or stored on our servers. We receive only the identifiers and subscription status Stripe returns, which is what tells us your plan is active.

Stripe processes that payment data as its own controller. See Stripe's privacy policy.

ANALYTICS

We use Google Analytics 4 to understand which pages people use and where they give up. It records page views and a small number of product events, such as an image being checked or a fix being downloaded. We do not send it your email address or the contents of your image.

If you reach the site by clicking one of our ads, Google may also record that click so we can tell whether the ad worked.

COOKIES

We keep this deliberately small:

A session cookie (connect.sid), which keeps you signed in and ties an anonymous check to the browser that made it. It is marked HttpOnly and Secure, so page scripts cannot read it, and it lasts 24 hours. The site cannot work without it.
Google Analytics cookies, which distinguish one visitor from another for the measurement described above.

We do not set advertising or profiling cookies of our own. You can block or delete cookies in your browser; blocking the session cookie will stop sign-in and the checker from working.

HOW LONG WE KEEP THINGS

Anonymous checks: 24 hours after your last check. Each new check restarts the 24 hours. A cleanup job runs every hour and deletes expired checks together with the stored image, so deletion can happen up to an hour after the 24 hours end. This is not a promise to delete on request later — it happens automatically.
Sign-in requests: 10 minutes. An unapproved request expires and is removed.
Session cookies: 24 hours.
Accounts: until you ask us to delete them. Email us and we will remove the account and its records.
A claimed fix is kept with the account or email that claimed it, so the free-fix limit means something. It is not deleted on the 24-hour schedule.
Shares: until you turn them off. Turning off a share (with Stop sharing on your dashboard) or deleting the account removes it immediately. See Images you share above for what a shared page includes.

WHO ELSE HANDLES YOUR DATA

We keep this list short on purpose. Each of these does one job for us:

Heroku — runs the website and the API.
MongoDB Atlas — stores accounts, checks and sessions.
Amazon Web Services (S3) — stores uploaded and fixed images.
Stripe — takes payments.
Google Analytics — measures site usage.
DreamHost — sends our sign-in and notification email.

We do not sell personal information, and we do not pass it to advertisers, data brokers or anyone else for their own purposes.

WHERE DATA IS PROCESSED

Our servers and storage are in the United States. If you are in the UK, EU or elsewhere, using ComplianceKit means your data is processed there.

YOUR RIGHTS

Wherever you live, you can ask us to tell you what we hold about you, correct it, delete it, or send you a copy. Email support@compliancekit.app and we will act on it.

Because we hold so little — an email address, a plan, some counters — most requests are quick to satisfy. We may need to confirm you control the address before acting, so that someone else cannot use this to reach your data.

If you are in the UK or EU, our basis for handling this is performing the service you asked for, and our legitimate interest in preventing abuse of a free tool. You can object to the analytics described above by blocking its cookies. If you are in the UK or EU you may also complain to your data protection authority.

SECURITY

The site is served over HTTPS. Uploaded images sit in a private bucket that is not publicly readable, and signed-in users are served their own files through short-lived links. Session cookies are HttpOnly and Secure. IP addresses are stored only as keyed hashes.

No service can promise perfect security, and we would rather say so than imply otherwise.

CHILDREN

ComplianceKit is a tool for people selling products online and is not directed at children. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, email us and we will delete it.

CHANGES TO THIS POLICY

If what we collect changes, this page changes with it, and the date at the top moves. There is no separate cookie policy — everything we set is listed above.

CONTACT

support@compliancekit.app
ComplianceKit, California, United States