Last updated: October 2026 (v3)
The data controller responsible for data processing on this website is:
KI·SUM·AI - Kisum GmbH
Sonnwendjochstr. 6
81825 München, Germany
Email: info@compliancelint.com
We may collect the following categories of personal data:
203.0.113.x — never the full address), and the user-agent string. Email addresses and full IPs are scrubbed before storage.We process your personal data based on the following legal grounds under GDPR:
4.1 Essential cookies and browser storage
We do not use analytics or advertising cookies and we do not use a third-party analytics service. We use only cookies and browser storage needed for requested account functions, security, user-selected interface settings, or to remember a privacy choice:
cl_session: encrypted, HttpOnly authentication session cookie;cl_csrf: cookie used for protection against cross-site request forgery;gh_oauth_state / g_oauth_state: short-lived state values used during GitHub or Google sign-in;cl_pending_invite: short-lived team-invitation token used during the sign-in flow;cl_return_to: stores the same-origin page to return to after sign-in for up to 10 minutes;compliancelint-sidebar-collapsed (localStorage): remembers the sidebar state selected by you; andcl_sentry_opt_out (localStorage): is written only if you opt out of browser error reporting and is used only to remember that choice.These technologies are not used for advertising, cross-site tracking or user profiling. Insofar as § 25 TDDDG applies, we use them under § 25(2)(2) TDDDG because they are strictly necessary for a function requested by you, for the security of that function, or to implement a setting/privacy choice selected by you. Where personal data are processed, the applicable GDPR legal basis is Art. 6(1)(b) GDPR where processing is necessary to provide requested account/service functions, Art. 6(1)(f) GDPR for proportionate service security and related legitimate interests, or Art. 6(1)(c) GDPR where processing is necessary to implement a legal data-protection obligation.
4.2 Minimal server-side page statistics
To understand at a coarse level which parts of ComplianceLint are used, we maintain minimal statistics on our own server. No analytics script or third-party analytics service is used, and we do not set or read an analytics cookie or browser-storage identifier.
For each full page load handled by our server—for example, when a page is opened directly, reloaded, or reached from another site—we increment the aggregate counter for that date and page. In-app navigations within ComplianceLint are not counted. Query strings and record-specific identifiers are removed before the counter is written. The statistics component does not use IP addresses, User-Agent headers, Referer headers, cookies, session IDs, account IDs or browser-storage values as analytics inputs. We do not calculate unique visitors and do not recognise visitors across requests or days. Automated traffic is excluded only where it has already been classified independently for security/request-handling purposes.
The stored page-statistics table contains only the date, normalized route template and page-view count. Daily page-statistics rows are deleted after 24 months. Access is restricted to Kisum GmbH management. We do not use these statistics for advertising, profiling, automated decisions or per-user analysis.
Technical access and application logs used to operate, secure and troubleshoot the service are described separately in Section 4.3 below. They are not part of the page-statistics dataset described in this section.
To the extent that personal data are involved in creating these minimal statistics, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to operate, understand and improve the service using a strongly data-minimised method. You have the right to object to processing based on Art. 6(1)(f) GDPR in accordance with Art. 21 GDPR.
4.3 Technical and security logs
To operate, secure and troubleshoot the service, our reverse proxy creates a technical access log for HTTP requests. It contains the time, a masked IP address (/24 for IPv4, /48 for IPv6), request method, host and path, status code, response size and request duration. Request headers and query strings are not logged. Access-log files are retained for no more than 14 days and may be deleted earlier by size-based rotation. We do not use these logs for analytics, advertising or profiling. The legal basis is our legitimate interest in the secure and reliable operation of the service, including detecting abuse and attacks and diagnosing technical problems (Art. 6(1)(f) GDPR).
The application also writes operational logs, such as errors, job results and request IDs. E-mail addresses and IP addresses are removed before entries are written. These logs are limited to three 10 MB files and retained for no more than 14 days. They are used only for operation, security and troubleshooting and not for analytics, advertising or profiling. The same legal basis applies.
4.4 Internal operational statistics
We also create internal aggregate statistics from operational records that we already process to provide ComplianceLint and administer subscriptions, for example the number of accounts, scans, evidence items, generated PDFs or Compliance Packs, and subscription starts or cancellations during a defined period. This does not create additional user tracking and does not cause new categories of data to be collected.
The aggregation uses only the fields needed to calculate the relevant count. The resulting management statistics contain aggregate counts rather than user-level analytics and are accessible only to Kisum GmbH management. They are used for internal service management, product planning and business administration. We do not use them to create user profiles or make automated decisions about users. To the extent personal data are processed during aggregation, the legal basis is Art. 6(1)(f) GDPR.
Error tracking. Sentry (EU instance) captures uncaught exceptions to enable bug-fixing. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in network and information security, Recital 49). Data minimisation: IP, cookies, headers, performance spans and session replay are not transmitted; email addresses and IP addresses are scrubbed from breadcrumbs and events before transmission.
Optional MCP scanner telemetry (opt-in). The MCP scanner (the BSL source-available CLI tool you install via npx compliancelint init) runs on your own machine and is silent by default: no telemetry leaves your machine unless you explicitly opt in. Opt-in is a single parameter on cl_connect: cl_connect(project_path, enable_telemetry=true). Opt-out is the symmetric enable_telemetry=false (or running cl_disconnect, which also wipes the per-user-machine telemetry config at ~/.compliancelint/sentry.json).
When enabled, the scanner ships only uncaught Python exceptions to a separate Sentry project (kisum-gmbh-2e / compliancelint-mcp, EU instance), with aggressive minimisation: send_default_pii=false (no hostname, username, IP, or environment auto-attached); traces_sample_rate=0 (no performance spans); 25% sampling (one event in four is transmitted); home-directory prefix in stack-trace paths replaced with the literal <home> sentinel; email and IPv4 patterns scrubbed from messages and breadcrumbs; and 12 categories of environmental noise dropped at the source (FileNotFoundError, PermissionError, UnicodeDecodeError, git subprocess CalledProcessError, SSL/TLS errors, KeyboardInterrupt, BrokenPipeError, and filesystem variants) so we only see events that look like actual ComplianceLint defects.
Legal basis: Art. 6(1)(a) GDPR (consent — explicit opt-in via enable_telemetry=true), with Art. 6(1)(f) GDPR as a fallback characterisation (legitimate interest in fixing bugs that affect users, Recital 47). Tier-independent — error tracking is provided to all users regardless of plan, because fixing bugs is our responsibility regardless of which tier you are on.
We rely on a small set of subprocessors for hosting, error tracking, transactional email, billing, and authentication. Each is contractually bound under GDPR Art. 28 to process personal data only on our documented instructions.
The current subprocessor list — including each subprocessor's purpose, processing region, and Chapter V GDPR transfer mechanism — is maintained at a stable URL: /legal/sub-processors. We will notify customers in writing of any new subprocessor before it processes personal data.
For international transfers outside the EEA, where applicable we rely on EU Standard Contractual Clauses, the EU–U.S. Data Privacy Framework, and supplementary safeguards as required by Chapter V GDPR.
We collect IP addresses and timestamps when you use our API to detect unauthorized account sharing and protect our service. This data is processed based on our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
API usage data (IP address, timestamp, API key prefix) is retained for 30 days and automatically deleted thereafter. We never store your full API key in monitoring logs.
ComplianceLint processes limited error logs, audit logs, and diagnostic metadata to operate, secure, debug, and evidence use of the Service. Application-generated logs are stored primarily on EU-hosted infrastructure operated by KI·SUM·AI - Kisum GmbH and its hosting provider, Hetzner, in Germany. Where applicable, we also use the subprocessors listed in §5 (most relevantly Sentry EU for supplemental error tracking).
Log contents. Logs may include: timestamp, account or user identifier, event type, affected feature, a truncated IP prefix (final octet zeroed), user-agent string, request route, error ID, stack-trace metadata and billing-event identifiers. Customer source code, secrets, request bodies, uploaded files and production datasets are not logged.
Legal basis. Error and audit logs are processed under Art. 6(1)(f) GDPR (legitimate interest in service security, integrity, and operational reliability). Insofar as log entries form part of records subject to statutory retention obligations, the corresponding processing is also based on Art. 6(1)(c) GDPR. The applicable statutory retention rules are set out in the Data Processing Agreement at /legal/dpa § 13.
Retention. Error logs: up to 90 days. Audit logs: up to 365 days for security, customer evidence exports, billing integrity and legal claims. Where log entries are subject to statutory retention (commercial / tax law), such entries are stored access-restricted for the statutory period as permitted by Art. 17(3)(b) GDPR and deleted after.
Security. Application data is encrypted at rest on EU-hosted infrastructure (Hetzner DE) and in transit via TLS. Access is restricted to authorised personnel under role-based access control.
Automated decisions. We do not make automated decisions about natural persons that produce legal or similarly significant effects within the meaning of Art. 22 GDPR.
Supervisory authority. You may lodge a complaint with the competent data protection supervisory authority, in particular the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), www.lda.bayern.de.
Data Processing Agreement. Customers acting as data controller are covered by our pre-executed Data Processing Agreement (Art. 28 GDPR) at /legal/dpa, accepted on signup. A counter-signed PDF copy is available on request via info@compliancelint.com.
Under GDPR, you have the following rights:
To exercise these rights, contact us at info@compliancelint.com.
For any privacy-related questions, please contact us at: info@compliancelint.com