Privacy policy.

Effective October 21, 2026. Last updated October 21, 2026.

Who we are

policyandcompliance.com is published by AllyMatter Inc, 651 N Broad St, Suite 201, Middletown, DE 19709, United States. AllyMatter Inc is the controller of the personal information collected through this site, its forms and its emails. Our Data Protection Officer is Sid Varma, who can be reached at [email protected].

This policy covers this site only. Sites we link to have their own privacy policies, and this one stops applying when you leave.

Information collected when you visit

Delivery and security. The site is hosted on Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes the standard details your browser sends with each request, including your IP address, browser type, the page requested and the time. Cloudflare may set a security cookie if your connection is challenged (see the Cookie Policy).

Analytics. We use PostHog, hosted in the United States, to see which pages are read and which filters and links are used. Requests to PostHog go through our own server first, which removes your IP address and adds only the country Cloudflare reports for your connection. PostHog never receives your IP address. What else happens depends on your choice in the consent box:

• Before you choose, nothing is recorded.
• If you leave Analytics unticked (or choose Only necessary), we still count page visits and clicks in a way that cannot identify you: no cookie, no stored ID, and no IP address kept. Each visit is labeled with a code that changes every day and cannot be turned back into an IP address or matched across days. No recordings are made.
• If you tick Analytics, PostHog stores a random ID in your browser so it can recognize your next visit, and records pages, clicks and recordings of visits so we can fix what confuses people. Recordings mask everything typed into a form. If you later send us a form, the email you typed is linked to your earlier visits on this site, so we can see which pages led to the request.

This analytics account is separate from AllyMatter's product analytics; nothing in it is shared with AllyMatter's product or sales systems, and it is never used for advertising.

The consent record. When you choose, your browser keeps a record of the policy version, the date and your answers, under a random identifier. A copy of that record, with the same identifier, date and answers and nothing else (no IP address, no browser details), is sent to us so we can show what you chose.

Information you give us

If you subscribe

We store the email address you type, what you chose to follow (your business type, any standards, families or states you picked, and the content categories), and the time and IP address of your consent, so we can show that you asked for the emails. We never ask for a name, a company or a phone number. Nothing is sent until you click the confirmation link. Every email carries an unsubscribe link, and unsubscribing removes you from the sending list immediately.

If you ask for a guide

We store the email address you type, your company if you give it, and the time, IP address and Terms version of your request. We email you the guide when it is published. You also agree, in the box on the form, to hear from AllyMatter Inc, which publishes this site: an AllyMatter representative will reach out within a week to offer more help, and AllyMatter may email you after that. Every email carries an unsubscribe link. The tools and firms named in a guide never receive your details: they see how many people downloaded it, and nothing else.

If you ask for a compliance checklist

We store your answers, the email address you type, any name, business name and website you give, which sections matter most to you and anything you write in the free-text box, with the time, IP address, country and Terms version of your request and the time and version of the box you tick to accept that the report is general information. We use them only to prepare your checklist and, if you tick the updates box, to tell you when a rule in it changes; the updates box starts the same confirmation as the subscribe form, so nothing is sent until you click the link. We do not share them with any firm. We keep answers for 24 months, then delete them unless you are subscribed. Analytics records which steps were completed and the answer categories (such as business type, headcount band and states), never your email, name, business name, website or anything you type.

If you ask for help finding a firm or tool

We store what you write, your name and email address, your company, size and timeline if you give them, the page you came from, and the time, IP address and Terms version of your request. A person reads it and replies. If you ask to be matched with firms, we pass on only what you write and only to the firms you agree to. Firms do not see your contact details until you choose one.

If you claim a listing, buy a profile or placement, or advertise

We store your name, work email, organization, role and what you tell us about the listing or placement, with the time, IP address and Terms version of your request, and we may check that you work for the organization. If you pay, the payment is taken through a payment link we send; we never see or store your full card details, and we keep the invoice record the law requires.

If you send us a press release or an article

We store what you send: your name if you give it, your email address, your organization, the text, and the time, IP address and Terms version of your request. Whatever the release or article itself contains, including any media contact or author byline, is published with it.

If you subscribe to press release announcements

This is a separate list. We store the email address you type and the time, IP address and Terms version of your consent, and we email you each new press release published here. Nothing is sent until you confirm, every email carries an unsubscribe link, and we never give the list to the organizations whose releases we publish, or to anyone else.

If you write to us

Mail to any of our addresses reaches a person and is kept while we deal with it. If you ask for a correction or for something to be deleted, we keep the request and what we did about it.

Firms and people in the directory

Listings describe organizations. They are compiled from public filings, public registers and firms' own published material, and each record says where it came from. Some listings name people, such as an independent consultant or a firm's published contact. We may contact a listed firm about its listing, using the business contact details it publishes, by email or LinkedIn message. If you are named in a listing and want it changed or removed, write to [email protected] and we will act.

Why we use it, and our legal bases

We use personal information only for the purpose it was given for, as set out above, and to keep the site secure and working. Where the GDPR or UK GDPR applies, our legal bases are:

• Consent: analytics beyond the anonymous count, subscriptions, press release announcements, and follow-up from AllyMatter after a guide request. You can withdraw consent at any time; that does not undo use that already happened, and we cannot recall an email already sent.
• Contract: answering a request you sent, preparing a checklist you asked for, and providing a listing, profile, placement or press release you bought.
• Legitimate interests: keeping the site secure, counting visits anonymously, publishing the directory from public sources, contacting listed firms about their listings, and defending legal claims.
• Legal obligation: keeping records the law requires, such as invoices, and answering lawful requests from authorities.

Who processes it for us

We use these service providers, each acting for us under contract and only on our instructions:

• Cloudflare: hosting, page delivery, security and the server functions that receive forms.
• Supabase: the database that holds form submissions, subscriber lists and consent records.
• Resend: sending confirmation, checklist and subscription emails.
• PostHog: analytics, as described above.
• Google Workspace: our email.

We also disclose information when the law requires it, to establish or defend legal claims, and to a buyer if the site or AllyMatter Inc is sold, who would then have to follow this policy. We do not sell personal information, and we do not share it for advertising. There are no advertising networks, pixels or retargeting on this site.

Where it is stored

Information is stored and processed in the United States and wherever our service providers run their facilities. These countries may not have the same data protection laws as yours. Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the standard contractual clauses approved for that purpose.

How long we keep it

• Subscriber records: until you unsubscribe or ask for deletion. After you unsubscribe we keep your address on a do-not-email list, with the record of your consent, for as long as we need to show we complied.
• Checklist answers: 24 months, then deleted unless you are subscribed.
• Help, claim, press and article requests: while we deal with them and for as long as the listing, profile or publication lasts, then deleted on request.
• Consent records: as long as we need to show what you chose.
• Analytics: kept by PostHog under our account settings; anonymous counts carry nothing that identifies you.
• Invoices: as long as tax law requires.

Security

The site is static and served over HTTPS. Form data sits in a database that only the site's own server functions can reach. We protect what we hold by commercially reasonable means, but no method of sending or storing data is completely secure.

Children

This site is for businesses. It is not aimed at children, and we do not knowingly collect personal information from anyone under 16.

Your rights

Wherever you live, you can ask what we hold about you, ask for a copy, ask us to correct it, ask us to delete it, object to how we use it, and withdraw any consent you gave. We will not treat you differently for using these rights. Write to [email protected]. We may ask you to confirm the request from the email address it concerns. We reply within 30 days, or tell you within that time why we need longer, as the law allows. There is no fee.

United States

Residents of California and other states with consumer privacy laws have the right to know the categories and specific pieces of personal information we collect, the sources, the purposes and the categories of service providers we disclose it to; to correct and delete it; and to opt out of its sale or sharing for targeted advertising, which we do not do. In the past 12 months we have collected these categories, for the purposes described above:

• Identifiers: name, email address, IP address (on forms only), and the random consent identifier.
• Professional information: company, role, business type, headcount band and website, where you give them.
• Commercial information: listings, profiles, placements and press releases bought.
• Internet activity: pages and clicks on this site, only if you tick Analytics; otherwise only the anonymous count.
• Approximate location: country only.

We collect no sensitive personal information. Sources: you, your browser, and public sources for directory listings. You can use an authorized agent; we may ask the agent for proof of your permission. Our browser settings do not respond to Do Not Track signals; the consent box is where you choose. California residents may also ask, once a year, about disclosures to third parties for their own direct marketing; we make none.

European Economic Area and United Kingdom

You also have the right to restrict our use of your information, and to receive the information you gave us in a machine-readable format and have it sent to another organization where that is technically feasible. You can complain to your local data protection authority; in the United Kingdom that is the Information Commissioner's Office. We would welcome the chance to deal with your concern first.

Canada

Under PIPEDA you can access and correct the personal information we hold and withdraw consent, subject to legal and contractual limits. If we cannot resolve a concern, you can contact the Office of the Privacy Commissioner of Canada. We do not send commercial email to anyone who has not asked for it, and every email we send carries a way to unsubscribe.

Australia

Some of our service providers are outside Australia and are not bound by the Australian Privacy Principles. If we cannot resolve a concern, you can contact the Office of the Australian Information Commissioner.

Changes

If this policy changes, the date at the top of this page changes with it. If a change affects you, the consent box asks you again on your next visit, and where the law requires it we ask for your consent to any new use.

Contact

Sid Varma, Data Protection Officer, AllyMatter Inc, 651 N Broad St, Suite 201, Middletown, DE 19709, United States. Email [email protected]. Corrections to anything published here: [email protected].