Privacy Policy

Last updated: 16 March 2026

Instilligent Limited ("we", "us", "our") operates the Modular Compliance application (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service.

Information We Collect

We collect information you provide directly to us when you create an account, including your name, email address, company name, and role. We also collect data you enter into compliance tasks, documents, and incident reports.

Device Permissions

Our mobile app may request access to:

• Camera: To capture photos for incident evidence and compliance documentation.
• Location: To tag incident reports and compliance activities with location data.
• Microphone: To record audio notes attached to compliance activities.
• Biometric Authentication: To provide secure app access via fingerprint or Face ID.
• Photo Library: To attach existing photos to compliance records.

These permissions are only used when you initiate the relevant action. We do not access your camera, microphone, or location in the background.

How We Use Your Information

We use collected information to:

• Provide and maintain the Service
• Process your compliance tasks and generate reports
• Send you service-related notifications
• Respond to your requests and support inquiries
• Improve and develop the Service

Data Storage and Security

Your data is stored on secure servers hosted by Railway (cloud infrastructure). We use encryption in transit (TLS/HTTPS) and implement appropriate technical and organisational measures to protect your personal data. Authentication tokens are stored securely using industry-standard practices.

Data Residency and Cross-Border Transfers

Modular Compliance is operated by Instilligent Limited, a New Zealand company. However, our cloud infrastructure provider (Railway) does not operate datacentres in Australia or New Zealand. As a result, all data — including personal information, compliance records, and uploaded documents — is processed and stored on servers located in the United States and/or European Union.

By creating an account and using the Service, you explicitly consent to the transfer, processing, and storage of your data in these regions. We take the following measures to protect your data during cross-border transfer:

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted using industry-standard AES-256 encryption
• Access to production infrastructure is restricted to authorised personnel only
• Our hosting provider maintains SOC 2 Type II compliance

Under the New Zealand Privacy Act 2020 (Information Privacy Principle 12), we ensure that any overseas recipient of personal information is subject to comparable privacy protections. Under the EU General Data Protection Regulation (GDPR), we rely on Standard Contractual Clauses (SCCs) and other approved transfer mechanisms to safeguard data transferred outside the European Economic Area.

If you have concerns about data residency or require data to remain within a specific jurisdiction, please contact us before creating an account.

Data Sharing

We do not sell your personal information. We may share data with:

• Service providers who assist in operating our platform (hosting, email delivery, payment processing)
• Law enforcement when required by law
• Other users within your organisation as determined by your company administrator's access settings

Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data by contacting us.

Your Rights

Under the New Zealand Privacy Act 2020, you have the right to access, correct, and request deletion of your personal information. To exercise these rights, contact us at the address below.

Children's Privacy

Our Service is not directed to individuals under 16. We do not knowingly collect personal data from children.

Changes to This Policy

We may update this policy from time to time. We will notify you of changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have questions about this Privacy Policy, please contact us at:
Instilligent Limited
Email: privacy@modularcompliance.com