Effective date: 2 October 2026
Applied Diligence is operated by Kanoe Technologies SL (NIF B23942923), Calle Padre Damián 41, 28036 Madrid, Spain. It is the controller of your account data. For the people in the records you build, you are the controller and we process them on your behalf. For privacy enquiries contact: privacy@applieddiligence.com
Account data: email address and password (hashed, never stored in plaintext) when you create an account.
Investigation data: information you input about investigation subjects, including questionnaire responses, documents, voice memos, and notes.
Usage data: how you interact with the platform, including pages visited and features used, for the purpose of improving the service.
We do not collect payment card data directly. Payment processing is handled by third-party processors.
Subjects of a check: We store the identifiers you give us, the results we retrieve, the source each came from, and the date we retrieved it.
When we build a record of a company's officers, we keep the person's name, their role, and the dates the register publishes. We do not record dates of birth or addresses — our officer records have no field for them.
We do not show you raw source data, and our tests check that specific personal details cannot appear in a result.
Where a check involves sanctions screening, we keep a date of birth where the list publishes one, because it is how a name match is confirmed or ruled out. It is shown on one screen only — the match-review screen where your analyst confirms or dismisses a name match — and never in a delivered packet or report.
We do not use your data to train AI models. We do not sell your data to third parties.
Applied Diligence uses the Anthropic Claude API to power AI features. Data submitted for AI processing is sent to Anthropic solely to generate your requested output. Anthropic does not train its models on API customer data. Anthropic's Data Processing Addendum applies and is available at anthropic.com/legal/data-processing-addendum
We keep your data while your account is open. When you close your account, or ask us in writing, we delete it within 30 days, except where the law requires us to keep it. Audit records of what happened on a case are kept while the case exists. Evidence from some sources expires sooner, when the source’s own terms require it.
If you are in the European Economic Area you have the right to:
To exercise these rights contact privacy@applieddiligence.com
| Processor | Role | Region | When |
|---|---|---|---|
| Supabase | Database, authentication and file storage | United Kingdom (London, eu-west-2) | Always — this is where your cases and uploaded documents live |
| Vercel | Application hosting and server functions | Global edge network; server functions run in Vercel's default region | Always — every page and API request passes through it |
| Anthropic | AI drafting and analysis — Statements, suggested questions, and checking answers | United States | When a Statement, a question set, or an answer assessment is generated |
| OpenAI | Voice-memo transcription (Whisper) | United States | Only when you record a voice memo |
| Resend | Transactional email — questionnaires, invitations, notifications | United States | When an email is sent |
| Stripe | Payment for credit packs. Card details are handled by Stripe and never reach us | United States and Ireland | When you buy credits |
| DocuSign | Electronic signature of consent forms | United States | When a consent form is sent for signature |
| OpenSanctions | Sanctions, watchlist and politically-exposed-person screening — the subject's name is matched against the lists they publish | Germany (OpenSanctions is operated from Berlin); queried over the public internet | When the paid sanctions and watchlist screen is run on a case |
To run a check we send the subject's name — and the registration number or other identifiers you give us — to the source being searched: the official register, the sanctions list, or the news search (GDELT, a public news index). These sources are not our processors; they answer a search, and we keep the answer as evidence on the case.
Some checks are not automatic: you order the record and a person on our own team obtains it from the source and files it on the case. We do not pass these to a third-party screening company. If that ever changes, they will appear in the list above before any order reaches them.
We will notify you of material changes to this privacy policy by email or platform notification at least 14 days before changes take effect.
For privacy questions or to exercise your rights: privacy@applieddiligence.com