Privacy Policy

Last updated: 15 August 2026

This policy explains what personal information My Compliance Library collects, why we collect it, who else sees it, how long we keep it and what you can ask us to do about it. It is written in plain language and it describes what this website actually does, not what a privacy policy usually says. If anything here is unclear, ask us before you use the site.

1. Who we are

My Compliance Library is operated by MorPhoe Tech Inc, a California corporation. We decide what personal information this site collects and why, so we are the data controller for it.

For anything in this policy, including any request about your own data, email support@mycompliancelibrary.com. Our postal address is MorPhoe Tech Inc, 3644 Wyndham Dr, Fremont, CA 94536, USA.

2. What we collect, and why

If you buy something

Payment is handled by Stripe. The card form on our checkout page is Stripe's own, running inside Stripe's frame, so your card number never reaches our website and we never see or store it.

Stripe collects your email address, your name and your billing address, because a card payment needs them. After a payment succeeds, Stripe tells our server about it and we store an order record containing your email address, your name, what you bought, the amount, the currency, the Stripe identifiers for the payment and a private access token that unlocks your downloads. We do not store your billing address on the order.

We also record three confirmations you give inside the Stripe checkout form, all of them required before it will take your payment. Under Immediate delivery of digital content you answer "I expressly consent to immediate delivery". Under 14-day cancellation right (UK and EU) you answer "I acknowledge I lose my 14-day right to cancel once the download begins". Under Terms and conditions of sale you answer "I have read and accept the terms and the refund policy".

Those answers are stored on the Stripe payment session, along with two identifiers naming the documents they were given under: one for our Terms and Conditions of Sale and one for our Refund and Returns Policy. Each identifier is derived from the document text itself, in the form refund-returns@2026-08-15+sha256: followed by a hash of the exact wording published at the time, so the record can be matched to the precise text you agreed to rather than only to a date. Our Refund and Returns Policy relies on this record.

If you create an account

We store your email address, your first and last name, the date you registered, and whether and when you confirmed your email address. We store your password only as a scrypt hash with a random salt unique to you, so the password itself is never written down anywhere and cannot be recovered from our database, by us or by anyone else. Password reset links and email confirmation links are stored only as a one-way digest, never as the link itself, and they expire.

Your order history is found by matching your email address, which is why an account has to confirm that address before it can see any orders.

If you save a billing address in your account

This is optional. If you fill it in we store the name, company, street address, town or city, state, postcode, country and phone number you enter, kept separately from the record that holds your password.

If you use the contact form

We take your name, email address, the topic and your message, and email them to our own inbox with your address set as the reply-to so we can answer you. The contact form does not write anything to our database. Your message lives in our email, and for as long as we keep that email.

The form also has a hidden field that people never see. If it is filled in we treat the submission as automated and discard it.

If you join the mailing list

We store your email address, your name if you gave one, when you signed up, whether you confirmed, whether you later opted out, and which form you came from. We use double opt-in: signing up does not put you on the list. We send you a confirmation link, and only clicking it records your consent and makes you mailable. If you never click it you stay off the list.

Your IP address

We want to be specific about this, because an IP address is personal information and it is easy to leave out of a policy like this.

When you submit the contact form, sign up to the mailing list, request a password reset, or land on the order confirmation page, our server reads your IP address from the request and writes it into a rate-limiting table in our database, alongside a count and an expiry time. This is how we stop somebody flooding those forms, which cost us money in email and in payment-provider calls every time they are used.

The row expires quickly: after one minute for the contact form, the mailing list form and the confirmation page, and after one hour for password reset requests. Once expired the row no longer counts against you, and it is physically deleted by a cleanup that runs at random on a small share of requests, so an expired row is usually gone within minutes and is never used for anything after it expires. We do not use these records to profile you, we do not connect them to your account or your orders, and we do not use them for analytics.

Login, registration and account verification are rate limited too, but those are counted against the email address or the account, not against your IP address.

Separately, our hosting provider receives your IP address for every request, because that is how the internet delivers a page to you.

3. Cookies and browser storage

We set two cookies of our own, and neither is used for advertising:

mcl_session. Set only when you sign in. It holds your account id, a session generation number and the time it was issued, signed so it cannot be altered or forged. It lasts 30 days, is marked HttpOnly so browser scripts cannot read it, and is sent over HTTPS only. Resetting your password invalidates every session cookie issued before the reset.
mcl_cart_count. Holds one number: how many lines are in your cart, so the header can show the right count on the first paint. It contains nothing about what is in your cart and lasts one year.

We also use your browser's own storage, which stays on your device and is not sent to us:

Local storage holds your cart, which is why it survives a reload. The cart never leaves your browser until you check out.
Session storage holds a random identifier for one checkout attempt, so that reloading the page while paying does not create a second charge. It is not a login credential, and it is discarded when you close the tab, which is the bound that matters in practice. It is also not reused after 30 days, with one exception: if Stripe has told us your payment is still being processed, that identifier is not retired by age at all. Some payment methods settle days after checkout, and dropping the identifier while the payment is still live is exactly what would create a second payable session, so it is kept until the payment has a definite outcome.
Local storage also holds your answers about the tools in section 4, under the name mcl_consent. It is a short record rather than a single word: your answer about analytics, your answer about the language switcher, your answer about the booking calendar, the date and time you last answered, and the list of companies you were shown at the time. It is never sent to us and it identifies nothing about you. Section 4 explains why the list of companies is stored with it.

The analytics, translation and booking providers described in the next section set cookies and use storage of their own, under their own names and their own policies. We do not control what those contain. None of them gets the opportunity to set anything unless you ask for it first, in the way section 4 describes for each one.

4. Analytics, translation and booking

On our public pages we use three third-party tools. None of them loads until you ask for it. They are gated in two different ways, for two different reasons, which the rest of this section sets out. We want to describe them accurately rather than call them all "analytics", because two of the three are not analytics at all.

Google Analytics, loaded through Google Tag. Reports which pages you view, the address of each page, where you arrived from, and general information about your device and browser, under an identifier Google assigns.
GTranslate. The language switcher. Loading it contacts GTranslate. If you actually choose a language, the text of the page is sent to Google Translate to be translated, so Google sees the page you are reading. Until you ask for a translation we do not load it at all, and the switcher you see in the header is our own. See "The language switcher" below.
Calendly. The booking calendar on our contact page, which is how you pick a time for a call. Loading it tells Calendly that you are on that page, and anything you then enter in order to book, such as your name, your email address and whatever you write in the booking form, is given to Calendly rather than collected by us. Until you press the button that loads it, the calendar you see is a plain block served by this website and Calendly has not been contacted. See "The booking calendar" below.

Analytics

Google Analytics does not load until you accept it. On your first visit to a public page, a notice appears across the bottom of the screen with two buttons, Accept and Reject. They are the same size, side by side, and one click each. Nothing is selected for you, and there is no extra screen to go through in order to refuse. While that notice is on screen it has not been requested and has put nothing on your device. The notice names the company and says what it does, and it also names the language switcher and the booking calendar, so that you can see what else the page is able to load and what opens each of them.

Accept loads Google Analytics, and it then does what is described above.
Reject does not load it, now or on any later visit. Nothing else about the site changes and no part of it is withheld from you.
Doing nothing has the same practical effect as Reject: it does not load. The difference is that we have no answer to remember, so the notice stays where it is, and it will appear again the next time you visit.

Your answer is kept in your browser's local storage under the name mcl_consent, as described in section 3. If your browser will not let us store it, your choice still holds for the page you are on and we ask again next time rather than assuming anything.

We store the date and time you answered, and the list of companies you were shown when you answered, alongside the answer itself. That is so the record says what you actually agreed to rather than just that you clicked something. If we ever change that list, your old answer stops counting. The notice comes back with the new list on it, nothing loads in the meantime, and you decide again. We would rather ask you twice than treat a yes about one list as a yes about another. That is not hypothetical. We changed the list on 15 August 2026, so every answer given before that date has already stopped counting and everybody is being asked again.

This record stays on your device. We do not send it to our servers and we do not keep a copy. That means it is your evidence of what you chose and when, and it is what this website acts on, but it is not a log we hold about you.

You can change your answer about analytics whenever you like. This button reopens the notice, and it is here so that you never have to go looking for the banner again:

If you accepted and later reject, we delete the identifying cookies Google set on this website, which are named _ga, _gid and _gat, and we reload the page. The reload is not cosmetic: a script that is already running does not stop simply because we stop asking for it, and a fresh page is what actually ends it. Whatever a vendor recorded before you rejected is held on that vendor's own systems rather than ours, and you would need to ask them to remove it.

The language switcher

The switcher in the header is ours until you use it. It is served by this website, it contacts nobody, and it sets nothing on your device. Opening it and reading the list of languages still contacts nobody.

Choosing a language is what loads GTranslate, and doing so is treated as your permission for it. From that point the switcher you see is GTranslate's own, and if you pick a language inside it the text of the page is sent to Google Translate. The list in the switcher tells you this before you choose.

This is deliberately a separate question from the one in the notice above. Accepting analytics is not a request to be translated, and refusing analytics should not take away your ability to read the site in your own language. Answering the notice either way leaves the switcher exactly as it was.

Your choice about the switcher is remembered in the same record described in section 3. There is no way to un-ask for it in the switcher itself at present: to stop GTranslate loading again, clear this site's data in your browser, or block cdn.gtranslate.net in a content blocker. We would rather say that than imply a control we have not built.

The booking calendar

Our contact page offers a calendar for booking a 30 minute call. That calendar is Calendly's, not ours, so we treat it the same way as the language switcher: until you press the button, the block you see is served by this website and Calendly has not been contacted. Pressing it is what loads Calendly, and doing so is treated as your permission for it.

Once loaded, the calendar is Calendly's own and runs inside a frame served by Calendly. What you enter in order to book a time, including your name and your email address, goes to Calendly and is held under Calendly's policy. We receive the resulting booking.

You should know what that frame brings with it, because we measured it rather than guessing. Our own page contacts one address, assets.calendly.com, which is the code that draws the calendar. Calendly's frame then contacts a further set of companies of its own choosing, and when we checked on 15 August 2026 that included Google, Facebook, Stripe, Segment, Sprig, Braze and Airbrake. Those requests are made by Calendly's page, not ours, under Calendly's policy, and we cannot control or restrict them. That is the real cost of loading the calendar, and it is why the button exists instead of it loading by itself.

You never have to use it. The same block gives you an email address to write to instead, and we will arrange a time by hand, which contacts nobody.

This is deliberately a separate question from the notice about analytics, for the same reason the switcher is. Accepting analytics is not a request to book a call, and refusing analytics should not take away your ability to book one. Your answer is remembered in the same record described in section 3, and as with the switcher there is no button that un-asks for it: to stop it loading again, clear this site's data in your browser.

We should say plainly that this used to be wrong. Until 15 August 2026 the contact page loaded Calendly by itself, before anybody was asked, while the notice on that same page said nothing had been loaded. That sentence is now true on every public page, and the notice is generated from the list of tools rather than written separately from it, so the two cannot go out of step again.

Global Privacy Control

Some browsers and extensions send a Global Privacy Control signal, which is a standing request not to have your data sold or shared. We read it and we act on it. If your browser is sending it, we treat that as Reject for the analytics tool before anything loads, and the notice does not appear, because the question has already been answered.

You can still see and change that. Open Cookie settings using the button above and the notice appears, tells you that your browser is sending the signal and that we have honoured it, and lets you accept anyway if you specifically want to for this site. An explicit choice you make here overrides the browser default in both directions, and it is remembered like any other answer.

The signal does not change the language switcher or the booking calendar, and that is not us ignoring it. Neither of them loads unless you ask for it in the first place, so there is no default there for the signal to switch off. Treating it as a refusal would mean pre-refusing a button on your behalf and then showing you the button anyway.

You can block any of these yourself in the same way: browser settings and tracking protection, a content blocker, or Google's own Analytics opt-out browser add-on will all stop them, and the site works normally without them. We do not act on the older Do Not Track browser setting, because it was withdrawn as a standard and we do not read it. Global Privacy Control is the one we honour.

None of this applies to the pages listed in section 5. Those load no analytics, no translation widget and no booking calendar for anybody, whatever they answered, so there is no notice on them and nothing to choose.

5. Pages where we deliberately run nothing

No analytics, no translation widget and no booking calendar loads on the cart, the checkout, your account area, an order page or the confirmation page. Those pages carry your name, your email address, your purchase history and, in the case of an order link, a credential that unlocks paid downloads. We do not consider it acceptable to hand that to a company that is not part of the transaction, so those pages are served by a separate layout that never renders those scripts, and the browser is additionally instructed to refuse any third-party script on them.

The single exception is Stripe's payment library on the checkout page. Stripe is not observing you on our behalf, Stripe is the company being paid, and running its library is what keeps your card details inside Stripe's frame instead of ours.

6. Who else receives your information

We do not sell your personal information, and we do not trade or rent it. We use the following companies to run the site, and each receives only what its job needs:

Vercel hosts the website. It handles every request, including your IP address.
Neon provides the database that holds accounts, orders, saved billing addresses, mailing list records and the short-lived rate-limiting rows.
Vercel Blob stores the product files themselves. They are stored privately and can only be read by our server after it has checked your order, so no product file is reachable by guessing a URL. No personal information is stored there.
Stripe processes payments and receives your name, email address, billing address, card details and the confirmations described in section 2.
Resend sends our email: order receipts, password resets, address confirmations, mailing list confirmations, and the notification raised by the contact form. It receives the recipient's address and the content of the message.
Google receives analytics data on public pages if you accepted analytics, and page text if you use the translation widget.
Calendly receives what you enter in order to book a call, if you load the booking calendar on the contact page and use it. If you never load it, Calendly receives nothing.
GTranslate serves the language switcher on public pages, once you have asked for a translation.

We will also disclose information where the law requires it, and to our professional advisers where we genuinely need to. If the business is ever sold, customer records would transfer with it, and we would tell you before that happened.

Some privacy laws, including California's, treat the use of analytics providers as "sharing" even though no money changes hands. Read that way, section 4 is what we share, and the Reject button described there is how you stop it before it starts.

7. Where your information is kept

MorPhoe Tech Inc is a United States company and every provider listed in section 6 is a United States company. You should assume your information is stored and processed in the United States, and on the global infrastructure those providers operate.

If you are in the UK or the European Union, that means your information leaves your country. We rely on our providers' standard contractual clauses for those transfers. If you want to know the current storage region for a particular provider, ask us and we will tell you.

8. How long we keep things

We would rather tell you what our system actually does than quote a schedule we do not operate:

Rate-limiting rows containing your IP address expire within a minute, or within an hour for password resets, and are then deleted automatically. This is the only thing on the site that is deleted on a timer.
Orders are kept indefinitely at present. They are our record of a sale, and we need them for accounting, tax and any dispute or chargeback. Nothing deletes them automatically.
Accounts and saved billing addresses are kept until you ask us to remove them.
Mailing list records are kept until you ask us to remove them, with one deliberate exception. When you unsubscribe we mark the record as opted out and keep it rather than deleting it, together with the date you asked. That record is the proof that you asked to be removed and when, and deleting it would leave us unable to show we honoured your request or to stop the address being added back. It is not used to mail you. If you would rather it were deleted outright, ask and we will do it.
Contact form messages live in our email inbox for as long as we keep the correspondence.

We are working towards a fixed retention schedule. Until we have one, anything above that you want removed sooner, you can ask for under section 9, and we will remove it unless we are legally required to keep it.

9. Your rights, and exactly how to use them

Depending on where you live you may have rights under the UK GDPR, the EU GDPR, the California Consumer Privacy Act or a similar law. Rather than work out which applies to you, we offer the following to anyone who asks, wherever you are:

A copy of what we hold about you, and an explanation of where it came from.
Correction of anything that is wrong.
Deletion of your account, your saved address and your mailing list record. We will also delete order records unless we are required to keep them for tax or accounting, and if we have to keep one we will say so and tell you why.
A machine-readable copy of the information you gave us.
An end to marketing email, immediately.
A complaint to us, which we would rather have than not.

There is no self-service delete button on this site, so we are not going to pretend there is one. Email support@mycompliancelibrary.com saying what you want, from the address you used with us or from an account you can sign into so we can be sure it is you. We will acknowledge within 2 business days and complete the request within 30 days. If a request will take longer we will tell you why before the 30 days are up. We do not charge for this and we will not treat you differently for asking.

If you are in the UK or the EU and you are not satisfied with our answer, you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office.

10. Marketing email

We only send marketing email to addresses that confirmed by clicking a link, and every marketing message carries an unsubscribe link and the standard header that puts an unsubscribe button in your mail client. One click and we stop. An opt-out cannot be reversed by somebody typing your address into our signup form, which means nobody can put you back on the list except you, by contacting us.

Order receipts, password resets and address confirmations are not marketing. We send those because you bought something or asked for them, and you cannot unsubscribe from them while you have an active account or order.

11. How we protect this

No website can promise it will never be breached, so here is what we actually do rather than a reassurance:

Passwords are stored as a salted scrypt hash and never in a readable form.
Password reset and confirmation links are stored only as a one-way digest, so even our own database cannot reproduce a working link.
The sign-in cookie is signed, cannot be read by browser scripts, and every existing session stops working when you reset your password.
Download links are signed and expire 15 minutes after the page is rendered, so a link that leaks into browser history or a proxy log is already useless.
Product files are stored privately and served only after your order has been checked.
Card details never touch our servers.
The browser is sent a content security policy that limits which other companies the page may contact at all, and forbids all of them on the pages listed in section 5.

12. Children

This site sells compliance material to organisations. It is not intended for children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us information, tell us and we will delete it.

13. Changes to this policy

If we change what we collect or who receives it, we will update this page and change the date at the top. Where a change materially affects you and we have your email address, we will email you rather than rely on you rereading this page.

14. Contact

MorPhoe Tech Inc, a California corporation, operating My Compliance Library.
3644 Wyndham Dr, Fremont, CA 94536, USA.
Email: support@mycompliancelibrary.com
Business hours: Monday to Friday, 9:00 AM to 5:00 PM.