Complaica Plugin for Claude — Privacy Policy
This policy explains what personal data Ciqualia processes when you use the Complaica plugin for Claude, why, for how long, and what rights you have. It applies only to the plugin. Your use of Complaica itself is governed by your Complaica contract and its data processing agreement, and your use of Claude is governed by Anthropic's terms and privacy policy.
Effective date: 16 November 2026 · Version: 1.0
1. Who is responsible
The plugin is provided by:
Ciqualia UG (haftungsbeschränkt)
- Address: Otto-Lilienthal-Str. 36, 71034 Böblingen, Germany
- Managing director: M.Sikalo
- Commercial register: Amtsgericht Stuttgart, HRB 801984
- VAT ID: DE457587291
- Email: info@ciqualia.com
2. How the plugin works
The plugin lets Claude read and update data in your Complaica workspace on your instruction. It bundles skills (instructions for Claude) and a connector to the Complaica server.
- You install the plugin in Claude and sign in to Complaica. Sign-in uses OAuth 2.0 (authorization code with PKCE) through Complaica's identity service (e.g. Keycloak), or through your organisation's identity provider, such as Microsoft Entra ID, if your organisation has connected one. You then confirm Claude's access on a consent page. Claude never sees your password.
- When you ask Claude something that needs Complaica data, Claude calls a tool on the Complaica server, for example to search assets, read controls or create a task.
- The Complaica server checks your permissions and returns only data your Complaica role allows you to see. Write actions run with your user rights and are recorded in the Complaica change history.
- The result is passed back to Claude, which uses it to answer you.
Interactive cards (MCP App). Some tools show their result as an interactive card inside Claude, for example to change the status of a task with one click. Cards run in an isolated frame in Claude, have no network access and hold no credentials.
- When you e.g. click a button on a card, the card asks Claude to call a Complaica tool. Claude sends that call to the Complaica server with your sign-in, exactly as in steps 2–3, and returns the result to the card.
- "Open in Complaica" opens the Complaica web application in your browser. That use is covered by your Complaica contract, not by this policy.
The skills in the plugin run inside Claude. Data reaches Complaica only through tool calls, whether Claude starts them or you start them in a card.
3. Which part of this policy applies to you
The plugin works with both ways of running Complaica. They differ in who processes your data:
- Part A applies if your organisation runs Complaica on its own servers or in its own private cloud.
- Part B applies if your organisation uses Complaica as a service (SaaS) hosted by Ciqualia.
All numbered sections apply in both cases.
Part A — Complaica on-premise or in your private cloud
Your organisation operates the Complaica server, its identity service and its logs. The plugin connects Claude directly to that server. Ciqualia is not part of this data flow.
- Ciqualia receives no personal data from your use of the plugin: no sign-in data, tokens, tool calls, workspace content or logs.
- Your organisation is the controller for all data its Complaica server processes, including where it is hosted, how long logs and tokens are kept and how they are protected. Its privacy notice applies. Contact your organisation or its data protection officer with questions or to exercise your rights.
- Claude reaches your server over the network. Depending on how you use Claude, tool calls may come from Anthropic's infrastructure, so your organisation decides how its server is exposed. See section 4 for how Anthropic handles the data.
- Support. If you contact Ciqualia support, section 5 applies.
Part B — Complaica as SaaS on Ciqualia's servers
Ciqualia hosts Complaica for your organisation and acts in two roles:
- Controller (Art. 4(7) GDPR) for data needed to run the plugin itself: sign-in, access tokens, technical logs.
- Processor (Art. 28 GDPR) for the content of your organisation's Complaica workspace. For that content your organisation is the controller, and the data processing agreement in your Complaica contract applies.
B.1 What data we process
| Category | Examples | Our role |
|---|---|---|
| Account and sign-in data | Name, email address, Complaica user ID, organisation, role; with single sign-on also the user identifiers your organisation's identity provider sends (e.g. object ID, subject ID, verified email address) | Controller |
| Access tokens | OAuth access and refresh tokens issued to Claude for your account and valid only for the Complaica MCP endpoint; the record of your consent | Controller |
| Tool requests and responses | Which tool was called, its parameters (e.g. a search term), your language setting, the data returned from your workspace | Processor |
| Workspace content | Assets, controls, risks, audits, tasks, processing activities and any personal data your organisation stores in them | Processor |
| Technical logs | Timestamp, tool name, user ID, IP address, response status, error messages | Controller |
We do not receive your conversations with Claude, your prompts, Claude's answers, files you upload to Claude, or your Anthropic account data. We only see the tool calls that reach the Complaica server, from Claude or from a card. The plugin and its cards load nothing from third-party servers and use no cookies, tracking or analytics.
B.2 Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Sign you in and authorise Claude's access | Account data, access tokens | Art. 6(1)(b) GDPR: performance of your Complaica contract |
| Execute the tool calls Claude sends on your behalf | Tool requests, workspace content | On behalf of your organisation under Art. 28 GDPR; your organisation's legal basis applies |
| Keep the service secure, detect misuse, fix errors | Technical logs | Art. 6(1)(f) GDPR: our legitimate interest in a secure, working service |
| Meet legal obligations | Data we must keep by law | Art. 6(1)(c) GDPR |
We do not sell personal data, use it for advertising, or use workspace content to train AI models. We do not make automated decisions with legal effect on you (Art. 22 GDPR).
B.3 Where data is stored and how it is protected
The Complaica cloud service runs in data centres of Hetzner in Germany.
We protect data with measures that include:
- TLS encryption for all connections between Claude and the Complaica server
- OAuth 2.0 with PKCE and explicit consent; short-lived, personal access tokens that work only for the Complaica MCP endpoint and not for other Complaica interfaces; you can revoke access at any time
- Role-based access control: Claude gets exactly the rights of your Complaica account
- Logging of actions in the Complaica
B.4 Who receives the data
Our service providers. We use processors bound by Art. 28 GDPR agreements:
| Provider | Service | Location |
|---|---|---|
| Hetzner | Hosting of the Complaica cloud service | Germany |
Authorities. We disclose data to authorities only where the law requires it.
Data returned to Claude is processed by Anthropic (see section 4). We do not share data with any other third parties.
B.5 Transfers outside the EU
Ciqualia itself processes plugin data only in the EU/EEA. For transfers by Anthropic, see section 4.
B.6 How long we keep data
| Data | Retention |
|---|---|
| Access tokens | Access tokens expire after 60 minutes; refresh tokens after 30 days or immediately when you revoke access or uninstall the plugin. Your consent record is kept until you revoke access |
| Tool requests and responses | Not stored beyond processing the request, except as technical logs below |
| Technical logs | 30 days, then deleted; longer only while needed to investigate a specific security incident |
| Workspace content | As agreed in your Complaica contract; deleted or returned at contract end under the data processing agreement |
| Account data | For the term of your Complaica account |
Uninstalling the plugin ends Claude's access immediately. It does not delete your workspace content, which stays in Complaica.
B.7 Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15)
- have it corrected (Art. 16) or deleted (Art. 17)
- restrict its processing (Art. 18)
- receive it in a portable format (Art. 20)
- object to processing based on our legitimate interest (Art. 21)
- withdraw any consent you gave, with effect for the future (Art. 7(3))
To exercise these rights, email security@ciqualia.com. For workspace content, your organisation is the controller: please contact them first. We will support them as their processor.
You can also complain to a supervisory authority. Ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (baden-wuerttemberg.datenschutz.de).
4. Claude and Anthropic
Anthropic. Data that the Complaica server returns to Claude is processed by Anthropic PBC or its affiliates as part of your use of Claude. Anthropic is not our processor; it processes this data under your or your organisation's agreement with Anthropic and its own Privacy Policy. Before you ask Claude to work with personal data from Complaica, make sure your organisation permits this.
Data returned to Claude may be processed by Anthropic outside the EU, including in the United States. That transfer happens within your use of Claude, and Anthropic is responsible for its safeguards, such as the EU Standard Contractual Clauses or the EU–U.S. Data Privacy Framework, as described in Anthropic's terms.
5. Support requests
This section applies to Part A and Part B. If you contact Ciqualia support, Ciqualia is the controller for your request.
| Topic | Details |
|---|---|
| Data | What you send us: name, email address, organisation, description of the problem, attachments |
| Purpose and legal basis | Answering your request. Art. 6(1)(b) GDPR if you are a customer, otherwise Art. 6(1)(f) GDPR: our legitimate interest in answering enquiries |
| Service provider | Microsoft 365 for email, data stored in Germany, under an Art. 28 GDPR agreement |
| Retention | 2 years after the request is closed, unless statutory retention periods (e.g. § 257 HGB, § 147 AO) require longer |
Please send personal data from your Complaica workspace only if it is needed to solve the problem. For this data you can exercise your GDPR rights (Art. 15–21) by emailing security@ciqualia.com, and you can complain to the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
6. Children
The plugin is a business tool and is not intended for persons under 16. We do not knowingly process their data.
7. Changes to this policy
We update this policy when the plugin or the law changes. The current version is always available at https://ciqualia.com/en/complaica/claude-plugin/privacy. We will inform customers of material changes by email or in Complaica before they take effect.
8. Contact
Ciqualia UG (haftungsbeschränkt)
- Address: Otto-Lilienthal-Str. 36, 71034 Böblingen, Germany
- Privacy questions: security@ciqualia.com
- Plugin support: support@ciqualia.com