Where
RegEngine uses US-default cloud infrastructure with managed-provider encryption at rest and encrypted transport. Provider-specific locations are listed in the DPA.
Privacy by Design
Privacy Policy
Effective: March 11, 2026 · Last updated: March 11, 2026
Related documents: Terms of Service, Data Processing Agreement, and Security.
Plain language. No legalese walls.
Here's what we collect, why, and what we do with it. Your compliance data belongs to you. RegEngine is designed to restrict tenant access at the database layer, provide verifiable evidence exports where configured, and don't sell your data (as defined by the CCPA/CPRA).
What We Collect
Account Information
When you create an account, we collect your name, email address, company name, and billing information. We need this to provide you with our services and process payments.
Compliance Data
When you use RegEngine to manage FSMA 204 compliance, we process and store the traceability data you submit, including Critical Tracking Events (CTEs), Key Data Elements (KDEs), and Traceability Lot Codes (TLCs). This data belongs to you. We store it to provide the service.
Usage Data
We collect basic analytics: pages visited, features used, API calls made. We use this to improve the product. We do not sell this data to anyone.
FTL Checker (Free Tool)
The FTL Coverage Checker does not require an account and does not store your selections. If you submit your email for follow-up, we use it to review your request and contact you about coverage questions.
How We Use Your Data
Providing, maintaining, and securing RegEngine services
Processing your compliance data as directed by you and the applicable agreement
Generating FDA-oriented exports and reports you request
Sending transactional emails (account, billing, compliance alerts)
Improving our platform based on aggregate usage patterns
Responding to your support requests
What We Don't Do
We do not sell or share your personal data or compliance data as those terms are defined by CCPA/CPRA.
We do not train RegEngine-owned models on your compliance data. Where third-party LLM providers such as OpenAI or Vertex AI are enabled for extraction, those calls run under the applicable provider terms and the executed agreement.
We do not share your data with other RegEngine tenants. PostgreSQL row-level policies and authenticated tenant context are designed and tested to restrict cross-tenant access on core PostgreSQL-backed paths; identity-resolution and graph-layer hardening is in active rollout.
We do not serve targeted ads.
We do not share your data with data brokers.
Data Storage & Security
Isolation
Tenant data is scoped by PostgreSQL row-level policies and authenticated tenant context, designed and tested to restrict cross-tenant access on core PostgreSQL-backed paths. Identity-resolution and graph-layer hardening is in active rollout. See the DPA for the full subprocessor list.
Integrity
Supported evidence workflows create SHA-256 manifests so exported records can be independently checked using RegEngine verification tools.
Retention
We retain your compliance data for the duration of your subscription and any post-cancellation period defined by your customer agreement. After cancellation, you can request available exports of customer-submitted compliance data, subject to plan, workspace configuration, retention status, and the executed agreement. Customers with regulatory retention obligations should maintain recurring exports or an external archive rather than relying on an active subscription alone. After the applicable retention period, data is scheduled for deletion from active systems; provider backups, immutable logs, and disaster recovery copies expire on their normal cycles, and legal or regulatory holds may require longer retention.
Your Rights
Access & Export
You can export your compliance data through the API and dashboard surfaces available to your plan. We support FDA-oriented export workflows and customer-managed off-platform archiving.
Deletion
You can request deletion of your account and associated data by contacting privacy@regengine.co. Timing, retention exceptions, and confirmation steps follow the executed agreement or DPA.
Correction
You can update your account information at any time through the dashboard.
California Residents (CCPA)
California residents have additional rights under the CCPA/CPRA, including the right to know what personal information we collect and the right to opt out of certain sales or sharing. We do not sell or share personal information as defined by CCPA/CPRA.
Third-Party Services
RegEngine uses subprocessors to operate the platform. Default processors support core hosting, database, and request-routing functions; optional processors are used only where the relevant billing flow, analytics flow, email flow, object storage, or AI extraction workflow is enabled or configured. The authoritative public list, including purpose, data processed, region, and availability, is in the DPA. The executed agreement controls notice periods, objections, and any negotiated subprocessor terms.
Service Availability Notice
RegEngine features and workflows may change as we improve the platform, and access may be modified during staged rollouts or service updates. This Privacy Policy applies throughout those updates and after broader rollout.
Changes to This Policy
We'll provide reasonable advance notice of material changes by email. Non-material changes (clarifications, formatting) may be made without notice.
Contact
Questions about this policy? privacy@regengine.co. You'll hear from the founder directly, not a legal department.
Your data belongs to you, always
Become a Founding Design Partner to review the current tenant-isolation posture and evidence verification workflows in your workspace.