Legal

Privacy policy

Effective October 1, 2026·Compass AI Solutions Inc·privacy@compassapp.ai

Sections

Introduction Terms and Definitions Personal Data We Collect Processing of Personal Data Your Rights Connected AI clients (MCP)Cookies Updates to the Policy

This privacy policy is effective as of October 1, 2026.

Data Controller: Compass AI Solutions Inc, 1111B S Governors Ave STE 25784 Dover, DE, 19904 US (hereinafter referred to as “Compass AI”).

At Compass AI, we deeply value the trust you place in us, and we are committed to ensuring that your privacy and confidentiality are our top priorities. This Privacy Policy serves to outline our commitment to maintaining transparency and providing you with control over how your information is collected, used, and shared. If you have any questions, please send us an email to privacy@compassapp.ai and we will make sure to respond back as soon as possible.

1. Introduction

In the course of its business, Compass AI Solutions Inc. (“Compass AI”) collects and processes personal data and acts as a data controller under multiple legal regimes.

The purpose of this Policy is to ensure that Compass AI provides all information necessary in connection with the personal data of individuals whose personal data it processes.

This Policy applies to all personal data processed by Compass AI in relation to any person, irrespective of whether or not such a person is or becomes an employee, customer, supplier, or contact of Compass AI. This Policy does not apply to anonymous data. Anonymous data is data altered in such a way that it cannot be associated with a particular person or cannot be exchanged without disproportionate effort, so it is not considered personal data within the meaning of the applicable legislation.

This Policy was developed for the purpose of improving the services Compass AI provides to its customers, to protect Compass AI’s customers, vendors and employees with respect to the confidentiality of their personal data while processing by Compass AI. Compass AI processes its customers’ personal data during the provision of agreed services, for its vendors during the contractual relationships with them and for the employees during the employment relationship. The purpose of this Policy is to prevent any damage to Compass AI and its customers, vendors and employees as data subjects (here in after jointly referred as data subjects), and to ensure that the processing of personal data by Compass AI is carried out fully in compliance:

Regulation (EU) 2016/679 (GDPR) and implementing national laws in the EEA
Act on the implementation of the General Data Protection Regulation (Official Gazette 42/18)
The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA); California DOJ
The Children’s Online Privacy Protection Act (COPPA) for services directed to children under 13; Federal Trade Commission
The Gramm–Leach–Bliley Act (GLBA) privacy provisions for nonpublic financial information; FDIC
Other applicable U.S. federal and state privacy laws, including applicable provisions of the Virginia CDPA, Colorado Privacy Act, and Nevada’s privacy statute (NRS 603A).
This Policy applies to all personal data processed by Compass AI in relation to individuals worldwide, whether they are customers, suppliers, users, vendors, or employees.

2. Terms and Definitions

Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

Personal data processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3. Personal Data We Collect

You as a Visitor
A “Visitor” is anyone who accesses our public marketing pages at www.compassapp.ai. When you visit our pages, you are informed about our use of cookies. If you want to know more, feel free to take a look at our Cookie Policy

You as a User
A “User” is anyone who registers to use the Compass AI websites and apps. Only registered users may use the platform and services provided by Compass AI. When registering as a company, we ask you to provide your full name, your email, company email, company tax ID, company address, and company name. You are personally responsible for the data being entered into Compass AI as a platform.

Vendors
Compass AI collects personal data of Vendors primarily to provide services or to fulfil legal obligations. The legal basis for the processing of personal data is the contractual relationship between Compass AI and Vendor, the legal obligation of Compass AI or the consent of Vendor.

Employees
Compass AI collects personal data of its employees important for the employment relationship and in connection with the employment relationship. Beside this, Compass AI does not collect any personal data of its employees.

4. Processing of Personal Data

Compass AI primarily collects, records, stores, and structures personal data for the purpose of providing the data subject with services as part of its business, or for the purpose of complying with legal obligations. The legal grounds for personal data processing are the contractual relationship between Compass AI and the data subject or compliance with legal obligation of Compass AI. When processing the personal data of Visitor, the legal ground for processing of the Visitor’s personal data is his consent given when accessing Compass AI’s public marketing pages. Compass AI treats such personal data adequately and in compliance with the relevant regulations, irrespective of how such personal data is collected, recorded, stored, and used – on paper, on a computer, or on any other medium. Compass AI processes personal data it receives from data subjects and third parties subject to informing them or as instructed by them. Compass AI does not forward such data to third countries, humanitarian organizations or to any charities.

For the purposes of conducting its business processes, Compass AI may outsource certain data processing services to processors, but only those that implement the technical, logical, and organizational personal data protection measures implemented by Compass AI. All processors gave the statements that they implemented the technical, logical, and organizational personal data protection measures or concluded the appropriate agreements with Compass AI.

The current data processors are:
1. Ars Futura d.o.o., Croatia, Zagreb;
2. Amazon Web Services, Inc., Germany, Frankfurt (accounts in our EU region) and United States, Oregon (accounts in our US region);
3. Salt Edge Limited, Level 39, One Canada Square, Canary Wharf London E14 5AB United Kingdom;
4. Plaid, B.V., Muiderstraat 1, 1011PZ Amsterdam;
5. Along Peopleware d.o.o., Savska cesta 106, Zagreb, Croatia.

Compass AI stores such personal data collected in an appropriate manner and ensures that they remain confidential. Compass AI will not forward such collected data to third parties without data subject’s consent, except where this is necessary to comply with its legal obligations or its obligations under a contract to which the data subject is a party, where this is necessary to perform duties being performed in public interest, or where the data subject discloses such data themselves, as well as in all other cases defined by the applicable regulations.

5. Your Rights

Right to be Informed
The data subject has the right to request from Compass AI at any time to inform them of whether their personal data is being processed and for what purpose, who the controller is, the contact details of the data protection officer, the categories of personal data being processed, the period for which the personal data will be processed/stored, the source from which such personal data originates and the recipients of such personal data, as well as the right to be informed of their other rights specified in this Policy.

Accessing Data
The data subject shall have the right to obtain from the Compass AI as a controller confirmation as to whether or not personal data concerning him is being
processed, and, where that is the case, access to the personal data and the following information:
• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed;
• where possible, the envisaged period for which the personal data will be stored or the criteria used to determine that period;
• the right to request from Compass AI rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from the data subject, any available information as to their source;
• the existence of automated decision-making, including profiling, as well as the consequences.

Updating Data
The data subject shall have the right to obtain from Compass AI without undue delay the rectification of inaccurate personal data concerning them specifically. The data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Deleting Data/right to be forgotten
The data subject shall have the right to obtain from Compass AI the deletion of personal data concerning them without undue delay if the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed, the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing, the data subject objects to the processing, the personal data have been unlawfully processed, the personal data have to be erased for compliance with a legal obligation in European Union or Member State law to which Compass AI is subject, the personal data have been collected in relation to the offer of information society services to a child.

The foregoing shall not apply to the extent that processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation which requires processing by European Union or Member State law to which Compass AI is subject or for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes, or for the establishment, exercise or defence of legal claims.

The right to object
The data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them including profiling. Compass AI shall no longer process the personal data unless Compass AI demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct
marketing.

Data Portability
The data subjects shall have the right to receive the personal data concerning them, which they have provided to Compass AI, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on their consent and the processing is carried out by automated means. The data subject shall have the right to have the personal data transmitted directly from Compass AI to another controller, where technically feasible and such right shall not adversely affect the rights and
freedoms of others.

Withdrawing Consent
Data subject’s consent is one of the legitimate grounds for processing data relating to the data subject. The data subject may at any time withdraw the consent given by them. Such withdrawal of consent shall not affect the lawfulness of data processing performed before the consent was withdrawn.

The right to an effective legal remedy (complaint and objection)
Without prejudice against other administrative or judicial remedies, each data subject has the right to submit a complaint to the supervisory authority regarding the processing of his personal data. Every respondent has the right to an effective legal remedy against a legally binding decision of a supervisory body that applies to him. The supervisory authority is the Personal Data Protection Agency, Croatia.

The right to restrict processing
The respondent has the right to request a limitation of the processing of his personal data: if he disputes the accuracy of his personal data – for the period necessary for the attorney to verify that accuracy, if the processing of his personal data is illegal and does not request deletion but only limitation of processing, if the attorney no longer needs his personal data, but their existence is necessary for the fulfillment of his legal requirements, if he has objected to the processing, he has the right to request a limitation of the processing for the period until it is determined whether attorney’s office has legitimate reasons for the processing exceed his reasons from the objection.

Data Protection Officer
Compass AI has appointed a personal data protection officer and each data subject may contact them in connection with the protection of their personal data at privacy@compassapp.ai.

Privacy of Children
We do not knowingly collect, maintain, or use Personal Information from people under the 18 years of age, and no part of our website or apps is directed to people under the age of 18. If anyone under the age of 18 has provided Compass AI with their personal data, Compass AI will delete such information immediately after being alerted to it.

6. Connected AI clients (MCP)

This section applies when you connect Compass AI to an AI client, such as Claude, through the Compass AI MCP connector. It adds to the rest of this Privacy Policy.

What the connector does
To connect, you sign in to Compass AI and approve the connection. The AI client can then use Compass AI tools on your behalf, limited to what your Compass AI role allows. Depending on your role, it can read your company's financial data (for example accounts and ledger data, forecasts, Numbers, knowledge entries, alerts, workflows, reports and your Inbox), and it can create or change items such as alerts, workflows, forecasts, knowledge entries and Numbers imports. An administrator controls this for each role with the Connected AI permission (Hide, View or Edit).

What is sent to the AI client
When the AI client calls a Compass AI tool, the result (for example account balances, forecast values, or the text of a knowledge entry) is sent to the AI client so that it can answer you. From that point, the AI client's own terms and privacy policy govern how it handles your conversation. For Claude, that is Anthropic's terms and privacy policy.

What we collect and why

Connection records. Your user account, your company or organization, the name the AI client reports about itself, and when the connection was created, last used and disconnected. We also store an encrypted credential that lets the connection act on your behalf. We use this to authenticate the AI client, to show you your connected clients, and to let you disconnect them.
Activity log. Each action an AI client takes is recorded in your company's activity log: who acted, through which AI client, what was done, and which item was involved (for example the name of an alert or report). When you ask a question through the ledger query tool, we also record the first 200 characters of that question. Your company can see this log in Compass AI.
AI request records. Some tools use an AI model to do their work: answering a question with a database query, building a chart, drafting an alert or workflow, extracting knowledge from a document you upload, or describing a KPI. For each of these we keep a record of the request: your question, the instructions and company context we sent to the model, the model's answer (which can include the database query it wrote), the number of tokens used, and the cost. We use these records for billing and usage limits, to check the quality of answers, and to investigate problems.
Items you create. Alerts, workflows, knowledge entries, Numbers imports, reports and charts created through an AI client, including the back-and-forth that built a chart in the chart chat tool, are stored in the same way as items you create in the Compass AI app.
Technical logs. Our servers keep technical logs, such as the addresses of requests and details of errors, to operate and secure the service.

We do not read your AI client's memory, chat history, conversation summaries or files, and we collect only what each tool needs to do its job.

Who processes this data

Amazon Web Services (AWS) hosts Compass AI. When a tool uses an AI model, the request is processed by Anthropic's Claude models running on AWS Bedrock, inside AWS, acting as our processor. For accounts in our EU region this happens in AWS regions in Europe; for accounts in our US region, in AWS regions in the United States. AWS does not share this data with the developer of the model and does not use it to train models.
PostHog (product analytics, hosted in the United States). When an alert is created or changed, we send PostHog an event with an internal user identifier. The event contains no financial data.
The AI client you connect receives tool results as described above, at your direction.

How long we keep it

AI request records: your question, the instructions and company context, and the model's answer are deleted 90 days after the request. The token counts and cost are kept for billing for as long as your company's account exists.
Activity log: for as long as your company's account exists.
Connection records: for as long as your user account exists. A disconnected connection is marked as disconnected and can never be used again.
Items you create: until you delete them, or until your company's account is deleted.
Technical logs: 30 days.
When your company's account is deleted, we delete its data from all Compass AI databases, including its AI request records, and the files uploaded to it. Copies in our backups expire within 7 days.

Disconnecting
You can disconnect an AI client at any time, in Compass AI under Settings, Connected AI, or by removing the Compass AI connector in the AI client. The AI client loses access to your Compass AI account within five minutes.

Contact
Questions about how Connected AI clients handle your data can be sent to privacy@compassapp.ai. To report a security issue, write to security@compassapp.ai.

7. Cookies

To ensure the optimal functionality of our websites and apps, and to enhance your user experience, we utilize small data files known as “cookies.” Our Cookie Policy provides comprehensive details on the nature of cookies and the manner in which we utilize them.

8. Updates to the Policy

Compass AI may update this Privacy Policy from time to time in response to legal, technical, or business developments. When we update this Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. When required by law, we will make sure to obtain your consent. You can see the date this policy was last updated at the top of this page.