Privacy Policy

Last updated: July 16, 2026

This Privacy Policy explains what information Compass collects, how we use it, who we share it with, and the choices you have. Compass is built for A-Level and IB students, and we've tried to keep this policy concrete about exactly what we do with your data rather than generic boilerplate.

1. Information we collect

• Account data: your name, email address, and password. Authentication and password storage are handled by our provider, Supabase — we never see or store your raw password.
• Student profile: background details you tell us directly — country of residence, region/city, nationality, current grade, curriculum, expected graduation year, and (optionally) school name/type. This is separate from your assessment answers and is used only to personalise your report.
• Assessment answers: your answers to all 100 assessment questions, including any free-text responses you write, saved to your account as you progress so you can resume later.
• Derived results: your RIASEC scores and Holland code, computed from your answers, and your AI-generated report.
• Payment records: when you pay for a report, Stripe processes your card details directly — we never see or store your full card number. We keep a record of the transaction (amount, currency, status, and Stripe's reference ID) for receipts and accounting.
• Technical data: basic request metadata (such as IP address and browser type) generated automatically as part of running the service securely.

We do not currently use analytics or advertising trackers of any kind.

2. How we use your information

• To create, secure, and let you log back into your account, and to verify your email address.
• To save your assessment progress and let you resume it.
• To generate your AI career report (see below) once you request it.
• To process your one-time $9 report payment via Stripe.
• To email you when your report is ready, and to resend it if you ask us to (via Resend, our email provider). The report email includes your report content so it's easy for you to read and share — it does not include your raw assessment answers.
• To respond to support requests you send us.

3. How your report is generated (AI processing)

When you unlock your report, we send your RIASEC scores, Holland code, selected multiple-choice context answers, your written free-text answers, and your student profile (country, region, nationality, grade, curriculum, and graduation year) to our AI provider, Groq, to generate the report content. We do notsend your name or email address as part of that request — the AI only sees your assessment responses and profile details, not who you are. Groq processes this data to generate a response and does not become a joint controller of your account data. Before your profile is used this way, we ask you to confirm it's accurate and to consent to this sharing on the profile form itself.

4. Who we share information with

We share information only with the service providers who help us run Compass, each acting on our behalf and only for the purposes below:

• Supabase — authentication and database hosting for your account, assessment answers, and reports.
• Stripe — payment processing for the paid report.
• Resend — delivery of your report and account emails.
• Groq — AI inference to generate your report content, as described above.

We do not sell your personal information, and we don't share it with advertisers.

5. Cookies

We use one essential cookie set by Supabase to keep you signed in and to protect pages like your assessment and report from being accessed while logged out. We don't use analytics, advertising, or third-party tracking cookies.

6. International data transfers

Our service providers (Supabase, Stripe, Resend, and Groq) may process data on servers located outside your home country. Where required, we rely on those providers' contractual safeguards for cross-border data transfers.

7. Data retention

We keep your account, assessment answers, and generated reports for as long as your account is active, so you can revisit your results. We retain payment records for as long as required for accounting and tax purposes. If you ask us to delete your account (see below), we delete your assessment answers, reports, and profile data, except where we're required to keep payment records by law.

8. Your rights & choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information. Account deletion is not yet self-service in the app — email us at the address below and we'll action your request.

9. Children's privacy

Compass is intended for users aged 16 and over. We don't knowingly collect personal information from children under the minimum age required by applicable law in their location. If you believe a child has created an account without appropriate consent, contact us and we'll remove it.

10. Security

We use industry-standard measures, including encryption in transit and provider-managed encryption at rest, to protect your information. No method of transmission or storage is perfectly secure.

11. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date.

12. Contact

Questions about this policy, or want to access, export, or delete your data? Contact us at support@compass.app.

This document is a template reflecting how Compass currently works and has not been reviewed by a lawyer. Replace the placeholder contact email with a real one, and have counsel review this before relying on it in production.