Privacy Policy

OwnerCompass ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our business continuity and organisation platform (the "Service").

Who is responsible for your data: OwnerCompass Limited is the data controller for the personal data described in this policy. We are a company registered in England and Wales (company number 17277207), with our registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are registered with the Information Commissioner's Office (ICO), the UK data protection regulator, under reference ZC212374. You can reach us about anything in this policy at privacy@ownercompass.com.

This policy applies to all users of OwnerCompass, whether you're using our Business Continuity or Business Valuation plans.

Please read this policy to understand how we handle your information.

Account Information: Name, email address, password, company name, phone number

Business Information: Industry, number of employees, business start date, business description

Payment Information: Billing address, payment card details (processed securely by Stripe - we do not store full card numbers)

Documents: Business documents you upload (accounts, contracts, policies, etc.)

Contacts: Business contact information you add to the platform

Trusted People: If you name someone as a Trusted Person in your Emergency Plan, the details you give us about them: their name, email address, phone number, relationship to you, the access you give them, and any instructions you leave for them

Communications: Messages you send us via contact forms or email

How You Found Us: If you choose to tell us during sign-up how you heard about OwnerCompass, we keep your answer with your account. It is optional, and we use it only to understand which ways of reaching business owners work

Usage Data: Pages viewed, features used, time spent on platform

Device Information: IP address, browser type, operating system, device type

Log Data: Access times, error logs, system activity

The Link You Arrived From: If you reach our website from one of our adverts or another tagged link, the web address carries a short label naming it (for example, which advert it was). If you then create an account, we keep that label with your account and use it only to understand which ways of reaching business owners work. The label travels in the web address; nothing is stored on your device to do this, and we do not share it with advertisers

Cookies: Small data files stored on your device (see Section 9 for details)

Payment Processors: Stripe provides us with payment confirmation and billing information

We use the information we collect to:

• Provide the Service: Create and maintain your account, store your documents, process your business information
• Process Valuations: Calculate and provide quarterly business valuations (Business Valuation tier)
• Generate Data Rooms: Compile your business information into organised data packs
• Communicate With You: Send service updates, respond to enquiries, provide customer support
• Process Payments: Bill your subscription and process transactions
• Improve the Service: Analyse usage patterns, fix bugs, develop new features
• Ensure Security: Detect and prevent fraud, abuse, and security issues
• Comply With Legal Obligations: Meet regulatory requirements, respond to legal requests

We will never:

• Sell your personal or business information to third parties
• Use your business documents for our own purposes (e.g., training AI models)
• Share your information for marketing purposes without your consent
• Access your account without your explicit permission (except for support requests)

No automated decisions: We do not make decisions about you that have legal or similarly significant effects by automated means alone. AI helps us organise your documents and extract information from them, and every valuation is prepared by a member of our team.

UK data protection law only allows us to use your personal information if we have a lawful reason for doing so, known as a "legal basis". For each of the ways we use your information described in Section 3, we rely on one of the reasons below.

We need this information to provide the Service you have signed up for, including your free trial. Without it, we cannot provide the Service.

• Creating and maintaining your account, storing your documents, and processing your business information, including AI document analysis and reading text from scanned documents
• Carrying out valuations and producing data rooms on the Business Valuation plan
• Taking payment for your subscription through Stripe, and handling plan changes and cancellations
• Helping you when you ask us for support with your account

• Keeping billing records for as long as UK tax law requires (see Section 8)
• Disclosing information when the law, a court order or a regulator requires it (see Section 6)
• Responding when you use your data protection rights (see Section 7)

We may also use your information where we have a genuine reason to do so, as long as that reason is not outweighed by your own rights and interests. The reasons we rely on are:

• Security: detecting and preventing fraud and misuse, recording sign-in activity, and sending the email verification codes used for two-factor authentication, to keep your account, your documents and our systems safe
• Service emails: telling you about things that affect your account, such as a reminder before your free trial ends, a failed payment or a change to your plan, so you are never caught out
• Improving the Service: looking at how the Service is used so we can fix problems and make it better
• Trusted People: holding the details of the people you name as Trusted People and emailing them an invitation, so that someone you trust can help keep your business running in an emergency
• How you found us: keeping your optional answer to "How did you hear about us?" and, if you arrived through one of our adverts or another tagged link, the label described in Section 2.2, so we can understand which ways of reaching business owners work
• Tips and product news: occasionally emailing account holders tips on getting the most from the Service and news about new features, unless you have told us not to. You can opt out when you sign up, in Settings, or with the unsubscribe link in any of these emails, and we will always stop
• Answering enquiries: replying to messages you send us through our contact form or by email
• Business transfers: if OwnerCompass is ever acquired or merged, passing your information to the new owner so your account can continue (see Section 6)

You have the right to object to any use of your information that relies on legitimate interests (see Section 7). Email privacy@ownercompass.com and we will stop, unless we have a compelling reason to continue. For example, we must keep security measures in place to protect your account.

We do not currently rely on your consent for any of the ways we use your information. We send tips and product news only to account holders who were given the chance to opt out when they signed up, as the Privacy and Electronic Communications Regulations allow, and you can stop them at any time. We do not use any cookies that need your consent (see Section 9). If we ever want to use or share your information in a way that needs your consent, we will ask you first, and you can withdraw your consent at any time.

Your documents and contacts may include information about other people, such as your staff, customers or suppliers. For that information, your business decides what is stored and why, and we only store and process it on your behalf to provide the Service, under section 6.4 of our Terms of Service. In data protection terms, you are the "controller" of that information and we are your "processor". This means you are responsible for having a lawful reason to store it with us, including any extra condition the law requires for sensitive information such as health records.

We implement multiple security measures:

• Encryption: All data encrypted in transit (TLS) and at rest (AES-256)
• Access Controls: Password-protected accounts with optional two-factor authentication via email verification code
• Regular Backups: Daily automated backups, encrypted storage
• Access Records: Sign-in activity is recorded, enabling investigation of suspicious activity

We share your information only in these limited circumstances:

Service Providers: We use the following services to operate our platform:

• Stripe — Payment processing
• Supabase — Data hosting and storage (UK region)
• Resend — Transactional emails only
• Anthropic — AI-powered document analysis (your documents are not used for AI training)
• Google Cloud Vision — text extraction (OCR) from scanned documents (not used for AI training)
• Vercel — Application hosting and delivery, plus cookieless website analytics (page-view counts only, no cookies and no personal identifiers)

These providers are GDPR-compliant and contractually obligated to protect your information. They can only use your data to provide their service to us. The one exception is Stripe, which also uses payment information to prevent fraud and meet its own legal obligations, under its own privacy policy.

Legal Requirements: We may disclose information if required by law, court order, or government regulation.

Business Transfers: If OwnerCompass is acquired or merged, your information may be transferred. We will notify you before this happens.

With Your Consent: We may share information for other purposes with your explicit consent.

We will never sell your information to third parties for marketing purposes.

Under UK GDPR, you have the following rights:

Right to Access: Request a copy of all personal data we hold about you

Right to Rectification: Correct inaccurate or incomplete information

Right to Erasure: Request deletion of your personal data (subject to legal obligations)

Right to Restrict Processing: Limit how we use your data in certain circumstances

Right to Data Portability: Receive your data in a structured, commonly-used format

Right to Object: Object to certain types of processing (e.g., direct marketing)

Right to Withdraw Consent: Withdraw consent for processing where we rely on consent

To exercise these rights, including requesting a copy of your personal data, please contact us at privacy@ownercompass.com. You can also delete your account at any time from your account settings.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we've mishandled your data.

We retain your information for as long as necessary to provide the Service and comply with legal obligations:

Active Accounts: We retain all data while your account is active

After Subscription Cancellation:

• Your access continues until the end of your current billing period
• After your billing period ends, your account is paused: your documents and data are kept safe, and your access is restricted until you resubscribe
• We do not delete your data automatically — it stays available to you if you resubscribe later
• If you want your data removed, you can request account deletion from your account settings at any time

Documents and Contacts You Delete:

• When you delete a document or a contact it is removed from your account straight away and is no longer visible to you or to anyone you have granted access
• We keep it for 30 days so it can be recovered if you deleted it by mistake — deleted documents appear in Recently Deleted during this period
• After 30 days it is permanently erased, including the underlying file in our secure storage

After Account Deletion:

• You have 14 days to change your mind — signing in during that period lets you restore your account
• After 14 days, your personal data and documents are permanently removed and this cannot be undone
• Billing records are kept for 6 years from the end of the financial year they relate to, as UK tax law requires

You can delete your account at any time from your account settings, or contact us at privacy@ownercompass.com.

We use cookies and similar technologies to provide and improve the Service.

Strictly Necessary Cookies: Required for the Service to function (authentication, security). These cannot be disabled.

We do not use:

• Marketing or advertising cookies
• Third-party tracking cookies
• Social media cookies

You can manage cookie preferences in your browser settings. Disabling necessary cookies may prevent you from using certain features.

For more details, see our Cookie Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

When we make changes:

• We'll update the "Last updated" date at the top of this page
• For significant changes, we'll notify you by email

We encourage you to review this policy periodically.

If you have questions about this Privacy Policy or how we handle your data, please contact us:

We aim to respond to all enquiries within 2 business days.