Privacy Notice

1. Who we are (controller)

Compass Intelligence Limited, a company registered in England and Wales (company number 15428272), is the data controller for your account data (the identity of the people who administer a Compass account). For the property and guest-derived data you upload or sync from your property management system, your hotel is the controller and Compass acts as a processoron your instructions — the terms of that processing are set out in our Data Processing Agreement.

Privacy contact: privacy@compassintelligence.co.uk.

2. What we collect

• Account data— the email address and name of each administrator, the hotel(s) they manage, and authentication metadata.
• Property data— room types, rates, availability, competitor prices and historical performance you upload or sync from your PMS or channel manager.
• Pricing outputs— the recommendations we generate and the model inputs and factor breakdown that produced them, retained for audit and improvement.
• Operational telemetry— request logs and error reports (via Sentry) used to keep the service reliable and secure.

Compass RMS prices rooms from aggregate property data; it is not designed to ingest individual guest personal data. Please do not upload guest names, contact details or payment data into the platform.

3. Why we use it (lawful basis)

• To provide the service (performance of our contract with you) — generating and displaying pricing recommendations.
• To secure, debug and improve the service (our legitimate interests, balanced against your rights).
• To meet legal and accounting obligations (legal obligation).

We do not use your property data to train third-party foundation models, and we do not sell, rent or share property-level data.

4. Where it lives & sub-processors

Application data is stored in Supabase (PostgreSQL) hosted in the EU (Frankfurt), with row-level security partitioning each tenant. PMS and channel-manager credentials are stored encrypted in Supabase Vault. We rely on a small set of sub-processors:

• Supabase— database, authentication and secret storage (EU).
• Vercel— web application hosting.
• Railway— background workers and scheduled jobs.
• Anthropic— the language model used for pricing explanations and guardrails (zero-retention API usage; no model training on your data).
• Sentry— error and performance telemetry.

Where a sub-processor transfers data outside the UK/EEA, the transfer is covered by UK International Data Transfer terms or the EU Standard Contractual Clauses. The current sub-processor list is maintained in our Data Processing Agreement.

5. How long we keep it

Account data is kept for the life of your subscription and deleted within 90 days of account closure, except where we must retain records to meet legal or accounting obligations. Property and pricing data is retained while your account is active; on termination it is exported to you and then deleted in line with the DPA.

6. Your rights

Under the UK GDPR / EU GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right not to be subject to solely automated decisions producing legal or similarly significant effects. To exercise any of these, email privacy@compassintelligence.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ICO) or your local supervisory authority.

7. Contact

Compass Intelligence Limited, a company registered in England and Wales (company number 15428272). Our registered office address is on the public Companies House register and is provided in full in the signed contract or on request. info@compassintelligence.co.uk. ICO data-protection registration: pending.