Privacy

Updated 5 November 2026. This policy covers the Compass website, onboarding and product workspace.

Who is responsible

Auraqu, Inc., a Delaware C-Corporation, operates Compass and is responsible for the personal data described here. Address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Contact misha@getcompassseo.com. See our legal notice for provider details.

What we collect and why

We use your email address and sign-in records to provide access to your account. Your workspace stores website URLs, business and audience details, optional competitor and writing references, brand preferences, topic plans, articles, sources, approvals and delivery records. We read public website pages to prepare profiles, source research and competitor suggestions. Setup progress is also saved in your browser tab so you can resume it.

Technical request information, including a hashed network identifier, is used for security and request limits. We store subscription identifiers and status to control paid access. Stripe processes payment details; Compass does not store card numbers.

If you join an earlier-access list, we keep your signup email, date and any answers you submit. When optional measurement is allowed, short campaign labels can be attached to a signup or website setup. They identify the campaign source; we do not save the full query string, referrer or advertising click identifiers for this attribution.

AI processing and public content

Article generation, planning and competitor discovery send the relevant business context and public-page extracts to Google Cloud Vertex AI. An alternative OpenAI adapter can be used when that provider is enabled. Do not put secrets or sensitive personal information in business descriptions or writing references. These inputs are separate from connected Google account reports.

Articles remain private in your workspace until you explicitly deliver them. Publishing to a connected CMS, a webhook, the article API or a hosted blog sends or exposes the approved content at that destination. A hosted-blog or feed publication can be public. Disconnecting Compass does not remove content already delivered to another service.

Google sign-in and optional reports

Google sign-in requests openid, email and profile to verify your identity. We use the verified email address to sign you into your Compass account. Signing in does not by itself connect Search Console or Analytics.

If you separately connect Google in Traffic, public accounts request webmasters.readonly for Search Console. Google Analytics is in limited preview pending Google permission review; approved preview accounts can also grant analytics.readonly. We read the Search Console sites and Analytics properties available to that account so you can choose the properties to show. For your chosen properties we retrieve daily Search Console clicks, impressions and average position, and Analytics sessions, users and page views. These read-only permissions do not allow Compass to change Google properties or their settings.

We keep the connection refresh token encrypted, together with selected property identifiers, available property names and cached reports. Connections and report access are scoped to your account and website. We use this data to display and refresh your requested Traffic reports. Connected Google API reports and sign-in data are not sent to the article-generation model and are not used to train generalized AI or machine-learning models.

Our use and transfer of Google API data follows the Google API Services User Data Policy, including Limited Use requirements. We do not sell this data, use it for advertising, or transfer it to advertising platforms or data brokers. Human access is limited to your explicit support authorization, necessary security investigations, or legal requirements. Service providers process it only as needed to deliver the requested features under these limits.

Disconnect Google in Traffic to delete the local connection token, property selections and cached reports. You can also revoke Compass access in your Google Account connections. Revoking access at Google stops future authorized retrieval; use Disconnect or contact us to remove reports already stored by Compass. Disconnecting does not delete your underlying Google data.

Publishing credentials and service providers

CMS credentials, GitHub tokens, webhook secrets and Google connection tokens are encrypted before database storage. They are used for the connection checks and actions you request and are not displayed back in connection forms. Read-only article API keys are stored as hashes and can be revoked. Only connect accounts and websites you are authorized to manage.

Google Cloud Run hosts the product and Vertex AI provides generation. Vercel hosts public website deployments. Google Cloud SQL stores product account and workspace data; Neon retains the separate legacy waitlist. Resend sends service emails; Stripe handles checkout and subscriptions. DataForSEO supplies keyword-demand estimates and public search results used for topic planning and conversation discovery. Your selected CMS, GitHub or webhook provider receives content when you request delivery. These providers may process data in countries outside your location. Contact us for information about the arrangements relevant to your account.

Cookies and optional measurement

A necessary HTTP-only session cookie keeps you signed in for up to 30 days; sign-in links expire after 15 minutes and work once. Short-lived cookies protect Google authorization. Your browser also stores onboarding progress and your analytics choice.

Public marketing pages can use Vercel Web Analytics and Speed Insights. With your analytics permission, Compass records limited page and workflow events, such as setup steps, trial activation and article completion, and sends them to PostHog on its EU endpoint using a pseudonymous identifier. We do not include form text, article bodies, credentials or connected Google API reports. Session recording is disabled; automatic page/session capture is excluded from sign-in, onboarding and private workspace pages.

Advertising measurement is a separate optional choice. When enabled and configured, we send selected conversion events, such as confirmed trials and collected subscription payments, campaign labels and hashed account identifiers/email addresses to Meta for advertising attribution and optimization. Hashing does not make these identifiers anonymous. Connected Google API data is never used or shared for advertising.

Your choices are stored in a shared-domain cookie for up to six months. When optional measurement is allowed, a random visitor cookie can link the marketing site, setup and your account for up to 30 days. Use Cookie settings to change either choice; withdrawal stops future optional forwarding, clears browser analytics storage and removes the optional visitor cookie after the preference update. Do Not Track and Global Privacy Control disable optional measurement.

Retention and your choices

We keep account content and stored reports while needed to provide your workspace or until you request deletion. There is no fixed automatic deletion period for workspace content. Billing and security records may need to be retained for legal obligations or resolving disputes. Disconnect removes the associated local Google connection data as described above; deleting an earlier-access signup does not by itself delete a product account.

Email misha@getcompassseo.com to request access, correction, an export or deletion of account data. We may verify your identity before acting. You can unsubscribe from marketing emails; essential sign-in and subscription messages are separate. Where applicable, you can also request restrictions, object to processing, or complain to your data-protection authority.

We process data to supply the service you request, protect accounts and prevent abuse, meet legal billing obligations, and, where required, with your consent for optional analytics. Withdrawing optional consent does not remove access to the core service. We will update this policy when data use changes and seek additional Google authorization before using Google API data for a new purpose requiring it.