Skip to main content
CompassFlow
Start free trial
Privacy · how we handle data

Your data is your data.

This policy describes how Sandhill Labs, LLC (the maker and operator of CompassFlow) handles your data. We collect what we need to run the product, nothing more. We don't sell data. We don't run ads. The information you put into the product belongs to your organization.

Effective May 2026
01

What we collect

Account information. Your name, email, organization name, and team-member emails you invite. Collected when you sign up or add a teammate.

EOS® content you enter. Rocks, Scorecard metrics and values, V/TO® sections, Issues, To-Dos, meeting notes and ratings, Accountability Chart® seats, People Analyzer® evaluations, Process documents.

Usage information. Pages you visit, actions you take, timestamps. Used to keep the product working and to fix bugs.

Billing information. Stored by Stripe, not by us. We see only the last four digits of your card, the billing country, and whether the payment succeeded.

02

What we do with it

We use your data to provide CompassFlow to you. We don't sell it, rent it, share it with advertisers, or use it to train external models without your permission.

Per our license with EOS Worldwide, we share anonymized and aggregated usage data with EOSW for research and benchmarking. This data does not include the content of your Rocks, V/TO® sections, Scorecard values, or any information that could identify you or your organization.

03

Who can see your data

Members of your organization see your organization's content based on their role (owner, admin, or member). Nobody outside your organization can see your content unless you explicitly share it.

CompassFlow staff have access to production data for the narrow purpose of support and system maintenance. Access is logged and reviewed.

We use Supabase (database, authentication), Vercel (hosting), and Stripe (payments) as sub-processors. Each holds your data only to provide their service.

04

How long we keep it

As long as your organization is an active customer, we keep everything. If you cancel, we keep your data for 30 days in case you change your mind, then delete it.

Audit logs and royalty-payment records are retained for two years post-cancellation as required by our license with EOS Worldwide.

05

Your rights and account deletion

Delete your CompassFlow account. You can permanently delete your account and all associated data from inside the app at any time.

On the web: sign in at compassflow.io, go to Profile, and use the Delete account option.

On mobile: open the CompassFlow app, go to Profile, and tap Delete account.

What gets deleted. Your personal profile (name, email, avatar), authentication records, and session data are removed immediately. Business data you created (Rocks, Scorecard entries, Issues, To-Dos, meeting notes) that lives inside an organization you own is removed with your account if you are the last member; otherwise it remains available to your organization and its remaining members. If you no longer want that data to exist either, delete the organization before deleting your account, or ask an organization owner to remove it.

What we retain. Audit logs and royalty-payment records are retained for two years after account closure as required by our license with EOS Worldwide. Stripe retains billing records for the period required by financial regulations. Nothing in these retained records identifies you to other CompassFlow users.

You can also export or edit your data from Settings. For California (CCPA), EU (GDPR), and other jurisdiction-specific requests, email privacy@compassflow.io and we'll respond within 30 days.

06

Security

Data is encrypted in transit (TLS 1.2+) and at rest. We use Stripe's PCI-validated payment infrastructure; we never see full card numbers. Access to production systems requires two-factor authentication and is logged.

If you find a security issue, please email security@compassflow.io rather than posting publicly. We respond within one business day.

07

Cookies

We use a small set of essential cookies to keep you signed in and to remember your active organization. We do not use third-party advertising cookies. We do not run analytics scripts that track you across sites.

08

Changes to this policy

If we materially change how we handle your data, we'll email every customer at least 30 days before the change takes effect. The current version of this policy is always available at this URL.