Privacy policy

Last updated October 31, 2026

This page explains what we collect when you use compassgrade.com or receive an email from us, and what you can do about it.

Who we are

CompassGrade, Raamplein 1, 1016 XK Amsterdam, the Netherlands. Questions about your data go to privacy@compassgrade.com.

The GDPR applies

We are based in the Netherlands, so the EU General Data Protection Regulation (GDPR) covers everything we do with personal data, wherever you are. For email to the United States we also follow the CAN-SPAM Act, and for any email to Australia, the Spam Act 2003.

Emails to businesses

We email owners of businesses in the US and Australia about their public Google listing. We don’t email businesses in the EU, the wider EEA or the UK. Our legal basis is legitimate interest: offering a business an audit of its own listing. We have weighed that interest against the owner’s privacy and written it down, and the safeguards on this page are part of it.

Where the email address comes from: first, we use an address published on the business’s own website. We look further only for a business we plan to email, meaning its report meets all our criteria except that we have no address for it, and only when we could read its website and it shows no email address. In that case our data provider Mercator runs a public Google search for the business’s owner. If the results name one, Mercator looks that person up in Apollo, a business-contact database. We use the address only when Apollo matches that same person as the current owner of this business, with a verified work email address at the business’s own domain. We keep only that address and the owner’s first name, which we use to greet them.

Greeting the owner by name: for a business in Texas or Florida whose address comes from its own website, we look for the first name of the person who holds the business’s license (at a small shop, usually the owner) in the state’s public contractor license records, which anyone can download: the Texas Department of Licensing and Regulation’s air conditioning contractors, the Texas State Board of Plumbing Examiners’ responsible master plumbers, and the Florida Department of Business and Professional Regulation’s air conditioning, mechanical and plumbing contractors. We use a name only when a current license clearly belongs to this business: it carries the name on the Google listing, it’s in the same city, ZIP code or county, or has the same phone number, and it names one person. We use it only for an address like office@ or info@, the business’s own, or one in that person’s own name. We keep that first name with the address, encrypted, to greet them.

For a business in Australia we use only an address published on its own website, and never one published with a note that the business doesn’t want unsolicited email. We don’t look up its owner.

The first email says which of the two sources its address came from, and when it greets the owner by a name from the license records, it says so too. It links to this page. We send one audit email and, if its report isn’t viewed and nobody replies, one short reminder five to nine days later. About a month after the first email, we check the public listing again and may follow up, never sending more than three emails in all. Our emails contain no tracking pixels. The link to the report says which of our emails it came in (“?t=1” for the first and its reminder), so when the report is opened from it, we know that email was read.

When you reply, we read your reply to answer it and to learn which emails are useful. We keep its text for 180 days, encrypted, and after that only a label such as “interested” or “asked to stop”.

Every outreach email has three links: unsubscribe, see the data we hold about your business, and delete it. Replying “stop” in any words works too.

What we collect

• The business name, city, country and email address you enter to request a report.
• Business email addresses for the emails above: one published on the business’s own website, or, if there is none, the owner’s work email address at the business’s domain and their first name, from Apollo’s match for the owner named in public Google results. For a business in Texas or Florida, the first name of the person who holds its license, from the state’s license records.
• A copy of those public license lists, refreshed about weekly, to find that name: for each current license, the business name on it, its city, ZIP code and county, the holder’s first name, encrypted, and one-way fingerprints of the holder’s full name and the license’s phone number. We keep no street address or license number from them, and no last name except where it’s part of a business’s name.
• The text of replies to our emails.
• Public information about businesses: Google Maps listings and rankings, review totals and the topics reviews mention, website content and results from AI search. We use this to build report cards. Reviews arrive with their authors’ names, and we drop those straight away.
• If you choose to pay: Stripe collects your name, billing and card details, and a VAT number if you give one, and we never see your card. Stripe works out any VAT and keeps the invoice. We keep the payment reference, the amount and which report it was for. If you subscribe to a plan, we read your email address from Stripe each time we send you a plan email, and we don’t keep it.
• On a booking page we run for a business on our Growth plan: the name, phone number, address, problem and preferred time a customer types into its repair request form. We encrypt it, email it once to the business so it can call the customer back, and keep no IP address with it. We count visits to the page, with nothing about who visited.
• Basic usage statistics, with no cookies, about pages viewed on this site (Vercel Web Analytics: the page, the referring site, and the browser, device type and country).
• If you reach this site by tapping one of our Google ads, and you are outside the EU, the UK and Switzerland: Google’s ad tag, which sets a Google cookie, and a note in your browser of when you arrived, kept for 30 days. If you then run a rank check, ask for a report or start a plan, Google is told that the ad led to it (and a plan’s monthly price), so it can show our ads to people like you. We get counts only. Inside the EU, the UK and Switzerland the tag never loads. Visitors who didn’t come from an ad get none of this.
• On a report page: a visit that stays open for a few seconds, and taps on its map, its fixes, its pay button and its plan buttons, counted for that report and the email that linked to it. No cookie is used and no IP address is kept. The country our host reads from the IP address is checked but not kept, so a visit from outside the business’s own country isn’t counted as the business’s. If someone asks for a plan there before its sign-up opens, or joins the list for Growth, we email the business once when it opens, at an address we already hold for it.

How we protect it

• Every email address, name and reply is encrypted with a key that belongs to that one business, and the first names in our copy of a license list with that copy’s own key. The keys are locked by Google Cloud’s key service, and only our own software can unlock them. Every unlock is logged.
• We look up by fingerprint, not by address. To check whether we have emailed someone before, or whether they opted out, we compare a one-way fingerprint (a keyed hash) that can’t be turned back into the address.
• People at CompassGrade see only summaries, such as counts and labels, never your address or your messages.

Why we use it

• To build and send the report you asked for, and to handle any payment you choose to make.
• To send the audit emails described above, and to answer replies.
• To learn which emails and reports are useful, whether to send the reminder, and whether to check your map again a month later, from replies and report visits.
• To keep the service secure and to prevent abuse.

Our legal bases are your request (and our agreement with you when you pay), and our legitimate interest in offering a relevant service to businesses.

Who processes it for us

Google Cloud (hosting, data storage and encryption keys), Google Workspace (sending and receiving our emails), Cloudflare (our domain and mail forwarding), Vercel (website hosting), Stripe (payments), Mercator (our data provider, which runs the Google searches, through Serper, and the Apollo lookups), and AI model providers that help write reports and answer replies. They process data only on our instructions. Short notices to our own team go through Telegram; they name the business, never an email address or what anyone wrote to us.

Transfers outside the EU

Our service runs in the United States. Google Cloud, Google Workspace, Cloudflare, Vercel and Stripe process data there under the EU–US Data Privacy Framework, the EU standard contractual clauses, or both. Apollo is certified under the EU–US Data Privacy Framework. For an owner lookup the Google search receives only the business’s name; Mercator and Apollo also receive its website domain and the full name of the owner found in the search.

How long we keep it

Only as long as we need it, and we never sell it.

• Report data about businesses: 24 months, so we can show how a ranking changes over time.
• An owner’s address we looked up but never used: 30 days.
• An address we emailed, if the business never engages: 12 months after our last email.
• If the business replied, asked for a plan or became a customer: 12 months after our last contact.
• The email address you enter to request a report: 12 months.
• The text of replies: 180 days.
• A repair request sent from a booking page: 90 days.
• Our copy of a license list: until the next copy replaces it, about a week later, and 30 days at most.
• Opt-outs: permanently, as a one-way fingerprint, so we never email you again.
• Billing records: as long as tax law requires.

We delete by destroying the business’s encryption key, which makes all its encrypted data unreadable at once. Backups that still hold it expire within 14 days. If we greeted you by a name from the license records, we also delete that license from our copy of the list and leave it out of every later copy.

Your right to object

You can object at any time to our use of your data based on legitimate interest, including looking up a work email address and the emails to businesses, and to direct marketing. Use the link in any email, reply “stop”, or write to privacy@compassgrade.com, and we stop. We keep only a one-way fingerprint of the address, so we never email it again.

Your choices

• Opt out of emails: use the unsubscribe link in any email, or reply “stop” (or tell us in any words).
• See or delete the data we hold about your business at once, with the links in any outreach email. You can also ask for access, a correction or deletion by emailing privacy@compassgrade.com. We answer within 30 days.
• You can also complain to a data protection authority, in the Netherlands the Autoriteit Persoonsgegevens.