Privacy policy

Last updated September 27, 2026

This page explains what we collect when you use compassgrade.com or receive an email from us, and what you can do about it.

Who we are

CompassGrade, Raamplein 1, 1016 XK Amsterdam, the Netherlands. Questions about your data go to privacy@compassgrade.com.

The GDPR applies

We are based in the Netherlands, so the EU General Data Protection Regulation (GDPR) covers everything we do with personal data, wherever you are. For email to the United States we also follow the CAN-SPAM Act.

Emails to businesses

We email businesses about their public Google listing. For that we use business contact details only: the business name, a business email address (which can be the owner’s work address, with their first name) and the public data on its Google listing. Our legal basis is legitimate interest: offering a business an audit of its own listing.

Where the email address comes from: first, we use an address published on the business’s own website. We look further only for a business we plan to email, meaning its report meets all our criteria except that we have no address for it, and only when we could read its website and it shows no email address. In that case, while we build its report and before we email it, our data provider Mercator runs a public Google search for the business’s owner. If the results name one, Mercator looks that person up in Apollo, a business-contact database. We use the address only when Apollo matches that same person as the current owner of this business, with a verified work email address at the business’s own domain.

From that lookup we keep only the owner’s work email address and their first name as Apollo’s match gives it, which we use to greet them. Every email says which of the two sources its address came from.

We send one audit email. About a month after it, we check the public listing again and may send at most two follow-ups.

To opt out, reply “stop” (or tell us in any words) to any email, or use its unsubscribe link where there is one, and we won’t email you again.

What we collect

• The business name, city and email address you enter to request a report.
• Business email addresses for the emails above: one published on the business’s own website, or, if there is none, the owner’s work email address at the business’s domain and their first name, from Apollo’s match for the owner named in public Google results.
• Public information about businesses: Google Maps listings and rankings, public reviews, website content and results from AI search. We use this to build report cards.
• If you choose to pay: your name, billing details and payment history. Card details go straight to Stripe; we never see them.
• Basic, cookie-free usage statistics about pages viewed on this site.

Why we use it

• To build and send the report you asked for, and to handle any payment you choose to make.
• To send the audit emails described above.
• To keep the service secure and to prevent abuse.

Our legal bases are your request (and our agreement with you when you pay), and our legitimate interest in offering a relevant service to businesses.

Who processes it for us

Google Cloud (hosting and data storage), Vercel (website hosting), Stripe (payments), Mercator (our data provider, which runs the Google searches, through Serper, and the Apollo lookups), our email providers, and AI model providers that help write reports. They process data only on our instructions.

Transfers outside the EU

Google Cloud, Vercel and Stripe may process data in the United States. For those transfers we rely on the EU–US Data Privacy Framework, the EU standard contractual clauses, or both.

Mercator, our data provider, is a US service, and so are Apollo and Google search (through Serper), which it uses for us. For an owner lookup the Google search receives only the business’s name; Mercator and Apollo also receive its website domain and the full name of the owner found in the search.

How long we keep it

Only as long as we need it, and we never sell it. Report data is kept for 24 months so we can show how your ranking changes over time. An owner’s work email address and first name from a lookup are stored with that business’s report and kept for the same 24 months. Opt-out requests are kept permanently so we never email you again. Billing records are kept as long as tax law requires.

Your right to object

You can object at any time to our use of your data based on legitimate interest, including looking up a work email address and the emails to businesses, and to direct marketing. Reply to any email or write to privacy@compassgrade.com, and we stop. We keep only a record of your objection, so we never email you again.

Your choices

• Opt out of emails: reply “stop” (or tell us in any words) to any email, or use its unsubscribe link where there is one.
• Ask for access to your data, a correction, or deletion by emailing privacy@compassgrade.com. We answer within 30 days.
• You can also complain to a data protection authority, in the Netherlands the Autoriteit Persoonsgegevens.