Privacy policy

What we collect

• Your account: your name, email address and, if you set one, your password, which we store only as a salted hash. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Your profile and ventures: what you tell us about yourself and each venture, such as country, stage, sector, team size, revenue band and funding raised. We mark these as self reported.
• Your work in Compass: calls you save, applications you track and their results, amounts you report winning, application drafts and saved answers, and who is on each venture team.
• Billing: your plan and subscription status. Stripe handles your card; we never see or store card numbers.
• Security records: sign in events and changes to your account and ventures, with the IP address they came from, so we can spot misuse and answer questions about what happened.

Why we use it

• To match your ventures and you to calls you may qualify for, and to explain each match rule by rule.
• To run the tracker, team access, the application kit and the emails you ask for.
• To take payment for premium and keep your plan in step with Stripe.
• To keep the service secure and fix problems.
• With your consent, to report funding won through Compass in totals that do not name you or your venture.

The legal basis is the contract with you for running the service, our legitimate interest in keeping it secure and improving it, and your consent where we ask for it.

Who helps us run Compass

These providers process data for us, only to run the service:

• DigitalOcean hosts our database and API in Frankfurt, Germany.
• Vercel hosts the website.
• Resend sends our emails: password resets, admin access codes, deadline reminders, digests and team invites.
• Anthropic provides the AI we use in two places. It reads public funder pages to build listings. When you ask the application kit for a draft, we send it your venture record, your saved answers and the call's page. Under its commercial terms, Anthropic does not use this to train its models.
• Stripe takes payments.
• Google, only if you choose to sign in with Google.

Some of these providers are in the United States. Where data leaves your country, we rely on the safeguards each provider offers, such as standard contractual clauses.

Who else sees your data

Ventures are private. Only people on a venture's team see it, its matches and its tracker. When you invite someone or approve a join request, they see what the team sees. Compass never sends your information to a funder; you decide what to submit and where. We share data with authorities only when the law requires it.

How long we keep it

• Your account and ventures, for as long as your account is open.
• Copies of funder pages, for 12 months after the listing closes, so every fact can be checked against its source.
• Security records, such as sign ins and admin actions, for 12 months.

When you close your account we delete your data within 30 days, except what we must keep for tax, accounting or legal reasons.

Cookies

We use only the cookies needed to keep you signed in. We do not use advertising or tracking cookies.

Your choices and rights

• You can see and edit your profile and ventures at any time in Compass.
• You can switch off deadline reminders and the weekly digest in settings or from the link in any of those emails.
• Depending on where you live, you can ask for a copy of your data, ask us to correct or delete it, object to some uses, or complain to your data protection authority.

To make a request or ask a question, email support@ayahq.com. We answer within 30 days.

Changes

If we change this policy in a way that matters, we will email you before the change takes effect.