PRIVACY NOTICE · 15 OCTOBER 2026

How Compass handles personal and assessment data.

Blue Top Consulting (registration number 2023/261373/07), of Buitenverwachting, Klein Constantia Road, Constantia, Cape Town, South Africa, 7806, is the responsible party or controller for Compass account and service-operation data. For customer-controlled target content, the customer may also determine why the assessment is run. This notice covers the Compass website, waitlist and beta service.

Data we process

• Waitlist and product-interest data, including email, name, organisation, role or area, selected interest and optional notes.
• Account, authentication and profile data, including email address, user identifier, display name, role, proficiency and interests, login events and current legal acceptance.
• Invitation and organisation data, including invited email, organisation, workspace and application names, membership, role, expiry, redemption and revocation records.
• Assessment data, including submitted public targets, sampled page URLs, public technical signals, bounded check evidence, findings, screenshots when enabled, report provenance and status.
• Communications and feedback, including support messages, feedback categories and comments you choose to provide.
• Security and operations data, including audit events, quotas, abuse-prevention records, worker/provider outcomes and error diagnostics. Compass avoids storing secret values in evidence and logs where its controls identify them.

Where data comes from

We collect information directly from you when you join the waitlist, create or use an account, complete a profile, submit a target, manage an organisation, contact us or provide feedback. Organisation owners or administrators may provide member and invitation details. We also generate service, security and assessment records through your use of Compass, receive authentication and infrastructure records from our providers, and collect public target content and technical signals from the websites you ask Compass to assess.

Required and optional information

Fields marked as required, authentication details, legal acceptance and a valid target are needed to provide the relevant feature or enter into the beta agreement. If you do not provide them, we may be unable to place you on the waitlist, create or secure your account, admit you to the beta, or run an assessment. Profile preferences, most waitlist details other than email, and free-text feedback are optional. We do not require personal information under a specific law merely to join the beta, although law may require us to keep or disclose limited records in particular circumstances.

Why we process it

We use waitlist data for beta admission review and product-interest communications. We use other data to authenticate invited testers, provide assessments and reports, manage organisations, enforce limits, prevent abuse, troubleshoot failures, secure Compass, communicate about the private beta, comply with law and establish or defend legal claims. Joining the waitlist does not create an account or grant beta access. Depending on the context, the basis is performance of our agreement, legitimate interests in operating and securing the beta, consent where required, or legal obligation.

Public target data and screenshots

Compass observes publicly reachable targets selected by a user. A target may still contain personal or confidential material, so users must have authority to assess it. Screenshots and sampled URLs can reveal page content and are treated as private assessment artefacts. Screenshot capture can be disabled operationally and may use a hosted-browser provider.

Providers, sharing and international processing

We use service providers for cloud hosting, database, authentication, transactional email and isolated browser sessions, currently including Vercel, Google Cloud, Supabase and the configured hosted-browser provider. We share only data reasonably needed for those services, security, professional advice, a corporate transaction, or legal compliance. Providers may process data outside South Africa. Depending on the provider and destination, safeguards may include contractual data-protection terms, transfer commitments and security controls; the protections and enforceable rights available in another country may differ from those in South Africa. Current provider, region and safeguard facts are maintained in our subprocessor register and are available on request where appropriate.

Retention

Completed and failed free-tier scans and their reports are scheduled for deletion after the configured period, currently 90 days. Security and audit events are scheduled for deletion after a separate period, currently 180 days. Pending or running work is handled through recovery controls. We keep account, organisation and profile data while needed to provide the beta and ordinarily remove or de-identify it after account closure, subject to legal, security and backup needs. Waitlist records are kept while beta recruitment and relevant follow-up remain active, or until you ask us to remove them where applicable. Invitation, legal-acceptance and transaction records may be retained as reasonably needed for access security, audit history and proof of the agreement. Some data may remain longer for a dispute, legal duty, incident investigation, fraud prevention or bounded backup cycle, after which it is deleted, de-identified or securely overwritten according to the applicable process.

Security and incidents

Measures include invitation-gated access, authentication, server-side authorisation, tenant boundaries, row-level security, private artefact storage, short-lived access URLs where used, target validation, quotas, audit events and deletion jobs. No internet service is completely secure. We investigate suspected compromise and notify affected people and regulators where applicable law requires it.

Cookies and analytics

Compass uses necessary cookies for authentication, security and invitation continuity. The raw invitation token is moved out of the address bar into an HTTP-only cookie. Compass does not currently use third-party advertising cookies on invitation pages. Analytics events, where enabled, must not include waitlist or beta email addresses, invitation tokens, organisation or client names, workspace names or application names. If analytics changes materially, this notice and consent controls will be updated where required.

Product communications and direct marketing

We send transactional messages needed to operate and secure the beta. We may also contact waitlist members about beta access and the product interests they submitted. Where consent is required, you may withdraw it at any time. You may ask us to stop optional marketing by using the unsubscribe method in the message or contacting compass@bluetop.co.za. We may still send non-marketing account, legal, security and service messages.

Automated processing

Compass automatically analyses public technical signals to produce assessment findings and may automatically enforce quotas, target-safety rules and abuse controls. These processes affect service availability and report content, but we do not use them to make decisions about individuals that produce legal or similarly significant effects. Contact us if you believe an automated control has been applied incorrectly.

Your rights and requests

Subject to applicable law, you may ask for access to or a copy of your personal information, correction, deletion, restriction, portability, or information about processing; object to certain processing; and withdraw consent where consent is the basis. Withdrawing consent does not affect earlier lawful processing. Account closure does not require deletion where retention remains legally permitted or required. Contact compass@bluetop.co.za; we may verify identity and authority before acting and will explain any lawful limitation or refusal.

Children and sensitive information

Compass is a business service and is not directed to children. Do not invite a child to use Compass or intentionally submit a child’s personal information unless you have a lawful basis and appropriate authority. Do not submit identity numbers, financial account details, health information, credentials, secrets or other sensitive personal information in target URLs, profile fields, feedback or support messages.

South African privacy contact and regulator

Information Officer: Jonathan Nel. Contact: compass@bluetop.co.za. You may also lodge a POPIA complaint with the Information Regulator (South Africa) at POPIAComplaints@inforegulator.org.za or 010 023 5200.

United States privacy rights

Some US state laws may provide rights to know, correct, delete or obtain a copy of personal information, opt out of certain processing, and appeal a refused request. Compass does not sell personal information or share it for cross-context behavioural advertising, and does not discriminate against a person for exercising an applicable privacy right. Submit requests or appeals through the privacy contact above; applicability depends on the relevant law and circumstances.

Changes

We may update this notice as Compass and its providers change. We will publish the new effective date and provide additional notice where required.