Scope and who we are
This Privacy Policy applies to Compass websites, the Compass application, public launch pages, account creation, school and district activation flows, support communications, billing workflows, and related services that link to this Policy.
Compass is operated by CARL Hub Inc., a Canadian corporation incorporated in British Columbia and federally registered in Canada. Our privacy contact is [email protected].
If your school, district, or organization has a separate agreement with Compass, that agreement may include additional data protection, retention, access, residency, or support terms for the organization workspace.
Student personal information
Compass is an educator and administrator platform. Student accounts are not currently available, and teachers should not enter student names, student records, grades, Individual Education Plans, health information, parent contact details, or other identifiable student personal information unless their institution has explicitly approved that use.
Compass can be used to track curriculum coverage, plans, classes, and teacher-created notes without naming students. If a school or district authorizes use involving student personal information, the institution is responsible for giving staff instructions, obtaining any required consents, and confirming that Compass is approved for that purpose.
Information we collect
Compass collects information directly from users, from institution administrators, from product activity, and from configured service providers.
How we use information
We use personal information for the purposes for which it was collected and for compatible purposes, including to:
- create, verify, authenticate, and secure accounts;
- provide class setup, curriculum coverage, planning, reporting, sharing, and workspace administration features;
- process uploaded files, pasted text, curriculum sources, and AI-assisted requests you initiate;
- operate school and district provisioning, roster imports, seat limits, owner transfer, and access policies;
- manage subscriptions, checkouts, invoices, district quotes, and customer portal access;
- send verification, password reset, account, billing, product, support, security, and policy communications;
- monitor reliability, debug errors, detect abuse, enforce limits, investigate security events, and protect users;
- measure product usage, improve workflows, prioritize roadmap decisions, and evaluate launch campaigns;
- comply with legal, tax, audit, accounting, reporting, and dispute-resolution obligations.
We do not sell personal information. We do not use private workspace content for targeted advertising. We may use aggregated or de-identified usage information to understand and improve Compass.
AI-assisted processing
When you use AI-assisted features, Compass may send relevant prompts, uploads, pasted text, plan details, custom curriculum content, curriculum metadata, and workspace context to the configured AI provider. Compass currently supports OpenAI, Google Gemini, Google Vertex AI, and a mock provider for development environments.
We do not use your content or personal information to train AI models. We access AI providers through their business APIs, under terms that do not permit them to use your inputs or outputs to train their models.
AI processing is used to extract file text, parse custom curriculum, suggest plan details, rank curriculum matches, generate plan ideas, summarize plans, and draft Plus features such as family summaries or report comment starters. AI output is returned to you for review and may be saved only when the feature or your action stores it in Compass.
Temporary uploads and pasted text may be stored long enough for the scan worker to finish processing. By default, temporary upload assets expire after 24 hours. Completed or canceled scan job results are deleted after a short workflow window, and failed scan job metadata is retained longer for support recovery. Current defaults are listed in the retention section.
Retention and deletion
We keep personal information only as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law, contract, tax, audit, security, dispute, or backup needs.
For verified account deletion requests, we target removal of active product account data within two business days where operationally possible. Backups, audit logs, billing records, de-identified records, and records we must keep for legal or security reasons may remain for longer.
Security
Compass uses administrative, technical, and organizational safeguards designed to protect personal information, including hashed passwords, session revocation, role-based access controls, request-origin checks, rate limiting, audit logs, support session controls, environment secret management, and encrypted HTTPS transport in production deployments.
No online service can guarantee absolute security. Please use a strong password, keep credentials private, sign out of shared devices, and contact [email protected] if you suspect unauthorized access.
School and district workspaces
When Compass is provided through a school or district workspace, the institution may control workspace membership, seat allocation, billing, roster imports, domain policies, class sharing defaults, resource access, owner transfers, and retention or offboarding decisions. Institution administrators may see workspace data according to their role and the applicable agreement.
If you use Compass through your employer or school district, direct requests about institution-controlled data to your institution when required by its policies. You can also contact us at [email protected] and we will route or coordinate the request as appropriate.
Your privacy rights and choices
Depending on where you live and how you use Compass, you may have rights to access, correct, export, delete, or challenge the handling of your personal information. You may also have rights to withdraw consent, object to or restrict certain processing, and complain to a privacy regulator.
- You can update some profile, language, session, workspace, billing, and planning information inside Compass.
- You can revoke other active sessions from Settings where that feature is available.
- You can request access, correction, export, or deletion by emailing [email protected].
- We may need to verify your identity and authority before acting on a request.
- We will not discriminate against you for exercising privacy rights.
Canadian users may contact the Office of the Privacy Commissioner of Canada or, for British Columbia matters within its mandate, the Office of the Information and Privacy Commissioner for British Columbia. We ask that you contact us first so we can try to resolve the issue directly.
Storage locations and international transfers
Compass is built for Canadian education and uses service providers selected for product, security, reliability, and operational needs. Primary hosting, databases, storage, analytics, AI, email, support, and payment processing may occur in Canada, the United States, or other countries depending on deployment and provider configuration.
When personal information is processed outside your province, state, or country, it may be subject to the laws of that location. We use contractual, technical, and organizational safeguards where appropriate. School or district agreements may add data residency or subprocessor terms.
Children and youth
Compass is not directed to children under 13 and does not offer student accounts. If we learn that a child has created an account or that identifiable child personal information was entered without authorization, we may delete the information, disable the account, or coordinate with the applicable school, district, parent, guardian, or regulator as appropriate.
Changes and contact
We may update this Privacy Policy to reflect product changes, legal requirements, provider changes, or privacy practice changes. Minor updates are effective when posted with a new date. For material changes, we will provide notice by email, in-app notice, website banner, or another reasonable method where required.
Privacy requests, security concerns, school or district questions, billing questions, and other Compass inquiries can be sent to [email protected].
Mailing address: CARL Hub Inc., Kelowna, BC, Canada.