Privacy Policy

Compound is a platform that customers use to organise their own documents and records. When a customer brings files into Compound — product records, certificates, supplier documents, and similar — we process that content on the customer’s instruction, as a service provider (a “processor”). Any personal information inside that customer content is governed by our agreement with the customer and, where applicable, a Data Processing Agreement — not by this Privacy Policy.

This policy covers the information we collect and control ourselves: information from website visitors, people who request a demo or contact us, and the individual users who log in to Compound.

We collect the following categories of personal information:

• Information you give us. When you request a demo or email us, we collect your name, job title, company email, company name, and anything you write in your message. If you become a user, we collect your account details (name, work email, role, and organisation).
• Information we generate about your use of Compound. To operate and secure the product, we record account activity and audit events — for example, sign-ins, actions taken, and approvals — along with technical logs.
• Website and device information. When you visit our site, we automatically receive standard technical data such as your IP address, browser type, pages viewed, and referring page.
• Customer content. Documents and records a customer uploads may contain personal information (for example, the name of a signatory or a supplier contact). We process this on the customer’s behalf, as described under Scope above.

We don’t seek out sensitive information — such as government IDs, passwords, or health details — and we ask that you don’t include it in demo requests or messages to us.

We use personal information to:

• respond to demo requests and enquiries, and prepare for our conversations with you;
• provide, maintain, secure, and improve the Compound service;
• authenticate users and protect accounts against unauthorised access;
• send service and administrative communications, and — where you have opted in or the law allows — occasional product updates;
• understand how our website and product are used, in aggregate;
• comply with our legal obligations and enforce our agreements.

We do not sell your personal information, and we do not run automated outbound marketing sequences against the details you share with us.

AI and model training. Compound uses AI models to help process documents. We do not use your personal information, or customer content, to train our own or any third party’s foundation models. Our AI sub-processor is engaged under terms that prohibit using the data we send it to train their models.

Where the GDPR or UK GDPR applies, we rely on these legal bases: your consent; our legitimate interests in operating and promoting our business (balanced against your rights); the performance of a contract with you; and compliance with legal obligations.

We do not sell your personal information, and we never share it with data brokers or advertisers. We share only the minimum necessary information, and only in these circumstances:

• Service providers who help us run Compound — such as cloud hosting and infrastructure, an AI provider that helps process documents, email delivery, and error monitoring. They act on our behalf under contracts that require them to protect the information and use it only to provide their service to us.
• Professional advisers (such as lawyers and accountants) where reasonably necessary.
• Legal and safety — where we are required by law, or to protect our rights, our users, or the public.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.

We can provide the current list of the sub-processors we rely on, and where they operate, on request — just email hello@askcompound.com.

Compound is operated from Australia, and we host in the Australian region where practical. Some of our sub-processors process information in other countries — in particular the United States (for example, our AI processing, website analytics, and error monitoring) and other locations where our providers operate.

When we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, and — where the GDPR or UK GDPR applies — we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep personal information only as long as we need it for the purposes described here, or as long as the law requires. We retain demo-request details for as long as needed to follow up and, if you don’t become a customer, we remove or de-identify them within a reasonable period. Account information is retained for the life of the account and a limited period afterwards. Customer content is retained and deleted according to the customer agreement.

We take reasonable technical and organisational measures to protect personal information — including encryption in transit, access controls, and audit logging — and we limit access to the people who need it to do their job. No system is perfectly secure, but we work to protect your information and to respond quickly if something goes wrong. If a data breach is likely to cause serious harm, we will notify affected individuals and the relevant regulator as required by law.

We use analytics services to understand how our website and our product are used. For each page view these record information such as the page address, the referring site, general device and browser type, and country-level location.

If you arrive from a campaign link or another website, we store a small record in your browser for the duration of your visit so we can tell how you found us. It holds the campaign tags in the link, the referring site’s domain, and the page you arrived on. If you request a demo it is attached to that request; otherwise it is discarded when you close the tab.

Compound uses cookies that are necessary to keep you signed in and protect account access. We do not use advertising, retargeting, or cross-site tracking cookies. You can control or block cookies through your browser settings, though blocking essential cookies may affect how the app works.

You can ask us to access, correct, update, or delete the personal information you’ve shared, and to stop sending you marketing communications. Depending on where you live, you may also have rights under the GDPR/UK GDPR (including data portability and objection) or the California Consumer Privacy Act (including the right to know and to opt out of “sale” or “sharing” — which we do not do).

To exercise any of these, email hello@askcompound.com and a person will handle it. We will verify your request and respond within the timeframe the law requires. If you are a user of a customer account and your request concerns customer content, we may direct you to that customer, who controls the data.

Compound is a business product not directed to children, and we do not knowingly collect personal information from anyone under 16.

We may update this policy as Compound grows or the law changes. When we make material changes, we will update the date above and, where appropriate, tell you directly. Your continued use of Compound after a change means you accept the updated policy.

Questions about privacy, or want to make a complaint about how we handle your information? Reach us at hello@askcompound.com. We’ll acknowledge your complaint and work with you to resolve it.

If you are in Australia and are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you are in the EU or UK, you may lodge a complaint with your local data protection authority.

Compound Technologies Pty Ltd (ABN 93 696 687 340), Sydney, Australia.