Privacy Policy

Last updated: 15 July 2026

1. Data Controller

This privacy policy applies to the course websites and branded domains listed below, together referred to as the "Service":

The data controller for the Service is:

Compass Revision
6 Farm Lane, Send, Woking, Surrey, GU23 7AT
United Kingdom
support@compassrevision.com

2. What Data We Collect

We collect only the personal data needed to provide course access, account sync, payments, support, security, and optional analytics. You can browse free course content without creating an account.

Data we process

  • Account data - If you create an account or sign in, we process your email address, optional name, authentication provider details, and any profile image supplied by that provider. If you use Google sign-in, Google verifies your email address and returns basic profile details to us.
  • Email address at checkout — When you purchase full access, Stripe collects your email address as part of the payment process. This email is stored by Stripe and is used to verify your purchase if you need to restore access on another device.
  • Course progress - If you are signed in, we may store your module progress, quiz scores, mock exam attempts, and flashcard state so your course can sync across devices.
  • Email address for access restoration— If you voluntarily enter your email on the "Restore Access" form, it is sent to our server solely to verify your purchase with Stripe. We do not store this email.
  • Email address for printable resources - If you request a free printable resource, we store your email address, the requested resource, source page, and delivery status so we can send what you asked for. A separate optional checkbox records consent for occasional learning tips and course updates.
  • Page issue reports - If you report a factual, wording, technical, or accessibility issue, we store the page, report category, your message, basic browser context, and your account ID if signed in. An optional reply email is used only to follow up on that report and is never added to marketing.
  • IP address and server logs — Our hosting provider (Vercel) automatically collects IP addresses and basic request data in server logs for security and operational purposes. These are retained for up to 30 days.
  • First-party usage analytics - Aggregated site usage such as page path, course/site, referrer or campaign source, device type, browser family, country code, bot classification, and interaction events. We do not store raw IP addresses or raw analytics session identifiers in the analytics table; visitor counts use a daily one-way hash derived from request data and session identifiers are one-way hashed.
  • Optional Marine Radio live-role-play audio - If you deliberately enable live role-play, grant microphone access, hold push-to-talk, and release it to send, that short recording is transferred to ElevenLabs so it can return a speech transcript. Compass Revision uses the transcript to assess the authored training scenario. If fixed rules cannot confidently interpret the wording, the transcript, but not the recording, may also be sent through Vercel AI Gateway to OpenAI for tightly constrained semantic classification. Those requests prohibit prompt training. Provider-side handling and retention remain governed by Vercel and OpenAI terms unless zero-data-retention routing is enabled; when that stricter mode is enabled but unavailable, the fixed-rule result is used instead. Our application does not save the recording or transcript to its database, analytics, or application logs.

Data we do NOT collect

  • We do not load Google Analytics or advertising measurement tags unless you choose "Accept analytics" on our cookie banner.
  • We do not require your postal address, phone number, or demographic information to use the Service.
  • We do not store your payment card details — these are handled entirely by Stripe.
  • We do not track your browsing behaviour across other websites.
  • We do not store Marine Radio live-role-play recordings or transcripts in Compass Revision accounts, course progress, or analytics.

3. Local Storage

The Service stores certain data locally in your web browser using the browser's localStorage feature. It includes:

  • Your access/unlock status for the course website you are using
  • Quiz scores and progress data
  • Flashcard review history and spaced repetition state
  • Mock exam score history
  • Your theme preference (light/dark/system)
  • Your cookie consent choice (essential only vs analytics), stored as a preference string

Some of this local data may be sent to our servers if you sign in and choose to sync or import progress. You can clear local data at any time through your browser settings. Clearing it will not affect your payment status, which can be restored using your checkout email.

4. Cookies and similar technologies

When you sign in, our authentication provider may set strictly necessary session cookies on the course domain you are using. If you choose Accept analytics on the cookie banner, we load Google Analytics 4(Google Ireland Limited) using Google's Consent Mode v2. In that case Google may set analytics-related cookies and process online identifiers (such as cookie IDs and IP addresses) to generate aggregated usage statistics. You can withdraw analytics consent at any time using the button below, which clears your saved choice and reloads the page so the banner appears again.

If you choose Essential only, we do not load Google Analytics on your device.

We also use first-party, cookie-free usage analytics for aggregate operational reporting across the Compass Revision Network. This helps us understand active visitors, bots, popular pages, course interest, sign-up routes, learning progress, and conversion signals without sharing that data with Google. A short-lived identifier in sessionStorage separates sessions and expires after 30 minutes of inactivity.

Third-party services (Stripe) may set cookies on their own domains during the checkout process — please refer to Stripe's Privacy Policy for details.

5. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we process personal data on the following lawful bases:

  • Contract performance (Article 6(1)(b)) — Processing your account, progress, and checkout data is necessary to fulfil your purchase and provide access to the Service.
  • Legitimate interests (Article 6(1)(f)) — Server logs, IP addresses, and first-party usage analytics are processed for security, fraud prevention, service improvement, and operational stability. We have assessed that this processing does not override your rights and freedoms given the minimal and non-sensitive nature of the data.
  • Consent (Article 6(1)(a)) — Where you choose Accept analytics, we process data collected via Google Analytics on the basis of your consent. You may withdraw consent at any time (see section 4); withdrawal does not affect the lawfulness of processing before withdrawal.
  • Legitimate interests / requested service - Where you ask us to email a printable, we use the address to deliver that resource and record whether delivery succeeded.
  • Contract performance / requested service - When an entitled learner chooses live Marine Radio role-play, processing the submitted audio is necessary to provide the requested transcription and deterministic training response. Microphone use is optional and begins only after the learner enables the mode.
  • Consent (Article 6(1)(a)) - We send occasional Compass Revision learning tips and course updates only when you select the separate optional marketing checkbox. Every opted-in resource email includes an unsubscribe link, and we retain a suppression record so the address is not added back accidentally.

6. Third-Party Services

The Service uses the following third-party providers who may process personal data on our behalf:

  • Stripe (payment processing) — Handles all payment transactions. Stripe is certified to PCI Service Provider Level 1, the highest level of certification in the payments industry. Stripe Privacy Policy
  • Vercel (hosting and optional AI Gateway) — Hosts the Service and routes a limited Marine Radio transcript classification request only when fixed rules are uncertain. Vercel Privacy Policy
  • Google (authentication if you choose Google sign-in, and analytics if you opt in) - Google OAuth and Google Analytics 4. Google Privacy Policy
  • Resend (email delivery and opted-in contact management) - Sends requested resources and service messages, and synchronises the subscription status of contacts who separately opt into marketing updates. Resend Privacy Policy
  • ElevenLabs(optional speech transcription) - Processes each deliberately submitted Marine Radio role-play recording to return text. Provider retention and handling are governed by ElevenLabs' terms and privacy policy. ElevenLabs Privacy Policy
  • OpenAI (optional semantic classification) - May receive the text transcript, never the microphone recording, for one constrained classification request. Prompt training is prohibited, while provider handling and retention terms apply unless zero-data-retention routing is enabled. No generated station reply or open-ended agent is used. OpenAI Privacy Policy

7. Data Retention

  • Account and progress records - Retained while your account remains active or while needed to provide access, support, fraud prevention, or legal compliance.
  • Payment records — Stripe retains payment data in accordance with their own retention policy and applicable financial regulations.
  • Server logs — Retained by Vercel for up to 30 days.
  • Restore access emails — Not stored. Used only in-memory during the verification request and then discarded.
  • Printable resource requests - Retained while the delivery record is needed for support and operational reporting. Marketing consent and unsubscribe suppression records are kept separately; suppression is retained so we can honour the opt-out.
  • Page issue reports - Retained while needed to investigate the report, document the review decision, prevent repeat errors, and provide support follow-up where requested.
  • Marine Radio live-role-play audio and transcripts - Not retained in Compass Revision storage. They are held only in memory for the active request or browser session; ElevenLabs may retain provider-side audio or transcript data under its own current retention policy. Optional AI classification is requested through Vercel AI Gateway with prompt training prohibited; Vercel/OpenAI handling and retention terms apply unless zero-data-retention routing is enabled for the request.

8. Your Rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

  • Right of access — You can request a copy of any personal data we hold about you.
  • Right to rectification — You can ask us to correct inaccurate personal data.
  • Right to erasure — You can ask us to delete your personal data where there is no compelling reason to continue processing it.
  • Right to data portability — You can request your data in a structured, machine-readable format.
  • Right to object — You can object to processing based on legitimate interests.
  • Right to complain— You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us at support@compassrevision.com. We will respond within one month.

9. International Transfers

Stripe, Vercel, Google, Resend, ElevenLabs, and OpenAI may process data outside the United Kingdom. These providers maintain appropriate safeguards for international data transfers in compliance with UK GDPR requirements, including Standard Contractual Clauses and adequacy decisions where applicable.

10. Children

The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child under 13 has provided us with personal data, please contact us and we will take steps to delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. The "last updated" date at the top of this page will be revised accordingly. We encourage you to review this page periodically.

12. Contact

If you have any questions about this privacy policy or how we handle your data, please contact us at support@compassrevision.com.

Compass Revision
6 Farm Lane, Send, Woking, Surrey, GU23 7AT
United Kingdom

Read our Terms & Conditions →