Privacy Policy

Compair AI Limited. 9 September 2026.

This page is for people who use Compair.

If a council published your name in its spending or contract data, this is not your page. Yours is the data transparency statement, and its first screen is how to get your name taken out.

Who we are

Compair AI Limited, registered in England and Wales, company number 16732731, registered office Apartment 205, 2 Wollstonecraft Street, London N1C 4BT. Registered with the Information Commissioner’s Office, reference ZC211347. Our director, Jordan Ismain, is responsible for data protection.

Write to privacy@compairai.com about your data or a complaint, security@compairai.com about a vulnerability, support@compairai.com about anything else, or call +44 20 4600 6150.

English councils publish their own spending. We collect it, standardise it and present it back for comparison. We sell the comparison, not the data.

What we hold about you

When you sign in we hold your email address, your display name, an identifier from your sign-in, the organisation your email domain puts you in, and the date you last signed in. Your profile has six optional boxes, all blank unless you fill them in: name, organisation, job title, kind of organisation, what you want from Compair, and whether you want occasional updates.

If you ask for an invoice or send a purchase order, we keep what you sent. If you buy a licence we keep the subscription record and the payments behind it. We keep a record of each sign-in. We do not keep a record of which pages you open. Fifty rows written by an older version still carry a page address, and we are clearing them.

No password of yours exists in our system. Microsoft handles signing in and we never see a sign-in credential. While Compair is a private preview it also sits behind one shared word, given to everyone we let in. It identifies nobody and we keep no record of who typed it.

We never see, handle or store a card number. Payment happens on Stripe’s own pages.

Who can see it

Everyone in your organisation can see the name, email address and last sign-in date of everyone else in it. If that matters to you, read that sentence twice. Anyone who signs in with an email address at your domain joins your organisation and gets your licence, with no invitation step.

Only your billing owner, and us, can open the billing portal, change the card, read the invoices or cancel.

We see accounts, profiles, invoice requests and sign-in records for support. We never sell personal data or share it for advertising.

Why we may hold it

What we hold it for: Your account, and what your licence opens. Our lawful basis: Our contract with you
What we hold it for: Payment, invoices and tax records. Our lawful basis: Our contract, and tax law
What we hold it for: Sign-in records, support, knowing who uses the product. Our lawful basis: Legitimate interests: running the service we sell
What we hold it for: Occasional updates by email. Our lawful basis: Your consent, and only that
What we hold it for: Names inside council spending data. Our lawful basis: Legitimate interests, weighed in the data transparency statement

No decision about you is automated, apart from which organisation your email domain puts you in.

Cookies

We set four: one for the preview password, one for the part of the product you were last in, one for the council you chose, and one that lets our staff preview another licence level. Signing in sets a few of its own, all necessary. The product loads no analytics, no tag manager, no advertising pixel and no third-party script, so nothing here needs a cookie banner.

Who else handles it

We name every one below. One more sits on this marketing site rather than in the product: our website builder loads a small stylesheet from unpkg, a public code library, which means unpkg sees the address of the device that asked for it. It sets no cookie and receives nothing else. We are removing it.

1. Microsoft runs the application, the account database, the sign-in directory, our storage and our logs.
2. Stripe takes payment, and sees your email address, organisation, billing address and card.
3. Framer hosts our marketing site, and sees every visitor’s IP address, browser and page. Its analytics sets no cookies and no account data reaches it.
4. Google Workspace runs our email, so anything you send us passes through Google.
5. GitHub holds our source code and Anthropic supplies the AI assistant we build with. Neither holds account data, and nothing you do in the product is sent to an AI service.

Three exceptions and nothing else: where the law requires it, our own professional advisers under a duty of confidence, and a buyer if the business is sold. If we add or replace one of them we publish it here 30 days beforehand and email you. You can object, and if we cannot meet the objection you can cancel and we refund the unused part of your licence.

Where it is held

Everything the product serves is held in Microsoft’s UK South region. Two things leave the United Kingdom: your sign-in identity, which sits in Microsoft’s European data location, and payment data, which Stripe handles outside the United Kingdom. Both run under the standard contractual clauses and the UK addendum.

How long we keep it

What: Account and profile. How long: While the account exists, and 12 months after your last sign-in
What: Sign-in records. How long: 12 months
What: Invoice and purchase order requests. How long: 24 months from the last contact
What: Billing and tax records. How long: 6 years, because tax and company law require it
What: Server logs. How long: 30 days
What: Database backups. How long: 7 days

Nothing is deleted on a timer: a person does it, on request, within a month of you asking at privacy@compairai.com. Tax records are the one thing we cannot delete on request. If your organisation stops paying, nothing is deleted: your account drops to the free level and you can come back.

Your rights

You can ask for a copy of what we hold about you, have it corrected or deleted, have us stop while a question is settled, have the data you gave us in a portable form, and object to anything we do on the basis of legitimate interests. You can withdraw consent to email updates at any time.

Write to privacy@compairai.com. We reply within 5 working days and answer within one month, with no fee. If you are unhappy, tell us and we will investigate. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, and you do not have to come to us first.

Security

Everything runs over HTTPS, and what your licence opens is decided on our servers, not in your browser. We hold no security certification and have commissioned no penetration test. If you need more assurance before you buy, ask and we will answer precisely.

If personal data we hold is lost or reached without authorisation, we tell the Information Commissioner’s Office within 72 hours where the law requires, and the people affected without delay. Report a flaw to security@compairai.com and we reply in 2 working days.

Changes

Each version of this page is published here with its date, and we email you before a significant change. The other two pages are the data transparency statement and the terms of service.