Privacy Policy

1. What we collect

Your account. Your name and email address, and - if you sign in with Google or Microsoft - the account identifier that provider gives us. If you sign in with a password, we store a hash of it, never the password itself.

Your firm. Firm name, website, location and logo, plus which people belong to it.

Your listings. Everything you enter about a business you are selling: description, industry, location, asking price, revenue, expenses, add-backs, answers to Compa’s questions, and the reports built from them.

Documents you upload. Financial statements, tax returns and similar material, and the figures we extract from them.

Usage data. Page views and basic technical information, through Vercel Analytics. Our server logs record errors, including what an external provider said when a sign-in fails.

Most of this is not personal data about you. It is confidential commercial information about your client’s business, which is why the rest of this document is about who can reach it.

2. How we use it

To run Compa for you: to authenticate you, to keep your firm’s data separate from every other firm’s, to normalize financials, to produce valuation ranges and reports, and to fix things when they break.

We do not sell your data. We do not use your content, or your clients’, to train machine-learning models. We do not run advertising.

3. Who else processes it

Compa is built on other companies’ infrastructure. Each of these can technically access the data described, under contract with us and only to provide their service:

• Supabase - the database, file storage and authentication. Effectively everything is stored here.
• Vercel - hosting and Vercel Analytics. Requests pass through it, and it holds usage analytics and server logs.
• Anthropic, via the Vercel AI Gateway - when you upload a document, its contents may be sent to a large language model to extract the figures. This is the one place your client’s financial statements leave our own infrastructure as content rather than as storage.
• Firecrawl - when you ask Compa to read a business’s website, we send that URL to Firecrawl to fetch and parse the page.
• Google Maps Platform - location suggestions. What you type in a location field is sent to Google to return matches.
• Google and Microsoft - if you sign in with one of them, that provider confirms your identity and returns your name and email address.

We may also disclose data where the law requires it, or to protect Compa’s or someone’s rights and safety. If Compa is ever acquired, data may transfer as part of that transaction; we would tell you first.

4. How it is protected

Every table in Compa is protected by row-level security keyed to your firm, enforced by the database rather than by application code - the check does not depend on our getting an if statement right in a new feature.

Uploaded documents live in a private bucket that serves nothing publicly. Downloads go through short-lived signed links. Traffic is encrypted in transit, and our infrastructure providers encrypt data at rest.

No system is perfectly secure, and we will not claim otherwise. Compa is early software, and you should weigh that alongside the sensitivity of what you upload.

5. How long we keep it

As long as your account is open. Delete a listing or a document and it goes; ask us to delete your account and we remove your data from our live systems, with backups aging out afterwards. We may keep records we are legally required to keep.

6. Your choices

You can see and edit your account, firm and listing data in the product at any time. To get a copy of your data, or to have it deleted, write to us at the address below.

Depending on where you live you may have additional rights - to access, correct, delete or port your data, or to object to some processing. We honour those requests regardless of whether a particular law happens to cover you, and we will not discriminate against you for making one.

7. Where we operate

Compa is built for US small-business brokers and its infrastructure is operated in the United States. If you use it from elsewhere, your data will be processed in the US.

8. Changes

We may update this policy. If a change materially affects how we handle your data, we will make it visible in the product rather than only changing the date at the top of this page.

9. Contact

Privacy questions, data requests and deletion requests: privacy@mycompa.ai.