Privacy Policy

Information Compass processes

Compass processes account and contact information, project records, schedules, messages, files, photos, videos, financial workflow records, activity history, device and security information, and information users intentionally submit to project workspaces. Access is limited by role, organization, project membership, and configured project visibility.

Google and YouTube information

Authorized internal administrators may connect company-managed Google and YouTube accounts. Compass requests only the OAuth scopes displayed on Google's consent screen. For YouTube, Compass uses authorization to identify the selected company channel and upload user-selected project videos with their title, description, audience, and visibility choices.

Compass stores the connected Google account email, YouTube channel ID and title, granted scopes, connection timestamps, and an encrypted OAuth refresh token. Tokens are used server-side and are not exposed to project participants. Compass does not sell Google user data or use it for advertising, credit, or unrelated profiling.

Compass's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Review Google's own practices in the Google Privacy Policy and the Google API Services User Data Policy.

How information is used

Information is used to provide project collaboration, scheduling, communications, file and media workflows, requested integrations, notifications, security, auditing, support, and service improvement. Compass does not use YouTube API data to create independent advertising profiles or to recreate YouTube's service.

Sharing and visibility

Project information is shared only with authorized organization members, invited project participants, service providers needed to operate Compass, and integrations a permitted administrator enables. YouTube videos may be private, unlisted, or public as shown before publication. An unlisted YouTube link can be viewed and forwarded by anyone who obtains the link, even when Compass distributes it only to authorized users.

Retention, deletion, and revocation

Compass retains project information according to business, contractual, legal, and backup requirements. Google OAuth tokens and connected-channel metadata are retained only while the connection is active or as required for security records. An authorized administrator can disconnect a YouTube channel from the project-video workspace. Compass then removes the stored connection and attempts to revoke the Google token.

A Google user may also revoke Compass directly from Google Account permissions. Users may request deletion or correction through their Compass administrator. Removing a Compass connection does not automatically delete videos already published to a company YouTube channel; a channel manager can remove those videos in YouTube Studio or request assistance.

Security

Compass uses authentication, authorization checks, encrypted integration credentials, server-side token handling, activity records, and access controls designed to protect project and integration data. No system can guarantee absolute security, so suspected misuse should be reported promptly.