Legal

Privacy Policy

Last updated: July 8, 2026

Plain-language summary: Compound reads your Google Analytics and Microsoft Clarity data to identify conversion opportunities on your site. We never sell your data, never share your experiment results with other clients, and never use your analytics to train AI models. You can disconnect your integrations or delete your account at any time.

1. Who we are

Compound is operated by Northpeak LLC ("Northpeak," "we," "us," "our"). Northpeak's registered address is in Ohio, United States. You can reach us at hello@northpeak.io.

2. What data we collect

Account data

When you sign up, we collect your email address, name, and organization name. This is used to authenticate you and send service-related communications.

Site data

You provide your website URL during onboarding. We use it to run an automated audit of your site's conversion opportunities.

Google Analytics data (via OAuth)

If you connect Google Analytics, we request read-only access to your GA4 property using the analytics.readonly scope. This lets us read aggregate metrics — sessions, conversion rates, bounce rates — for your site. We store your OAuth refresh token in encrypted form so we can pull updated data on your behalf. We do not access individual visitor data or personally identifiable information from your GA4 account.

Microsoft Clarity data (via API key)

If you connect Clarity, we store your API token and project ID to retrieve session recording and heatmap summaries. As with GA4, we access aggregate behavioral data, not individual visitor records.

Usage data

We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This helps us diagnose errors and improve the service.

3. How we use your data

  • To generate your site audit and identify conversion opportunities
  • To surface experiment ideas ranked by projected revenue impact
  • To display analytics trends in your Compound dashboard
  • To send you results, recommendations, and service updates
  • To process payments (via Stripe — we do not store card data)
  • To troubleshoot errors and maintain service reliability

We do not use your analytics data to train machine learning models. We do not share your experiment results, site performance data, or conversion rates with other Compound clients or third parties.

4. Data isolation and security

All data is scoped to your organization. Your site's analytics, experiment results, and conversion data are never accessible to other Compound accounts. OAuth credentials and API tokens are stored encrypted at rest. Data in transit is encrypted via TLS.

We operate on a principle we call alpha protection: the specific insights derived from your site are yours alone. Compound does not aggregate learnings across clients or use one client's conversion data to inform another client's recommendations.

5. Data sharing

We share data only with the following categories of service providers, and only as necessary to deliver the service:

  • Supabase — database hosting (US region)
  • Railway — API server hosting (US region)
  • Vercel — frontend hosting
  • Clerk — user authentication
  • Stripe — payment processing
  • Resend — transactional email delivery
  • Google — OAuth authentication and Analytics API access

We do not sell personal data. We do not share data with advertisers or data brokers.

6. Data retention

We retain your account and analytics data for as long as your account is active. If you cancel your account, we delete your data within 30 days, except where we are required to retain it for legal or financial compliance purposes (e.g., payment records, which are retained for 7 years).

You can disconnect any integration (GA4, Clarity) at any time from your dashboard. Disconnecting removes the stored credentials immediately.

7. Your rights

Depending on where you are located, you may have rights including:

  • Access to the personal data we hold about you
  • Correction of inaccurate data
  • Deletion of your data ("right to be forgotten")
  • Portability of your data in machine-readable format
  • Objection to or restriction of certain processing

To exercise any of these rights, email privacy@northpeak.io. We will respond within 30 days.

8. Cookies

We use cookies for authentication (session management via Clerk) and to remember your preferences. We do not use third-party advertising cookies. You can clear cookies in your browser at any time; this will sign you out of your Compound account.

9. Children's privacy

Compound is a business tool not intended for use by anyone under 18. We do not knowingly collect data from minors.

10. Changes to this policy

If we make material changes to this policy, we will notify you by email at least 14 days before the changes take effect. The "last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions about this policy or your data? Email us at hello@northpeak.io.

Northpeak LLC · Ohio, United States