Privacy notice

Last updated 3 August 2026

1. Who we are

SERPCompass is a search intelligence product operated by FlowDesk ("we", "us"). This notice explains what personal data we handle when you use the SERPCompass website and application, and what rights you have over it.

For data you provide directly, we are the data controller. For data inside your workspace that concerns your own customers or website visitors, you are the controller and we act as a processor on your instructions.

2. What we collect

Information you give us

• Account details — name, email address, password (stored only as a cryptographic hash, never in readable form), and your organisation name.
• Contact messages — what you send us through the contact form, including your name, email and message, so we can reply.
• Billing details — if you subscribe to a paid plan. Card details are handled by our payment processor and never reach our servers.

Information from services you connect

• Search and analytics performance data for properties you choose to connect, pulled with read-only permission. See section 5.

Information we generate

• Analysis output — crawl results, reports, keyword studies, rank history and the evidence trail behind each finding.
• Usage and diagnostic data — which features were used, when jobs ran, and error information, so we can keep the service working.

3. Why we use it, and our legal basis

We do not sell personal data, we do not use it for advertising, and we do not profile you for marketing purposes.

4. Compass Intelligence narratives

Some of what you see in your workspace — a plain-language explanation of a finding, or a suggested next step — is written by a feature we call Compass Intelligence. This is the one place a data flow leaves our infrastructure to reach a language model, so we're specific about it here rather than folding it into a general clause.

• The narrative text is generated from the structured findings your account already displays (a title, a count, a metric) by a third-party language-model provider, Anthropic PBC (USA). Anthropic is listed on our subprocessor list.
• We send that provider no page HTML, no credentials, no user-level analytics and no other personal data — only the structured findings your account already shows you.
• The provider does not train its models on this data, and deletes the content of each request within 30 days (or within 29 days for requests processed as an asynchronous batch job), except where its own safety systems flag content for longer retention or the law requires it.
• The narrative text that comes back is stored as your account's own data, on our infrastructure, and is deleted when your account is deleted.
• Requests are routed to the provider's infrastructure globally by default. If your workspace needs requests kept to US-only routing, ask us and we'll turn that on for you.

5. Google account data

If you connect Google Search Console or Google Analytics, we request read-only permission. We cannot modify, submit or delete anything in your Google properties, because we never request the permission that would allow it.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we use this data only to provide and improve the features you connected it for. We do not transfer it to others except as needed to provide the service, for security purposes, or to comply with applicable law. We do not use it for advertising, and we do not allow humans to read it except where you explicitly ask us for support, where required by law, or for security investigation. It is never sent to the language-model provider in section 4.

You can disconnect at any time from within SERPCompass, or revoke access directly in your Google account permissions. Either method takes effect immediately and we delete the stored tokens. Full technical detail is on our security page.

6. Who we share it with

We share personal data only with service providers who help us run SERPCompass, and only to the extent they need it:

• Hosting and infrastructure — to run the application and store your data.
• The narrative provider — described in section 4, and only the structured findings it needs to write a narrative.
• Payment processing — to take payment for paid plans. They receive your billing details directly; we receive only a confirmation and a customer reference.
• Email delivery — to send account and transactional messages.

We may also disclose data if legally required, or to protect our rights or the safety of users. If we are ever involved in a merger or acquisition, we'll tell you before your data becomes subject to a different privacy notice.

We never share your workspace data with other customers, and we don't use it to build products for anyone else.

7. How long we keep it

• Account and workspace data — while your account is open. Historical data is retained because trend analysis depends on it.
• Connection tokens — until you disconnect, at which point they're deleted.
• Contact messages — up to two years, so we have context if you write again.
• Billing records — as long as tax and accounting law requires.

Ask us to delete your account and we'll delete the workspace and its stored data, then confirm when it's done.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct data that's inaccurate or incomplete
• Delete your data ("right to be forgotten")
• Receive your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing relies on it
• Complain to your local data protection authority

To exercise any of these, contact us. We won't charge you for it and we won't make it difficult.

9. Cookies

We keep this deliberately minimal. SERPCompass uses cookies that are strictly necessary to operate:

• Session cookie — keeps you logged in.
• Security cookie — protects forms against cross-site request forgery.

We do not use advertising cookies or third-party tracking pixels, which is why you aren't reading this through a consent banner.

10. International transfers

Our service providers, including the narrative provider in section 4, may process data in countries other than yours. Where data leaves its country of origin, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

11. Children

SERPCompass is a business tool and is not directed at anyone under 16. We don't knowingly collect data from children. If you believe a child has provided us data, tell us and we'll delete it.

12. Changes to this notice

If we make a material change we'll update the date at the top and notify account holders by email. Continuing to use SERPCompass after a change means the updated notice applies.

13. Contact

Questions about this notice, or about your data, go to our contact page, choose the privacy topic and it routes straight to the right person. Postal address: available on request via our contact page.