GDPR and CCPA basics

This page summarizes how SOPCompass handles personal data. The privacy policy is the governing document. This page doesn’t give legal advice.

Roles

For content your organization puts into a workspace, including information about your staff, your organization decides what goes in and SOPCompass processes it to provide the service. For your own account and billing details, SOPCompass, an Ironbridge AI Advisory company, decides how they are used, as described in the privacy policy.

What personal data SOPCompass holds

• Account data: name, email address, the workspaces and roles you belong to.
• Content: SOPs, comments, assignments, quiz attempts, policy sign-offs (including the name typed when signing), AI interview transcripts, and anything else people add.
• Usage data: SOP views, searches, questions asked in Ask, and an activity feed, used for features like read tracking and Insights.
• Billing data: subscription status and the name and email entered at signup. Card details are entered on Whop and never reach SOPCompass.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict some processing. Some of this you can do in the app:

• Export: export SOPs as Word or PDF, and sign-off reports as CSV.
• Delete: delete your Ask history; editors and admins can delete content.

For anything else, including correcting your name or email and deleting your account, email support@ironbridgeaiadvisory.com from the address on the account.

CCPA and CPRA (California)

• We don’t sell personal information.
• We don’t share personal information for cross context behavioral advertising.
• You can ask what we hold about you and ask us to delete it.

GDPR (EEA, UK and Switzerland)

• Location: data is stored in the United States (Supabase, us-east-1). We don’t offer EU hosting.
• Subprocessors: listed on the subprocessors page.
• DPA: we don’t publish a standard Data Processing Agreement. Email support@ironbridgeaiadvisory.com if you need one before signing up.
• Website analytics: for visitors in the EEA, UK and Switzerland, analytics cookies on sopcompass.com are off by default, as described in the privacy policy.

Note: If your organization is subject to GDPR and needs a signed DPA, international transfer terms or EU hosting before processing staff data, contact us first. We would rather tell you up front what we can’t offer yet.