Privacy Policy

Last updated: 12 August 2026

1. Data Controller

This privacy policy applies to the course websites and branded domains listed below, together referred to as the "Service":

The data controller for the Service is:

Compass Revision
6 Farm Lane, Send, Woking, Surrey, GU23 7AT
United Kingdom
support@compassrevision.com

2. What Data We Collect

We collect only the personal data needed to provide course access, account sync, payments, support, security, and optional analytics. You can browse free course content without creating an account.

Data we process

  • Account data - If you create an account or sign in, we process your email address, optional name, authentication provider details, and any profile image supplied by that provider. If you use Google sign-in, Google verifies your email address and returns basic profile details to us.
  • Email address at checkout — When you purchase full access, Stripe collects your email address as part of the payment process. This email is stored by Stripe and is used to verify your purchase if you need to restore access on another device.
  • Course progress - If you are signed in, we may store your module progress, quiz scores, mock exam attempts, and flashcard state so your course can sync across devices. If you choose to record whether a saved exam or course date went to plan, we store that self-reported outcome with the course and date; it is not treated as an official result or certificate.
  • Email address for access restoration— If you voluntarily enter your email on the "Restore Access" form, it is sent to our server solely to verify your purchase with Stripe. We do not store this email.
  • Email address for printable resources - If you request a free printable resource, we store your email address, the requested resource, source page, and delivery status so we can send what you asked for. A separate optional checkbox records consent for occasional learning tips and course updates.
  • Practical training requests - If you ask for manually curated training options, we store your email address, optional name, postcode, course type, preferred month and format, travel radius, accommodation preference, budget band, source page, request status, and our operational notes. These details are used only to research and reply to that request and are not added to marketing consent records.
  • Compass Passport and journey services - If you sign in and use Passport, we store the goals, self-declared qualifications and dates, experience summary, saved versioned plans, training organisations, course dates, searches, and granular service-alert preferences you choose. We do not ask for or store certificate scans. You may export this data as JSON or delete the Passport records without deleting course access or revision progress.
  • Location for training search - A full postcode is geocoded transiently on the server to find nearby results and is not written to analytics. If you explicitly save a journey profile, we retain only the outward postcode or town and a rounded centroid. Training organisation locations are public business facts.
  • Training partner and referral operations - Training partner applications, work-email verification, profile claims, memberships, team invitations, submitted profile, location, course, event and media updates, imports, service API keys, scheduled feed URLs and any bearer credential encrypted at rest, moderation decisions, seat invitations, and separately consented cohort summaries are stored for operating and auditing the service. Training partner application postcodes are geocoded to the business location used in the public profile; training organisation locations are not treated as learner location data. Referral records contain an allowlisted target, placement, timestamps and any training-organisation-confirmed outcome; they avoid unnecessary learner details.
  • Page issue reports - If you report a factual, wording, technical, or accessibility issue, we store the page, report category, your message, basic browser context, and your account ID if signed in. An optional reply email is used only to follow up on that report and is never added to marketing.
  • Learner feedback and reviews - Private feedback may include an optional enjoyment rating, category, what worked, what should improve, page and course context, account ID when signed in, and a reply address only if you permit follow-up. A review additionally stores a rating, your chosen public display name, review text, course-specific product-use verification, publication permission and the Admin moderation history. No review is public automatically, and Admin cannot rewrite it.
  • IP address and server logs — Our hosting provider (Vercel) automatically collects IP addresses and basic request data in server logs for security and operational purposes. These are retained for up to 30 days.
  • First-party usage analytics - Aggregated site usage such as page path, course/site, referrer or campaign source, device type, browser family, country code, bot classification, and interaction events. We do not store raw IP addresses or raw analytics session identifiers in the analytics table; visitor counts use a daily one-way hash derived from request data and session identifiers are one-way hashed. We may turn sufficiently large totals into delayed, rounded product-activity signals. Network learner counts include only distinct signed-in accounts; question and module signals use browser-first first-attempt totals. Minimum thresholds prevent us from exposing identities, exact sample sizes, or low-volume figures.
  • Optional Marine Radio live-role-play audio - If you deliberately enable live role-play, grant microphone access, hold push-to-talk, and release it to send, that short recording is transferred to ElevenLabs so it can return a speech transcript. Compass Revision uses the transcript to assess the authored training scenario. If fixed rules cannot confidently interpret the wording, the transcript, but not the recording, may also be sent through Vercel AI Gateway to OpenAI for tightly constrained semantic classification. Those requests prohibit prompt training. Provider-side handling and retention remain governed by Vercel and OpenAI terms unless zero-data-retention routing is enabled; when that stricter mode is enabled but unavailable, the fixed-rule result is used instead. Our application does not save the recording or transcript to its database, analytics, or application logs.

Data we do NOT collect

  • We do not load Google Analytics or advertising measurement tags unless you choose "Accept analytics" on our cookie banner.
  • We do not require your full postal address, phone number, or demographic information to use the Service.
  • We do not store your payment card details — these are handled entirely by Stripe.
  • We do not track your browsing behaviour across other websites.
  • We do not store Marine Radio live-role-play recordings or transcripts in Compass Revision accounts, course progress, or analytics.

3. Local Storage

The Service stores certain data locally in your web browser using the browser's localStorage feature. It includes:

  • Your access/unlock status for the course website you are using
  • Quiz scores and progress data
  • Flashcard review history and spaced repetition state
  • Mock exam score history
  • Pending signed-in progress, flashcard, and mock-exam updates that are waiting to sync, partitioned by account and removed on sign-out
  • We do not store sailing qualification certificate scans.
  • We do not put postcodes, coordinates, qualifications, experience, or training-organisation free text into analytics properties.
  • Audio playback position, completion state, and listening history
  • Course-scoped Audio Challenge resumption, seen prompts, mastery, and missed-question review state
  • Optional saved exam/course dates and self-reported course outcomes
  • Your theme preference (light/dark/system)
  • Your cookie consent choice (essential only vs analytics), stored as a preference string

Signed-in progress is sent to our servers automatically. If a connection fails, eligible updates remain on this device and retry after reconnection. You can clear local data at any time through your browser settings. Clearing it will not affect your payment status, which can be restored using your checkout email.

An installable service worker stores the app's offline fallback, essential visual assets, and lesson or flashcard pages you have already visited. Study-page caches are cleared when the signed-in account changes or signs out. Audio, API responses, account pages, checkout, downloads, and unvisited pages are not stored for offline use.

4. Cookies and similar technologies

When you sign in, our authentication provider may set strictly necessary session cookies on the course domain you are using. If you choose Accept analytics on the cookie banner, we load Google Analytics 4(Google Ireland Limited) using Google's Consent Mode v2. In that case Google may set analytics-related cookies and process online identifiers (such as cookie IDs and IP addresses) to generate aggregated usage statistics. You can withdraw analytics consent at any time using the button below, which clears your saved choice and reloads the page so the banner appears again.

If you choose Essential only, we do not load Google Analytics on your device.

We also use first-party, cookie-free usage analytics for aggregate operational reporting across the Compass Revision Network. This helps us understand active visitors, bots, popular pages, course interest, sign-up routes, learning progress, and conversion signals without sharing that data with Google. A short-lived identifier in sessionStorage separates sessions and expires after 30 minutes of inactivity. Audio Challenge analytics record course/module context, prompt type, correctness, bounded replay and transcript-assist signals, and rounded duration; they never contain answer text, transcripts, audio, email addresses, or microphone data.

Third-party services (Stripe) may set cookies on their own domains during the checkout process — please refer to Stripe's Privacy Policy for details.

5. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we process personal data on the following lawful bases:

  • Contract performance (Article 6(1)(b)) — Processing your account, progress, and checkout data is necessary to fulfil your purchase and provide access to the Service.
  • Legitimate interests (Article 6(1)(f)) — Server logs, IP addresses, and first-party usage analytics are processed for security, fraud prevention, service improvement, and operational stability. We have assessed that this processing does not override your rights and freedoms given the minimal and non-sensitive nature of the data.
  • Consent (Article 6(1)(a)) — Where you choose Accept analytics, we process data collected via Google Analytics on the basis of your consent. You may withdraw consent at any time (see section 4); withdrawal does not affect the lawfulness of processing before withdrawal.
  • Legitimate interests / requested service - Where you ask us to email a printable, we use the address to deliver that resource and record whether delivery succeeded.
  • Legitimate interests / requested service - Where you ask for practical training options, we use the details you provide to research suitable training organisations, send the requested reply, and measure whether the pilot is useful. This request is separate from marketing consent.
  • Contract performance / requested service - When an entitled learner chooses live Marine Radio role-play, processing the submitted audio is necessary to provide the requested transcription and deterministic training response. Microphone use is optional and begins only after the learner enables the mode.
  • Legitimate interests and consent- We use voluntarily submitted private feedback to improve the Service. We publish a learner review only with the learner's explicit permission after verifying course activity and completing human moderation. Permission to publish is separate from permission to contact the learner and from marketing consent.
  • Consent (Article 6(1)(a)) - We send occasional Compass Revision learning tips and course updates only when you select the separate optional marketing checkbox. Every opted-in resource email includes an unsubscribe link, and we retain a suppression record so the address is not added back accidentally.

6. Third-Party Services

The Service uses the following third-party providers who may process personal data on our behalf:

  • Stripe (payment processing) — Handles all payment transactions. Stripe is certified to PCI Service Provider Level 1, the highest level of certification in the payments industry. Stripe Privacy Policy
  • Vercel (hosting and optional AI Gateway) — Hosts the Service and routes a limited Marine Radio transcript classification request only when fixed rules are uncertain. Vercel Privacy Policy
  • Google (authentication if you choose Google sign-in, and analytics if you opt in) - Google OAuth and Google Analytics 4. Google Privacy Policy
  • Resend(email delivery) - Sends requested resources and service messages. Marketing consent and unsubscribe status remain in Compass Revision's database and are not synchronised to Resend Contacts. Signed delivery events record operational status without retaining subjects, open IPs, or clicked URLs in Compass Revision's delivery log; permanent bounces and complaints create a separate technical suppression. Resend Privacy Policy
  • ElevenLabs(optional speech transcription) - Processes each deliberately submitted Marine Radio role-play recording to return text. Provider retention and handling are governed by ElevenLabs' terms and privacy policy. ElevenLabs Privacy Policy
  • OpenAI (optional semantic classification) - May receive the text transcript, never the microphone recording, for one constrained classification request. Prompt training is prohibited, while provider handling and retention terms apply unless zero-data-retention routing is enabled. No generated station reply or open-ended agent is used. OpenAI Privacy Policy

7. Data Retention

  • Account and progress records - Retained while your account remains active or while needed to provide access, support, fraud prevention, or legal compliance.
  • Payment records — Stripe retains payment data in accordance with their own retention policy and applicable financial regulations.
  • Server logs — Retained by Vercel for up to 30 days.
  • Restore access emails — Not stored. Used only in-memory during the verification request and then discarded.
  • Printable resource requests - Retained while the delivery record is needed for support and operational reporting. Marketing consent and unsubscribe suppression records are kept separately; suppression is retained so we can honour the opt-out.
  • Practical training requests - Retained while the pilot is active and while needed to fulfil, audit, or follow up the requested service. Closed requests are reviewed for deletion or anonymisation when they are no longer operationally useful.
  • Page issue reports - Retained while needed to investigate the report, document the review decision, prevent repeat errors, and provide support follow-up where requested.
  • Learner feedback, reviews and moderation records - Retained while useful for product improvement, publication, support, authenticity and decision audit. We review private contact details and old unpublished material for deletion or anonymisation when no longer needed. An unpublished review may retain a minimal moderation record where needed to evidence the decision and prevent accidental republication.
  • Marine Radio live-role-play audio and transcripts - Not retained in Compass Revision storage. They are held only in memory for the active request or browser session; ElevenLabs may retain provider-side audio or transcript data under its own current retention policy. Optional AI classification is requested through Vercel AI Gateway with prompt training prohibited; Vercel/OpenAI handling and retention terms apply unless zero-data-retention routing is enabled for the request.

8. Your Rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

  • Right of access — You can request a copy of any personal data we hold about you.
  • Right to rectification — You can ask us to correct inaccurate personal data.
  • Right to erasure — You can ask us to delete your personal data where there is no compelling reason to continue processing it.
  • Right to data portability — You can request your data in a structured, machine-readable format.
  • Right to object — You can object to processing based on legitimate interests.
  • Right to complain— You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us at support@compassrevision.com. You may also ask us to unpublish a review at any time. We will respond within one month.

9. International Transfers

Stripe, Vercel, Google, Resend, ElevenLabs, and OpenAI may process data outside the United Kingdom. These providers maintain appropriate safeguards for international data transfers in compliance with UK GDPR requirements, including Standard Contractual Clauses and adequacy decisions where applicable.

10. Children

The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child under 13 has provided us with personal data, please contact us and we will take steps to delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. The "last updated" date at the top of this page will be revised accordingly. We encourage you to review this page periodically.

12. Contact

If you have any questions about this privacy policy or how we handle your data, please contact us at support@compassrevision.com.

Compass Revision
6 Farm Lane, Send, Woking, Surrey, GU23 7AT
United Kingdom

Read our Terms & Conditions →