Legal

Privacy Policy

This policy explains how Compass Island, LLC handles personal data collected through livesop.com. It covers visitors to this website, including anyone who requests a demonstration.

1. Who we are

LiveSOP™ is a product of Compass Island, LLC. For personal data collected through this website, Compass Island, LLC is the data controller.

Compass Island, LLC
808 Lady Street, Suite D #57
Columbia, SC 29201, United States
privacy@compassisland.co

2. What this policy covers

This policy applies to livesop.com and to inquiries you send us through it.

It does not cover the operational content a customer puts into the LiveSOP application — missions, procedures, tasks, participants and similar records. For that content we generally act as a processor on the customer’s instructions, and the customer’s agreement with us governs how it is handled.

We also process a limited set of information for our own purposes: account administration, business contact details, billing information, security and service logs, and support correspondence. For that information we act as a controller, and this policy describes how we approach it.

3. What we collect

We keep this deliberately small. There is one form on the site, and it asks only what we need to answer you properly.

We do not ask for or intentionally seek to collect special category data through this website, and we do not build profiles of visitors. No decision affecting you is made by automated means. We may also hold professional contact details obtained from a conference, a referral, a public professional profile or a business development tool, for the single purpose of getting in touch about LiveSOP. Where the GDPR or UK GDPR applies and we obtained your professional contact information from another source, we provide the required privacy information within the period required by applicable law and, where we use the information to contact you, no later than our first communication with you. If you would rather we did not hold yours, tell us and we will delete them.

4. Why we use it, and our legal basis

Under the GDPR and UK GDPR we must have a legal basis for each purpose. Ours are as follows.

5. Cookies and similar technologies

This site sets no advertising cookies and runs no advertising pixels. What it uses today:

• Strictly necessary storage. A single record of your cookie choice, held in your browser so we do not ask again. It carries no identifier and is not sent to us.
• Analytics. Google Analytics 4, with your consent. The Google tag is not loaded until you accept analytics — before that, nothing is stored on your device and nothing is sent to Google. Once you accept, it records page views, referrers, approximate location from a truncated IP address, and device and browser type. Cookies _ga and _ga_<id>, kept up to 24 months. Measurement ID G-G46ELT9BEM. Google Signals, advertising features, and data sharing for advertising are off.
• Product analytics, only if you accept. Microsoft Clarity, with your consent. Clarity is not loaded until you accept analytics. Once loaded, it records clicks, scrolling, and mouse movement, and may create masked session recordings and aggregated interaction heatmaps so we can see where the site is confusing. Form inputs and other designated sensitive content are masked in accordance with our configuration and Microsoft’s masking controls, so the words you type are not captured in a recording — though the fact that you moved through the form is. Where you consent to analytics, usage information may be disclosed to Microsoft through Clarity, subject to Microsoft’s applicable privacy and data-protection terms. Cookies _clck and _clsk, kept up to 12 months.
• Third-party content that sets no cookies. The site loads its typefaces from Google Fonts, and the map on the How it works page loads the Leaflet map library from the unpkg content delivery network and map tiles from OpenStreetMap. These requests set no cookies and are not used for analytics or advertising, but delivering a font, a script or a map tile does reveal your IP address to the provider serving it. They happen whichever cookie choice you make, because the page cannot render without them.
• Neither tool is used for advertising, and we run no advertising cookies or third-party ad pixels. If you choose essential only, Clarity is never requested and Google Analytics sets no cookies and stores nothing on your device. When you accept, we pass your analytics consent to Clarity using Microsoft’s consent API; if you withdraw consent after accepting, we pass the withdrawal to both tools, stop the collection, delete both tools’ cookies from your browser and reload the page.

You can change your choice at any time using cookie settings, or by clearing site data in your browser. If your browser sends a Global Privacy Control signal, we treat it as a choice of essential only.

6. Who we share it with

We do not sell personal data, and we do not share it for advertising. We disclose it only to:

• service providers who work on our instructions under written contract, in three categories: website hosting, email and business communications, and the tools we use to track sales inquiries;
• Google, for Google Analytics, and only if you accept analytics. Google processes that data on our instructions under its data processing terms;
• Microsoft, for Microsoft Clarity, and only if you accept analytics. Usage information may be disclosed to Microsoft through Clarity subject to Microsoft’s applicable privacy and data-protection terms, which may give Microsoft its own data-protection role for some of that information;
• content delivery and mapping providers — Google Fonts, unpkg and OpenStreetMap — which receive your IP address when your browser requests a typeface, the map library or a map tile, as described in section 5;
• professional advisers, where we need legal or accounting advice;
• authorities, where the law requires it, and any acquirer if the business is sold.

Write to privacy@compassisland.co and we will tell you which providers we currently use.

7. International transfers

We are based in the United States and our infrastructure is hosted there, so information you send us is stored in the United States. Where privacy law requires a transfer mechanism for personal data leaving the EEA or the UK, we use an appropriate one, such as standard contractual clauses or a provider’s certification under a recognized transfer framework. If you want to know which mechanism applies to a particular transfer, ask us.

8. How long we keep it

• Demonstration requests and related correspondence that do not lead to a customer relationship: up to 36 months from your last contact with us, then deleted.
• Server logs: up to 12 months.
• Analytics data, where you consented: Google Analytics event data up to 14 months. Microsoft Clarity session playback data is generally retained for 30 days; certain aggregated interaction data, heatmap data, and labeled or selected sessions may be retained for up to nine months, subject to Microsoft’s then-current retention practices. Neither set is used to identify you.
• Records we must keep for tax or legal reasons: for the period the relevant law requires.

9. Security

The site is served over TLS. Access to inquiry data is limited to the people who need it to respond to you, and is protected by individual accounts and multi-factor authentication. No transmission over the internet is completely secure, so we collect as little as we can and hold it no longer than we need to.

10. Your rights in the EEA and the UK

If the GDPR or UK GDPR applies to you, you have the right to:

• ask what personal data we hold about you, and get a copy of it;
• have inaccurate data corrected, or incomplete data completed;
• have your data deleted, or its use restricted;
• object to processing we carry out on the basis of legitimate interests;
• receive the data you gave us in a portable format;
• withdraw consent at any time, where we rely on consent.

Email privacy@compassisland.co. We answer within one month, and will tell you if we need longer. Exercising these rights is free, and we will not treat you differently for doing so. We may ask for enough information to confirm who you are before we act.

11. California privacy rights

If the CCPA, as amended by the CPRA, applies to us, California residents may ask us to disclose the personal information we have collected about them, to correct it, or to delete it. The categories involved are identifiers, professional and employment information, internet activity from server logs, and the contents of messages you send us, collected for the business purposes described in section 4.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. You may use an authorized agent to make a request. We will not treat you differently for exercising these rights. Write to privacy@compassisland.co.

12. Canada

If you are in Canada, applicable Canadian privacy law, including PIPEDA where it applies, gives you the right to access the personal information we hold about you and to challenge its accuracy. Requests go to the same address. If you are not satisfied with our response, you may be able to complain to the Office of the Privacy Commissioner of Canada.

13. Children

LiveSOP is sold to organizations and this site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us information, write to us and we will delete it.

14. Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects how we use personal data we already hold, we will tell affected people directly where we have a way to reach them.

15. Contact and complaints

For anything in this policy, including a request about your own data, write to privacy@compassisland.co or to Compass Island, LLC, 808 Lady Street, Suite D #57, Columbia, SC 29201, United States.

We are based in the United States. Where applicable law requires us to appoint a representative in the EEA or the UK, we will appoint one and publish the details here. Until then, requests from either region come to us directly at the address above.

If you are in the EEA or the UK and you are unhappy with how we have handled your data, you may also complain to your national data protection authority, or to the Information Commissioner's Office in the United Kingdom.