Privacy Policy

COMPASSUP SAS • Effective Date: January 27, 2026

Introduction

COMPASSUP SAS ("Company," "we," "us," or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, share, and protect information when you use the Accessible document transformation and remediation platform (the "Service").

This Privacy Policy applies to all users of the Service and should be read in conjunction with our Terms of Use, available at ada-uni.com.

By using the Service, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, please do not use the Service.

Table of Contents
  1. Controller Information and Contact Details
  2. Scope and Applicability
  3. Information We Collect
  4. How We Use Your Information
  5. Legal Basis for Processing (GDPR)
  6. AI and Machine Learning: Use of Your Documents
  7. Information Sharing and Disclosure
  8. International Data Transfers
  9. Data Retention and Deletion
  10. Your Privacy Rights
  11. Children's Privacy
  12. Data Security
  13. Cookies and Tracking Technologies
  14. Third-Party Services and Links
  15. Changes to This Privacy Policy
  16. How to Contact Us

1. Controller Information and Contact Details

Data Controller:

COMPASSUP SAS

Legal Form: Société par Actions Simplifiée (SAS)

Registration Number: 933 416 265 00017

Registered Office: 58 RUE DE MONCEAU, 75008 PARIS, France

Email: briac@compassup.fr

Website: ada-uni.com

Data Protection Officer (if applicable):

Email: briac@compassup.fr

Address: 58 RUE DE MONCEAU, 75008 PARIS, France

For privacy-related questions, data subject access requests, or to exercise your rights under applicable data protection laws (including GDPR and CCPA), please contact us using the information above.

2. Scope and Applicability

2.1 Geographic Scope

This Privacy Policy applies to all users of the Service, regardless of location. We are committed to complying with:

2.2 Service Coverage

This Privacy Policy covers:

2.3 Third-Party Services

This Privacy Policy does not apply to third-party websites, applications, or services that may be linked to or integrated with our Service. We recommend reviewing the privacy policies of any third-party services you use.

3. Information We Collect

We collect different types of information to provide, improve, and secure the Service.

3.1 Information You Provide Directly

(A) Account Registration Information

When you create an account, we collect:

(B) Billing and Payment Information

When you purchase access to the Service, we collect:

Note: Payment card details are processed by our third-party payment processors (Stripe). We do not store complete credit card numbers on our servers.

(C) Profile Information

You may optionally provide:

(D) Communications and Support

When you contact us for support or communicate with us, we collect:

3.2 Documents and Content You Upload

(A) User Content

We collect and process documents and files you upload to the Service ("Your Content"), including:

(B) Output Documents

We store the transformed and remediated documents generated by the Service based on Your Content.

IMPORTANT: Your documents may contain Personal Data. If you upload documents containing Personal Data, you are responsible for ensuring you have a lawful basis to process that data and to share it with us. See Section 5 for details on the legal basis for our processing.

3.3 Automatically Collected Information

(A) Usage Data

When you use the Service, we automatically collect:

(B) Device and Technical Information

We collect:

(C) Cookies and Similar Technologies

We use cookies, web beacons, and similar tracking technologies to collect information about your browsing behavior. See Section 13 for details.

3.4 Information from Third Parties

(A) Payment Processors

We receive transaction confirmation and payment status information from our payment processors (Stripe).

(B) Authentication Services (if applicable)

If you sign in using a third-party authentication service (e.g., Google, Microsoft), we receive:

We only receive information you authorize the third-party service to share with us.

3.5 Information We Do NOT Collect

We do not knowingly collect:

If you upload documents containing Sensitive Personal Data, you do so at your own risk and in violation of our Terms of Use. We are not responsible for such data, and you agree to indemnify us for any liability arising from such uploads.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 To Provide and Operate the Service

4.2 To Process Payments and Prevent Fraud

4.3 To Improve and Develop the Service

4.4 To Communicate with You

4.5 To Ensure Security and Compliance

4.6 For Legal and Business Purposes

6. AI and Machine Learning: Use of Your Documents

IMPORTANT: PLEASE READ THIS SECTION CAREFULLY.

6.1 Overview

The Service uses advanced artificial intelligence (AI) and machine learning (ML) technologies to analyze, transform, and remediate documents. To improve the accuracy, efficiency, and capabilities of our AI/ML models, we use Your Content (the documents you upload) to train, test, and refine our algorithms.

By using the Service, you expressly acknowledge and consent to the use of Your Content for AI/ML training purposes as described in this Section 6.

6.2 How We Use Your Documents for AI Training

(A) Training Data

Your Content is used as training data to:

(B) What This Means

(C) Technical Process

Our AI training process may involve:

6.3 Privacy Protections for AI Training

We implement the following measures to protect your privacy during AI training:

(A) No Public Distribution

We do not publish, sell, or publicly distribute Your Content to third parties for their own AI training or commercial purposes.

(B) Confidentiality

Your documents are treated as confidential business information and are protected by technical and organizational security measures (see Section 12).

(C) Aggregation and Anonymization

Where technically feasible, we aggregate and anonymize training data to reduce identifiability. However, we cannot guarantee that all Personal Data in Your Content will be fully anonymized or removed during the AI training process due to technical limitations of current AI technologies.

(D) Access Controls

Access to training data is restricted to authorized personnel (data scientists, machine learning engineers) who are bound by confidentiality obligations.

(E) Secure Infrastructure

Training data is stored on secure servers in the EU and/or US, operated by trusted service providers (AWS) under strict contractual agreements.

6.4 Your Consent and Control

(A) Consent Requirement

Use of the Service constitutes your consent to the use of Your Content for AI training. If you do not consent, you must not use the Service.

(B) No Opt-Out Available

AI training is integral to the Service's functionality and continuous improvement. We do not currently offer an opt-out option for AI training while still using the Service.

If this is unacceptable to you, we recommend not using the Service or using it only with documents that do not contain Personal Data or confidential information.

(C) Enterprise Options

For large organizations with specific data processing requirements, please contact us at briac@compassup.fr to discuss custom enterprise agreements that may include different data processing terms.

6.5 Legal Basis

For users in the EEA/UK/Switzerland, our legal basis for using Your Content for AI training is:

You have the right to object to processing based on legitimate interests (see Section 10.8).

6.6 Transparency and Accountability

We are committed to transparency about our AI practices. If you have questions or concerns about how Your Content is used for AI training, please contact our Data Protection Officer at briac@compassup.fr.

6.7 CCPA Notice (California Residents)

California residents are hereby notified that:

7. Information Sharing and Disclosure

We do not sell your Personal Data. We share your information only in the limited circumstances described below:

7.1 Service Providers and Subprocessors

We share information with third-party service providers who perform services on our behalf, including:

(A) Cloud Infrastructure Providers

(B) Payment Processors

(C) Email and Communication Services

(D) Customer Support Tools

(E) Analytics and Monitoring

All service providers are contractually bound to:

A complete list of subprocessors is available upon request by contacting alan@compassup.fr.

7.2 Business Transfers

If we are involved in a merger, acquisition, asset sale, bankruptcy, or other corporate transaction, your information may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on our website before your information becomes subject to a different privacy policy.

7.3 Legal Requirements and Protection of Rights

We may disclose your information if required to do so by law or in response to:

We may also disclose information when we believe in good faith that disclosure is necessary to:

7.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

7.5 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you, including:

This data is not considered Personal Data under GDPR or Personal Information under CCPA.

7.6 No Sale of Personal Data

We do not sell your Personal Data to third parties for monetary compensation.

However, under some definitions in privacy laws like the CCPA, sharing data for certain purposes (including AI training) may be considered a "sale" or "sharing." See Section 10.11 for opt-out rights.

8. International Data Transfers

8.1 Data Processing Locations

COMPASSUP SAS is based in France. However, the Service operates globally, and your information may be transferred to, stored, and processed in:

These countries may have data protection laws that differ from those in your country of residence.

8.2 Safeguards for International Transfers

When we transfer Personal Data outside the European Economic Area (EEA), United Kingdom, or Switzerland, we implement appropriate safeguards, including:

(A) Standard Contractual Clauses (SCCs)

We use Standard Contractual Clauses approved by the European Commission (Decision 2021/914) for transfers to countries that do not have an adequacy decision.

(B) Adequacy Decisions

We may transfer data to countries that the European Commission has determined provide an adequate level of data protection.

(C) Binding Corporate Rules (if applicable)

For intra-group transfers, we may rely on Binding Corporate Rules approved by data protection authorities.

(D) Derogations for Specific Situations

In limited cases, we may transfer data based on GDPR Article 49 derogations, such as:

8.3 US Service Providers

Some of our service providers (AWS, Vercel, Stripe) are based in the United States. We have entered into Standard Contractual Clauses with these providers and require them to implement appropriate technical and organizational measures to protect your data.

EU-US Data Privacy Framework (if applicable): Some US service providers may be certified under the EU-US Data Privacy Framework, which provides safeguards for transfers from the EU to the US.

8.4 Your Rights

You have the right to obtain information about the safeguards we have in place for international transfers. You may also request a copy of the Standard Contractual Clauses by contacting us at briac@compassup.fr.

9. Data Retention and Deletion

9.1 Retention Principles

We retain your information for as long as necessary to:

9.2 Retention Periods

(A) Account Information

We retain your account information (name, email, profile data) for as long as your account is active.

(B) Your Content and Output Documents

(C) Backup Copies

Backup copies of Your Content may be retained for an additional period (typically up to 90 days) as part of our routine backup and disaster recovery procedures. These copies are not accessible to you and will be automatically deleted according to our backup retention schedule.

(D) AI Training Data

Data that has been incorporated into our AI/ML models in aggregated, anonymized, or derivative form may be retained indefinitely to preserve model integrity and performance. Once integrated into models, individual data points are generally not identifiable or retrievable.

(E) Transaction and Billing Records

We retain transaction records, invoices, and billing information for 7 years to comply with tax, accounting, and financial regulations.

(F) Support Communications

We retain support tickets, emails, and communications for 3 years for customer service, quality assurance, and dispute resolution purposes.

(G) Usage and Log Data

We retain usage data, IP logs, and access logs for 12 months for security, analytics, and operational purposes.

(H) Marketing Data

If you have consented to receive marketing communications, we retain your marketing preferences until you withdraw consent or for 3 years of inactivity, whichever comes first.

9.3 Deletion Upon Request

You may request deletion of your account and Personal Data at any time (see Section 10.6). Upon receiving a verified deletion request, we will delete your Personal Data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, dispute resolution).

9.4 Legal Holds

In some cases, we may be required to retain data beyond the standard retention periods due to:

We will resume normal deletion practices once the legal hold is lifted.

10. Your Privacy Rights

Depending on your location, you may have certain rights regarding your Personal Data.

10.1 Rights Under GDPR (EEA, UK, Switzerland Residents)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR:

(A) Right of Access (Article 15)

You have the right to obtain:

(B) Right to Rectification (Article 16)

You have the right to correct inaccurate or incomplete Personal Data.

(C) Right to Erasure / "Right to be Forgotten" (Article 17)

You have the right to request deletion of your Personal Data in certain circumstances, including:

Note: This right is not absolute. We may refuse erasure if retention is necessary for compliance with legal obligations, establishment or defense of legal claims, or other lawful grounds.

(D) Right to Restriction of Processing (Article 18)

You have the right to restrict processing of your Personal Data in certain circumstances, including:

(E) Right to Data Portability (Article 20)

You have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another controller, where:

(F) Right to Object (Article 21)

You have the right to object to processing based on:

(G) Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

(H) Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, particularly in your country of residence, place of work, or place of alleged infringement. In France, the supervisory authority is:

Commission Nationale de l'Informatique et des Libertés (CNIL)

Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

Website: https://www.cnil.fr/

Phone: +33 1 53 73 22 22

(I) Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you, unless:

Note: The Service uses AI for document analysis and transformation, but these processes do not involve automated decision-making that produces legal effects or significantly affects you in the sense of Article 22.

10.2 How to Exercise Your GDPR Rights

To exercise any of the above rights, please contact us at:

Email: briac@compassup.fr

Subject Line: "GDPR Data Subject Request"

Please include:

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months, in which case we will inform you of the extension and the reasons for delay.

10.3 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

(A) Right to Know

You have the right to request that we disclose:

(B) Right to Delete

You have the right to request deletion of Personal Information we collected from you, subject to certain exceptions (e.g., to complete a transaction, comply with legal obligations, detect security incidents, exercise free speech, or engage in research).

(C) Right to Correct

You have the right to request correction of inaccurate Personal Information.

(D) Right to Opt-Out of Sale/Sharing

You have the right to opt out of the "sale" or "sharing" of your Personal Information.

Important: We do not sell Personal Information for monetary compensation. However, use of Your Content for AI training may be considered a "sale" or "sharing" under CCPA. To opt out, you must discontinue use of the Service, as AI training is integral to its functionality.

(E) Right to Limit Use of Sensitive Personal Information

You have the right to limit the use of Sensitive Personal Information to purposes necessary to provide the Service. We prohibit the upload of Sensitive Personal Information in our Terms of Use and do not intentionally collect it.

(F) Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights, including by:

10.4 How to Exercise Your CCPA Rights

To exercise your CCPA rights, please:

Email: briac@compassup.fr

Subject Line: "CCPA Consumer Request"

Please include:

We will acknowledge receipt of your request within 10 business days and respond substantively within 45 days. In some cases, we may extend this period by an additional 45 days, in which case we will notify you.

10.5 Authorized Agents (California)

You may designate an authorized agent to submit CCPA requests on your behalf. We will require:

10.6 Account Deletion

To delete your account entirely, you may:

Upon account deletion, we will delete or anonymize your Personal Data within 30 days, except where retention is required by law or for legitimate business purposes.

10.7 Marketing Opt-Out

You may opt out of marketing communications at any time by:

Note: Even if you opt out of marketing, we will still send you transactional and Service-related communications (e.g., account notifications, receipts, security alerts).

10.8 Objection to AI Training (GDPR)

If you are in the EEA/UK/Switzerland and wish to object to the use of Your Content for AI training based on legitimate interests (GDPR Article 21), please contact us at briac@compassup.fr.

However, please note:

10.9 Identity Verification

To protect your privacy and security, we may require verification of your identity before responding to data subject requests. Verification methods may include:

10.10 Fees

We do not charge fees for responding to data subject requests, except:

10.11 Third-Party Rights Platforms (if applicable)

You may also exercise your privacy rights through authorized third-party platforms or browser-based tools, such as Global Privacy Control (GPC) signals. We will honor GPC signals where required by law.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect Personal Data from children under 18.

If you are under 18, you may not use the Service.

If we become aware that we have inadvertently collected Personal Data from a child under 18, we will take steps to delete such information as soon as possible. If you believe we have collected information from a child under 18, please contact us immediately at briac@compassup.fr.

Note for Educational Institutions: If you are an educational institution seeking to use the Service with students under 18, please contact us at briac@compassup.fr to discuss custom terms and COPPA/FERPA compliance measures.

12. Data Security

12.1 Security Measures

We implement commercially reasonable technical and organizational measures to protect your information against unauthorized access, disclosure, alteration, and destruction, including:

(A) Technical Safeguards

(B) Organizational Safeguards

(C) Physical Security

Our service providers (AWS, Vercel) maintain physical security controls for data centers, including:

12.2 Limitations of Security

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You use the Service at your own risk.

12.3 Data Breach Notification

In the event of a data breach affecting your Personal Data, we will:

(A) For GDPR:

(B) For CCPA:

(C) Notification Content:

12.4 Your Responsibilities

You are responsible for:

13. Cookies and Tracking Technologies

13.1 What Are Cookies?

Cookies are small text files placed on your device when you visit our website or use the Service. Cookies help us recognize your device, remember your preferences, and improve your user experience.

13.2 Types of Cookies We Use

(A) Strictly Necessary Cookies

These cookies are essential for the Service to function and cannot be disabled. They include:

(B) Performance and Analytics Cookies

These cookies help us understand how users interact with the Service, including:

These cookies collect information such as pages visited, time spent, clicks, and error messages.

(C) Functional Cookies

These cookies remember your preferences and choices, such as:

(D) Marketing Cookies (with consent)

If you consent, we may use cookies for marketing purposes, including:

13.3 Third-Party Cookies

Some cookies are placed by third-party services we use (e.g., Google Analytics, payment processors). These third parties may collect information about your online activities across different websites.

13.4 Managing Cookies

(A) Browser Settings

You can control cookies through your browser settings. Most browsers allow you to:

Note: Disabling strictly necessary cookies may prevent you from using certain features of the Service.

(B) Cookie Consent Management

When you first visit our website, we will ask for your consent to use non-essential cookies (performance, functional, marketing). You can:

You can change your cookie preferences at any time by clicking "Cookie Settings" in the footer of our website.

(C) Opt-Out Tools

13.5 Do Not Track (DNT)

Some browsers have a "Do Not Track" (DNT) feature that signals websites not to track you. We do not currently respond to DNT signals, as there is no industry consensus on how to interpret them.

However, we honor Global Privacy Control (GPC) signals where required by law (e.g., California).

14. Third-Party Services and Links

14.1 Third-Party Links

The Service may contain links to third-party websites, applications, or services. We are not responsible for the privacy practices or content of these third parties.

We encourage you to review the privacy policies of any third-party services you visit.

14.2 Third-Party Integrations

If you connect the Service with third-party applications (e.g., Google Drive, Dropbox, Microsoft OneDrive), those third parties may collect and process your information according to their own privacy policies.

We are not responsible for third-party data practices.

14.3 Social Media

Our website and communications may include social media features (e.g., Facebook, Twitter, LinkedIn buttons). These features may collect your IP address, page visited, and set cookies. Social media features are governed by the privacy policies of the respective social media companies.

15. Changes to This Privacy Policy

15.1 Updates

We may update this Privacy Policy from time to time to reflect:

15.2 Notification of Changes

We will notify you of material changes to this Privacy Policy by:

15.3 Effective Date

The "Effective Date" at the top of this Privacy Policy indicates when it was last updated. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy.

15.4 Reviewing Changes

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you do not agree to the updated Privacy Policy, you must discontinue use of the Service and may request deletion of your account.

16. How to Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

COMPASSUP SAS

General Privacy Inquiries:

Email: briac@compassup.fr

Address: 58 RUE DE MONCEAU, 75008 PARIS, France

Data Protection Officer:

Email: briac@compassup.fr

Address: 58 RUE DE MONCEAU, 75008 PARIS, France

Data Subject Access Requests (GDPR/CCPA):

Email: briac@compassup.fr

Subject Line: "Data Subject Request" or "CCPA Consumer Request"

Supervisory Authority (France)

If you are located in France and wish to contact the supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL)

Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

Website: https://www.cnil.fr/

Phone: +33 1 53 73 22 22

Email: https://www.cnil.fr/en/contact-cnil

Response Time

We will respond to your inquiries within:

Important Notices for Specific Jurisdictions

For Users in the European Union:

This Privacy Policy complies with the GDPR (Regulation EU 2016/679). You have specific rights regarding your Personal Data, as described in Section 10.1. For questions or to exercise your rights, contact our Data Protection Officer at briac@compassup.fr.

For Users in California:

This Privacy Policy complies with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). California residents have specific rights, as described in Section 10.3. For CCPA requests, contact us at briac@compassup.fr.

CCPA "Do Not Sell or Share My Personal Information" Notice:

We do not sell your Personal Information for monetary compensation. However, the use of Your Content for AI training may be considered a "sale" or "sharing" under CCPA. To opt out, you must discontinue use of the Service, as this processing is integral to the Service's functionality.

For Users in the United Kingdom:

Following Brexit, the UK has its own data protection regime (UK GDPR). This Privacy Policy complies with UK GDPR. UK users have the same rights as EEA users described in Section 10.1. The UK supervisory authority is the Information Commissioner's Office (ICO): https://ico.org.uk/

For Users in Switzerland:

This Privacy Policy complies with the Swiss Federal Act on Data Protection (FADP). Swiss users have rights similar to those under GDPR, as described in Section 10.1. The Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch/

BY USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THIS PRIVACY POLICY.

Last Updated: January 27, 2026