Ad Astra Studios (“Kompound”, “we”, “us”) respects your privacy and is committed to protecting your personal data. This policy explains how we collect, use, disclose and protect personal data when you use our website, the Kompound application and related services, and describes your rights under applicable laws, including the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended (CCPA/CPRA), and India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
This policy covers personal data collected through kompound.app, the Kompound application (including the version installed from the Shopify App Store and the WooCommerce connector), Ask Kompass, Kompound MCP and our support channels. Read it together with any notice we provide when collecting specific data. Our website and services are not intended for children under 18 and we do not knowingly collect data relating to children.
Ad Astra Studios, Mumbai, Maharashtra, India, is the controller of personal data about you, the merchant, and your team. For the personal data of your customers, subscribers and store visitors contained in the data we read from the platforms you connect (“Store Data”), you are the controller and Kompound is your processor; that processing is governed by our Data Processing Addendum and by Section 3 below. We have appointed a grievance and privacy officer, reachable at support@kompound.app, responsible for questions about this policy and requests to exercise your rights.
Our website and services may include links to third-party websites, plug-ins and applications. Clicking those links or enabling those connections may allow third parties to collect or share data about you. We do not control those third parties and are not responsible for their privacy statements.
Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer the following kinds of personal data about you and your team:
We also create and use Aggregated Data, such as statistical or benchmark data, which may be derived from personal data but does not directly or indirectly reveal your identity and is not personal data in law. We do not intentionally collect special categories of personal data or sensitive personal information.
When you connect a store or an advertising, email, analytics or finance platform, Kompound reads, on a read-only basis, the data needed to produce your Reports: orders, refunds and transactions; products, variants and costs; customer records as provided by the platform (name, email, address, phone, tags); marketing spend and campaign performance; email and SMS campaign performance; and, if you install the Kompound Pixel, storefront sessions and events together with the consent state your store recorded.
We process Store Data only to provide the service to you: to build Reports, Dashboards, Cohorts, forecasts and AI answers, and to keep them current. We never change anything in a connected platform, never sell Store Data, never use it for advertising, and never use it to train AI models. Reports and exports do not display a customer’s name, email, phone number or address; where you need to identify an order, Kompound links to it in your own store administration.
Store visitors and the Kompound Pixel. The Pixel reads the consent decision recorded by your store’s own consent banner and collects nothing where consent was declined or could not be read. Kompound does not show its own banner and does not track shoppers across websites.
If you are a customer of a store that uses Kompound, your data was collected by that store under its privacy policy. To exercise your rights, contact the store; Kompound will act on the store’s instruction and honours the platform’s data-request and deletion mechanisms within 48 hours.
We use your personal data only where the law allows: to perform our contract with you; for our legitimate interests where your interests and rights do not override them; to comply with a legal obligation; or with your consent.
| Purpose | Data | Lawful basis |
|---|---|---|
| Register and administer your account and team | Identity, Contact, Account | Contract |
| Deliver the service, build your Reports and keep them current | Account, Usage, Technical, Store Data | Contract |
| Bill your subscription and recover amounts due | Identity, Contact, Transaction | Contract; legitimate interest |
| Answer support requests and notify you of changes to the service or these terms | Identity, Contact, Marketing and Communications | Contract; legal obligation; legitimate interest |
| Secure, troubleshoot, monitor and improve the website and application | Technical, Usage | Legitimate interest (running and securing our business) |
| Provide AI features (Ask Kompass, Kompound MCP) | Usage, Store Data (aggregates only) | Contract; legitimate interest |
| Send product news and early-access invitations | Contact, Marketing and Communications | Consent (EEA/UK); legitimate interest elsewhere, with opt-out |
When you ask Ask Kompass a question, or an AI client you have authorised queries Kompound MCP, the question and the aggregated figures needed to answer it are sent to our AI provider, Anthropic, solely to generate the response, under a contract that limits use of that data to our purposes and prohibits its use to train the provider’s models. No customer-identifying data is sent. You can revoke an MCP authorisation at any time.
We send product and early-access communications to account owners and people who registered for them. For users in the EEA and UK we obtain consent before sending direct marketing. You may opt out at any time using the link in any message or by writing to support@kompound.app; this does not affect service communications such as billing notices and security alerts.
We use PostHog for analytics of our own website and application (which pages and features are used) and Crisp for support chat. We do not run interest-based advertising on the website or application and do not share your data with advertising networks.
We share personal data only with service providers who process it on our instructions under written contracts, with the categories below. The full subprocessor list, with purposes and locations, is in the Data Processing Addendum.
We require all third parties to respect the security of your personal data and to process it only for specified purposes and in accordance with our instructions. We do not sell personal data.
Kompound is operated from India and our infrastructure is hosted in the United States, so your personal data is transferred outside your country of residence. Whenever we transfer personal data we take steps to ensure it is treated securely and in accordance with this policy. For residents of the EEA, UK and Switzerland we rely on Standard Contractual Clauses approved by the European Commission and the UK addendum, available under the Data Processing Addendum. For personal data originating in India we comply with the DPDP Act and any restrictions notified under it. An EU hosting region is planned.
We have put in place appropriate technical and organisational measures to prevent personal data from being accidentally lost, used, accessed, altered or disclosed without authorisation: encryption in transit and at rest, per-store isolation enforced in the database, role-based access, an audit log of changes, daily backups, secrets held in a managed vault, and vulnerability monitoring. Access is limited to personnel with a business need. SOC 2 Type II is under way.
We have procedures to deal with any suspected personal-data breach and will notify you and any applicable regulator where legally required. For users in the EEA or UK we will notify the supervisory authority within 72 hours; for California residents in the most expedient time possible; and under the DPDP Act we will notify the Data Protection Board of India and affected individuals as prescribed.
We retain personal data only as long as reasonably necessary for the purposes we collected it for, including legal, tax, accounting and reporting requirements. In practice: account and billing records are kept while your account exists and for the period required by applicable tax and legal obligations afterwards; Store Data is kept while a store is connected and deleted within 30 days of disconnection or uninstallation, except records we must keep by law; raw storefront events are kept for 90 days; support conversations for three years; early-access and contact-form submissions until the request is resolved and for one year afterwards. We may anonymise personal data for statistical purposes, in which case we may use it indefinitely.
Depending on where you live, you have the right to request access to your personal data, request its correction or erasure, object to or request restriction of its processing, request its transfer in a structured, machine-readable format, and withdraw consent where we rely on consent. To exercise any right write to support@kompound.app. We may need to verify your identity. We respond to all legitimate requests within one month, and we will tell you if we need longer. You also have the right to complain to the data-protection authority in your jurisdiction, although we would appreciate the chance to address your concern first.
In addition to Section 10, if you are in the EEA or UK you have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object (including to direct marketing and to processing based on legitimate interests), and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Kompound does not make such decisions about you. Complaints may be made to your national supervisory authority; the European Data Protection Board lists them.
California residents have the right, free of charge, to know the categories and specific pieces of personal information we have collected, the sources, the purposes and the categories of third parties to whom it is disclosed; to request deletion and correction; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Kompound does not sell personal information and does not share it for cross-context behavioural advertising, so no opt-out is required. Requests may be made to support@kompound.app.
If you are in India, you have the right to access a summary of the personal data we process about you and the identities of the entities it has been shared with, the right to correction, completion and erasure, the right to grievance redressal, and the right to nominate another person to exercise your rights in the event of death or incapacity. Where processing is based on consent you may withdraw it at any time. Our grievance officer can be reached at support@kompound.app and will respond within the period prescribed under the Act. If you are not satisfied you may approach the Data Protection Board of India.
Ad Astra Studios, Mumbai, Maharashtra, India. Privacy and grievance officer: support@kompound.app. We aim to acknowledge every privacy request within two business days.
The governing law and dispute-resolution provisions applicable to this policy are those set out in our Terms of Service. We may update this policy; the date at the top shows when it was last revised, and for material changes we will notify account owners by email before they take effect.
Questions about this document: support@kompound.app · Ad Astra Studios, Mumbai, Maharashtra, India.