CompassU Privacy Notice
Effective September 11, 2026 · Production legal draft for counsel review
1. Scope
This notice explains how CompassU collects, uses, discloses, retains, and protects information when students, educational institutions, administrators, and other authorized users use CompassU.
2. Information we collect
Depending on use, CompassU may process account and profile information such as name, email address, institution affiliation, graduation year, and state; assessment responses and attempts; derived major, career, and educational recommendations; saved preferences; institutional membership and reporting configuration; and technical, security, audit, and email-delivery information.
3. How we use information
CompassU uses information to provide and personalize the service, score assessments, generate educational recommendations and reports, support institution-authorized analytics, communicate with users, secure and administer accounts, troubleshoot the service, prevent misuse, and comply with applicable law and contractual obligations.
4. Student data commitments
CompassU does not sell student personal information, serve targeted advertising based on student data, or use institution-provided student information to build unrelated commercial profiles. Student information supplied through an educational institution is used only to provide, secure, support, improve, and administer the CompassU educational service as permitted by the institution and applicable law.
5. Educational institutions and FERPA
When CompassU processes education records on behalf of a participating institution, CompassU acts as a service provider for the authorized educational purpose established by the institution and applicable agreement. Institutions retain the rights applicable to education records under their control. Technical execution of identifiable access, export, modification, and deletion requests is performed exclusively by authorized CompassU Master Administrators after request authentication and authorization.
6. Minors and COPPA
CompassU is designed primarily for high-school juniors and seniors and college students. CompassU does not intentionally invite independent account creation by children under 13. Any institution-sponsored use involving children under 13 must be specifically authorized and configured in accordance with applicable child-privacy requirements and the CompassU Minors/COPPA Policy.
7. Institutional reporting
Institutional analytics are designed to use aggregate information by default. CompassU applies institution scoping and may suppress small data cells to reduce re-identification risk. Identifiable operational information is provided only when authorized and necessary for administration or support.
8. Service providers
CompassU uses service providers to operate its application infrastructure, database and authentication services, hosting, and transactional email. These providers may process information only for services they provide to CompassU and are subject to applicable contractual and security obligations. CompassU maintains a current subprocessor disclosure for institutional customers.
9. Retention and deletion
CompassU retains information only for periods needed to provide and administer the service, satisfy institution-authorized educational purposes, maintain security and audit records, resolve disputes, and meet legal obligations. Authorized institutions and users may submit access or deletion requests where applicable. CompassU Master Administrators authenticate and execute approved technical requests.
10. Security
CompassU uses administrative, technical, and organizational safeguards appropriate to the nature of the information processed. No service can guarantee absolute security. Suspected security incidents are handled under the CompassU incident-response and breach-notification process.
11. Choices and requests
Questions or authorized requests concerning student records should ordinarily be submitted through the participating institution when the institution supplied or controls the information. CompassU may require verification before acting on any request.
12. Changes
CompassU may update this notice as the service, law, or data practices change. Material revisions will be identified by a new effective date and, when appropriate, additional notice.
13. Contact
Privacy and data-governance inquiries may be submitted through the official CompassU support or institutional contact channel designated for the applicable deployment.