Privacy policy
Last updated 2026-09-23
CompSlate helps small companies run sales compensation. This policy explains what we collect, why, where it lives, who we share it with, how long we keep it, what rights you have, and how to reach us. Questions: legal@compslate.com.
Customer data and our own data
Most of the personal data in CompSlate is put there by our customers: a company creates a workspace and adds its people, plans and deals. For that data ("customer data"), the company is in charge and CompSlate acts as its service provider (a "processor" in some laws), processing it only on the company's instructions under our Data processing addendum. If your employer added you to CompSlate, your employer's own privacy notice applies to that data, and we'll pass requests about it to them (see "Your rights" below).
For the data we collect for ourselves (for example, the contact details of the admins who sign up, billing records, messages you send us, and technical data about visits to our website), CompSlate decides how it is used, and this policy covers it directly.
What we collect
- Account data: names, work email addresses, roles and reporting lines of the people a workspace admin adds.
- Compensation data you enter: plans, pay components, OTE, base and quota figures, deals and bookings, one-off payments, plan changes and the payouts we calculate from them.
- Activity log: which person made which change, when, and whether it came from the web app or an AI assistant.
- Technical data: IP addresses for rate limiting and security, and a sign-in cookie. We don't use advertising or tracking cookies.
- Billing data: handled by Stripe. We keep the Stripe customer and subscription IDs, never card numbers.
- Messages to us: what you write when you email us, and your email address.
What we don't collect
When you use CompSlate from Claude, ChatGPT or another AI assistant, we only receive the tool calls the assistant makes (for example "record these deals") and send back their results. We don't receive or store your conversations, and our tools never ask for conversation history. We don't collect payment card numbers, government IDs, health information or precise location.
How we use it
Only to run the service for your workspace: calculating pay, showing comp cards and team views, sending sign-in links and notices an admin asks for, billing, security, and support. We don't sell data, use it for advertising, or use it to train AI models.
Where it is stored
In Amazon Web Services in the United States (us-east-1), encrypted at rest and in transit. Access within CompSlate is limited to what's needed to operate and support the service.
Who we share it with
We share data only with the service providers below, which handle it for us under contract. The current list, with locations, is on our Subprocessors page.
- Amazon Web Services: hosting, database and email delivery.
- Stripe: payments, for workspaces on a paid plan.
- Cloudflare: DNS for our domain, and forwarding of email sent to our @compslate.com addresses.
- Google Fonts: our pages load fonts from Google, which sees your IP address.
- Google (Gmail): hosts our support mailbox, so it holds email you send us.
- Your AI assistant provider (for example Anthropic or OpenAI) receives the tool results you ask for, under their own terms. You choose and control that connection; the provider isn't our service provider.
We may disclose data if the law requires it. If the business is sold, data would move with it under this policy.
Who can see what inside a workspace
Admins see and change everything in their workspace. Managers see their teams. Everyone else sees their own comp card, plus anything an admin shares with them.
Cookies
We set one cookie: a sign-in session cookie, created when you sign in, that keeps you signed in for up to 30 days. It is marked HttpOnly and, on our live site, Secure. We don't use analytics, advertising or tracking cookies, and we don't run third-party analytics or ad scripts on our pages.
Security
Data is encrypted in transit (HTTPS only) and at rest. Sign-in uses one-time email links rather than passwords, sign-in links and tokens are stored only as hashes, and changes are recorded in the workspace's activity log. Details are on our Security page. No system is perfectly secure; if we learn of a breach affecting your data, we'll notify you as the law and our DPA require.
How long we keep it
- Workspace data: for as long as the workspace exists.
- After deletion: removed within 30 days; database backups roll off within 35 days.
- Server logs: 90 days. Sign-in links: 20 minutes. Sessions: 30 days. Assistant access tokens: 1 hour, refresh tokens 90 days.
Your choices
Admins can export everything (CSV or Excel) and delete people, plans and deals at any time. To delete a whole workspace, or to access, correct or delete personal data about you, email legal@compslate.com. If your employer added you, we may pass your request to them, since they control the workspace.
Your US state privacy rights
Depending on where you live, laws such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and similar laws in other US states give you rights over your personal information. We honor the following requests from anyone in the US:
- Know and access: what personal information we have about you, where it came from, why we use it and who we share it with, and a copy of it.
- Delete: ask us to delete personal information about you, subject to exceptions the law allows (for example, records we must keep).
- Correct: ask us to fix inaccurate personal information.
- Opt out of sale or sharing: we don't sell personal information or share it for cross-context behavioral advertising, and we haven't in the past 12 months, so there is nothing to opt out of. We also don't use sensitive personal information to infer characteristics about you.
In the past 12 months we have collected these categories of personal information, from you, from your employer's workspace admins, and automatically when you use the service: identifiers (name, email address, IP address), professional or employment-related information (title, role, reporting line, compensation terms and results), commercial information (subscription and billing records), and internet activity (the activity log and server logs). We use and disclose them only for the business purposes described in this policy, and keep them for the periods listed above.
How to make a request. Email legal@compslate.com. We'll confirm receipt and respond within 45 days (or tell you if we need more time, as the law allows). To protect you, we verify requests by matching them to the email address we have on file, and may ask a follow-up question. If your request concerns customer data your employer controls, we'll forward it to your employer and help them respond.
Authorized agents. Someone you authorize can make a request for you. We'll ask for your signed permission and may ask you to confirm your identity with us directly.
No discrimination. We won't treat you differently for exercising these rights.
Appeals. If we decline your request, you can appeal by replying to our decision. If you're not satisfied with the outcome of the appeal, you can contact your state attorney general.
Children
CompSlate is a business tool and isn't directed at children. It isn't meant for anyone under 16, and we don't knowingly collect personal information from children under 16. If you believe we have, email legal@compslate.com and we'll delete it.
Changes
We'll post changes here and update the date above. Material changes are emailed to workspace admins.