Last updated: 10 October 2026
Policy Compass is operated by Meet George Limited ("Meet George", "we", "us", "our"), a company registered in England and Wales under company number 15747538, with its registered office at 18 Albert Road, Bournemouth, Dorset, BH1 1BZ.
For the personal data described in this policy, Meet George Limited is the data controller, except where sections 2, 15 and 16 explain that we act as a processor on behalf of an organisation that uses Policy Compass. If you have any questions or want to exercise your rights, contact us at privacy@policycompass.co.uk.
This policy explains how we handle personal data as a controller - for visitors to policycompass.co.uk, people who contact us or request a trial, and the administration of customer accounts.
It also covers the Policy Compass app for Microsoft Teams and the Policy Compass app for Slack. Section 15 and section 16 explain what personal data each app handles, why, who acts as controller and processor, and how long we keep it.
Separately, when we process personal data within the Policy Compass platform on behalf of a customer, we act as a processor, on the customer's instructions and under our agreement with it. That data is governed by the customer's own privacy notices and by our agreement with it, and by the controls described in our Trust Centre.
We do not seek special category data, and the platform is intended for regulatory and business content rather than personal data.
We do not sell your personal data, and we do not use customer content (your questions, documents or chat history) to train AI models - by us or by our providers. See the Trust Centre for detail.
Where you have asked to hear from us, or where we are otherwise permitted to, we may send you product updates and other marketing emails. You can opt out at any time using the unsubscribe link in any such email, or by emailing privacy@policycompass.co.uk. Service and account messages we need to send to run a trial or contract are not marketing and continue regardless.
Policy Compass is an AI research tool, but it does not make decisions about you. We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects, and a human stays in control of how the platform is used. Where the Service analyses regulatory material, it does so to assist a person's research and judgement, not to make automated decisions about individuals.
We use a consent banner to manage cookies. Strictly necessary cookies are always on; analytics and similar technologies (such as Google Analytics and Google Tag Manager) load only after you consent. You can review or change your choices at any time using the Cookies link in the website footer.
We share personal data with trusted service providers who process it on our instructions, including, for the website and enquiries: Airtable (storing form submissions), Resend (sending email), Vercel (website hosting), Google (analytics, with your consent), our consent-management provider (cookie consent), and Sentry (error monitoring, with prompt and response content removed).
For the Policy Compass platform, a list of our sub-processors, with each one's purpose and region, is available on request. We give active customers at least 30 days' notice before any material change. We do not sell personal data.
Primary storage is in the UK, and the AI models that process customer data run in the EU. Some of our providers operate outside the UK and the EU. Where we transfer personal data outside the UK, we rely on UK adequacy regulations or on the safeguards our providers offer, such as the EU Standard Contractual Clauses with the International Data Transfer Addendum issued by the UK Information Commissioner. Our web search provider, which is based in the US, receives only search queries made from users' questions, never uploaded files or chat history, and does not retain them.
Microsoft provides the Azure Bot Service, which carries messages between Microsoft Teams and the Policy Compass app for Microsoft Teams (see section 15). It is a global service, so these messages may be processed outside the UK and the EU. Microsoft provides it to us as our processor under Microsoft's data protection terms, which apply the EU Standard Contractual Clauses and the UK International Data Transfer Addendum to transfers from the UK.
We keep personal data only as long as we need it for the purposes above: enquiry and lead data for as long as we are in contact and a reasonable period afterwards; account and service data for the term of the contract and a defined period after it ends, after which it is deleted. Configurable retention is available on enterprise contracts.
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Primary storage is in the UK, customer data is isolated per customer, and Meet George holds the UK government-backed Cyber Essentials certification. We notify affected customers of a personal-data breach affecting their data without undue delay, and no later than 72 hours after becoming aware of it. See the Trust Centre for the full picture.
Under UK data-protection law you have the right to access, rectify, erase, restrict, and port your personal data, to object to certain processing, and to withdraw consent at any time. To exercise any of these, email privacy@policycompass.co.uk. Where we are the controller, we respond within 30 days. Where we hold your data on behalf of an organisation that uses Policy Compass (see sections 2, 15 and 16), that organisation is the controller: we will pass your request to it, help it respond and act on its instructions.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, though we'd appreciate the chance to resolve any concern first.
Policy Compass is a business-to-business service and is not directed at children. We do not knowingly collect personal data relating to children.
The Website and Service may link to third-party websites, such as Ofgem, DESNZ and industry code bodies. We are not responsible for their content or their privacy practices; their own privacy notices apply.
Policy Compass is available as an app for Microsoft Teams (the "Teams app"). People whose organisation has a Policy Compass account can use it to ask regulatory questions in Teams and get AI-generated answers that cite their sources. This section explains what personal data the Teams app handles, why, who it is shared with, how long we keep it, and how to disconnect or ask us to delete it. The rest of this policy also applies.
The Teams app only receives messages that are sent to it: messages in a one-to-one chat with the app, and messages in a channel or group chat that @mention it. It cannot read other messages in your chats or channels, and it has no access to your mailbox, files, calendar or contacts. It does not open or keep files or images attached to a message. For each message sent to it, Microsoft passes us:
Microsoft also sends some details that the Teams app does not use or keep, such as your Microsoft Entra object ID, your language, country and time-zone settings, and the type of Teams client you are using.
To tell whether you are a member of the organisation that owns a chat or channel, one of its guests or a person from another organisation, the Teams app may also ask Microsoft for your membership details in that conversation. Microsoft's reply includes the Microsoft 365 tenant ID of your own organisation and whether you are a member or a guest, as well as details such as your name and email address. We hold the reply in memory for a short time and use it only to decide how to respond. We do not store the reply itself, we never store the email address in it, and we use the name in it only for the welcome message described below. The only things we may record from it are whether you are a member, a guest or from another organisation, in the log entry described below, and whether you are a member or a guest, with a connection code if one is issued to you.
When the Teams app is added to or removed from a team, group chat or one-to-one chat, Microsoft tells us where: the Microsoft 365 tenant, team and conversation IDs. When it is added to a team or group chat, we also look up the name of the person who added it, in the same way as the membership details above, so that the app's welcome message can mention them. We use the name only to post that message and do not store it.
If you message the Teams app before you have connected an account, if you are from another organisation, or when the app is not available to your organisation, we do not keep the text of your message. We keep only what we need to issue a code, where one is issued, and the log entry.
Owners and admins of your organisation's Policy Compass account can see who has connected a Teams account, and can disconnect them. They cannot read the questions you ask the Teams app, or its answers, in Policy Compass, and they cannot see the log described above. A question you ask in a channel or group chat, and its answer, can be seen in Teams by everyone in that conversation.
Connected users. For people who have connected a Policy Compass account, we act as a processor for the organisation whose Policy Compass account they are connected to, on its instructions and under our agreement with it (see section 2). This covers everything we hold about you as a connected user: your questions and the answers, the link between your Teams and Policy Compass accounts, the connection code you used to connect, and the log entries about your messages. That organisation is the controller: it decides how its people use Policy Compass, and it can instruct us to return or delete this data.
People who are not connected. We are the controller only of the minimal records we keep about people who are not, or not yet, connected users of a Policy Compass organisation, and about messages we could not attribute to anyone:
For these we rely on our legitimate interests in keeping the Teams app secure and preventing its misuse, including making sure that it only answers people who have a Policy Compass account in the organisation that owns the conversation.
Where the app has been added. Where a team or chat belongs to an organisation whose Microsoft 365 tenant is connected to a Policy Compass account, we hold the record of where the Teams app has been added there, and use the name of the person who added it for the welcome message, as a processor for that organisation. Otherwise we are the controller of that record and of that use of the name, and we rely on our legitimate interests in running the Teams app where it has been added.
Your right to object. Where we rely on our legitimate interests, as described above, you can object to this processing at any time by emailing privacy@policycompass.co.uk. If you do, we will delete the records about you that we hold on that basis, unless we need them for an open investigation into misuse of the app. To find them, we need your Teams or Slack user ID, or roughly when and where you messaged the app.
Microsoft carries messages between Teams and the Teams app through its Azure Bot Service (Bot Framework), which handles them on our behalf under Microsoft's data protection terms. Microsoft is our processor for this service, or our sub-processor where we act for your organisation. It is a global service, so messages may be processed outside the UK and the EU; section 9 explains the safeguards. The messages you send the app, and its answers, also stay in Teams, where Microsoft stores them as part of your organisation's Microsoft 365 service under your organisation's agreement with Microsoft and the Microsoft Privacy Statement. Deleting data from Policy Compass does not delete messages in Teams.
To answer a question, we use the same sub-processors as the rest of the Policy Compass platform: the cloud services that run the Teams app and Research, our database, our AI model providers, the web search service Research uses to find its sources (which receives search queries, not your files), and error monitoring. They are listed, with each provider's purpose and region, in our Security & Data Handling overview, available on request (see section 8). We do not sell personal data.
Primary storage is in the UK, and the AI models that answer your questions run in the EU. Some supporting services, including Microsoft's Azure Bot Service, operate outside the UK and EU; section 9 explains the safeguards we rely on. We don't use your questions or answers to train AI models, and the AI models that answer them don't keep them for training. Section 11 covers how we protect your data.
Questions about the Teams app and your data: privacy@policycompass.co.uk. Help with using the app: hello@policycompass.co.uk.
Policy Compass and Meet George Limited are not affiliated with, or endorsed by, Microsoft. Microsoft and Microsoft Teams are trademarks of the Microsoft group of companies.
Policy Compass is also available as an app for Slack (the "Slack app"). Someone in an organisation that has a Policy Compass account adds it to that organisation's Slack workspace from Policy Compass, and each person then connects their own Slack account with a one-time code, as for the Teams app. Section 15 applies to the Slack app in the same way - including what we use messages for, our role and legal basis, what owners and admins can see, how long we keep data, and deletion - with these differences:
Policy Compass and Meet George Limited are not affiliated with, or endorsed by, Slack.
We may update this policy from time to time. The "last updated" date above shows when it last changed, and we will notify active customers of any material change.
Meet George Limited, 18 Albert Road, Bournemouth, Dorset, BH1 1BZ. Data and privacy enquiries: privacy@policycompass.co.uk. General enquiries: hello@policycompass.co.uk.