This website
When you submit the Contact form on this website, we collect what you provide: your name, email address, phone number, the topic you select, and your message. We do not require an account to submit a message, and this form is handled entirely separately from any individual travel agency's own customer inquiries (see "Two separate systems" below).
Two separate systems
Compass Tools is the CRM platform; travel agencies run their own, separate customer-facing websites on top of it. This website's own Contact form (above) is about Compass Tools the product — a demo, a feature question, support, billing. It is kept entirely separate, in its own database records and its own inbox visible only to Compass Tools's own team, from any inquiry a traveler submits to a travel agency's own customer-facing website. We do not combine these.
Information CRM users enter into the application
Travel agency staff who use Compass Tools enter information about their own leads, customers, quotes, and bookings — names, contact details, travel preferences, pricing, and (where a customer pays by card) payment card information. This information belongs to the travel agency; Compass Tools stores and processes it on the agency's behalf so their staff can do their jobs, and does not use it for any other purpose, such as marketing to those customers directly.
Payment card information
Where a travel agency collects a customer's card details for a booking, the card number is encrypted before storage using the application's own key-based encryption, and is only ever decrypted by an explicitly authorized staff member completing a manual charge with a supplier. The short security code printed on the back of the card is collected only on the booking form, is encrypted immediately, is kept only so an authorized administrator can complete that manual charge, and is permanently deleted as soon as the payment is recorded — and in every case no later than 24 hours after the customer signs the booking form. It is never included in emails or shown to anyone other than an administrator. We do not claim any particular payment-industry certification (such as PCI DSS) for this functionality.
Account sign-in (CRM staff)
Staff accounts sign in to the CRM with Google Sign-In. We receive the basic profile information Google provides (name, email address) to identify the account; we do not receive or store the Google account password. A staff member may separately, explicitly connect their own Gmail account so the CRM can send email (such as a quote) on their behalf — this is a distinct authorization from signing in, limited to sending mail, and can be disconnected at any time.
Cookies and local storage
This website and the CRM application use a session cookie to keep a signed-in user logged in, and browser local storage to remember a visitor's light/dark theme preference. We do not use advertising or third-party tracking cookies.
Security measures
Access to customer data within the CRM is restricted by role and by which records a given staff account is permitted to see. Sensitive actions (such as revealing a stored card number) are logged, rate-limited, and require a recent sign-in. All traffic to this website and the CRM is served over HTTPS.
Service providers
We use Google (for sign-in and, where connected, Gmail sending), a managed PostgreSQL database provider, and Vercel (for application hosting) to operate Compass Tools. We do not sell any information — from this website or from the CRM — to third parties.
Data retention and deletion
We retain information for as long as reasonably necessary to provide the service and maintain accurate business records. A travel agency administrator can remove a stored payment card from the CRM at any time. To request deletion of information you submitted through this website's Contact form, or to ask a question about data a travel agency has entered about you, use the contact details below.
Changes to this policy
We may update this policy from time to time. The date above reflects the most recent revision.
Contact
Questions about this policy, or a request regarding your information, can be sent through our Contact page.