Last updated 24 October 2026
This policy explains what personal data Compamin processes, why, who we share it with, how long we keep it, and how you can exercise your GDPR rights.
Compamin (compamin.com) is a web service for company administration: cap tables, board work, documents and e-signing. You can reach us about anything in this policy at hello@compamin.com.
For website, account, security, support and email-delivery data, Compamin is the data controller. For the company records that a workspace owner enters (shareholders, transactions, meetings, documents, invitations), the workspace owner is the controller and Compamin acts as their processor. A data processing agreement is available on request.
Account data: name, email address, password (stored only as a salted hash), email-verification status and the company roles you hold.
Workspace data entered by you or your colleagues: company details, shareholder and transaction records, board meeting materials, uploaded documents, invitations, signature requests and audit-log entries that record who did what and when.
Technical data: IP address and browser (user agent) where needed for sign-in, security, and the evidence trail of electronic signatures; and the essential cookies listed in our cookie policy.
Communications: the transactional emails we send you (verification, invitations, signature requests) and any messages you send to us.
We do not sell personal data, do not use it for advertising, and do not make decisions about you based solely on automated processing or profiling.
To create and run your account, authenticate you, and provide the features you use: performance of a contract (Art. 6(1)(b)).
To keep the service secure, prevent abuse, keep audit trails and answer support requests: our legitimate interests (Art. 6(1)(f)). You can object to this processing (see your rights below).
To meet accounting, corporate-law and other legal obligations: legal obligation (Art. 6(1)(c)).
Optional analytics: only with your consent (Art. 6(1)(a) and the ePrivacy rules on storing or accessing information on your device). Analytics is off by default, and nothing is loaded until you choose "Allow analytics". You can withdraw consent at any time via "Cookie settings" in the footer; withdrawing is as easy as giving it.
We use a small number of providers that process data on our behalf under data processing terms: Cloudflare (application hosting, document storage, DNS and security); Supabase (database, hosted in the EU, Ireland); and Resend (delivery of transactional email).
Within a workspace, other members can see the data their role allows, including your name and email address if you are a member. If you are invited, the person inviting you sees that you were invited and whether you accepted.
We disclose data to authorities only when legally required.
Our database is located in the EU. Some providers (for example Cloudflare and Resend) are US companies or operate globally, so limited personal data such as email address and request metadata may be processed outside the EEA. Where that happens we rely on an adequacy decision such as the EU–US Data Privacy Framework or on the EU Standard Contractual Clauses.
Account data is kept while your account is active. Deleted accounts are removed from active systems within 30 days of a verified request, except where we must keep data by law; backups roll off on the provider's normal schedule.
Workspace data and audit logs are kept for as long as the workspace exists, because they document company decisions; the workspace owner decides what to delete. Invitations expire after 7 days. Email-verification tokens are short-lived and expire automatically. Your cookie choice is remembered for up to 6 months.
You have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time. Email hello@compamin.com and we will respond within one month. We may need to verify your identity first.
For company records inside a workspace, we will pass your request to the workspace owner, who decides on it as controller.
You also have the right to complain to a supervisory authority. In Norway this is Datatilsynet (datatilsynet.no); you may also contact the authority in your own EU/EEA country.
Data is encrypted in transit (HTTPS). Passwords are hashed, access is limited by role, sensitive tokens such as email-verification tokens are stored hashed, and material actions are recorded in an audit log. Access to production systems is restricted to the service operator.
No system is perfectly secure. If a personal-data breach affects you, we will notify you and the relevant authority as required by law.
Compamin is a business tool and is not directed at children. If you believe a child has provided personal data, contact us and we will delete it.
We will update this policy when we add processors, change what we collect, or switch on analytics. Material changes are announced in the app or by email. The date at the top shows the latest version.