Compound OS Privacy Policy

Effective date: 5 October 2026

Compound OS is an internal construction management application operated by Compound Group Limited (“Compound”, “we”, “us” or “our”). It is designed for authorised Compound personnel to access and manage information relating to Compound’s business and construction projects.

This Privacy Policy explains the information processed through Compound OS, why we use it, how it is protected, and the choices available to users.

Compound handles personal information in accordance with applicable privacy requirements, including the New Zealand Privacy Act 2020.

1. Information we collect and process

Depending on how Compound OS is used, we may collect and process the following information:

Account and user information

  • Name

  • Email address

  • User account identifier

  • Role, permissions and other information associated with a Compound OS account

  • Authentication and account access information

Project and business information

Information entered into or accessed through Compound OS in connection with Compound’s projects and business activities, including:

  • Project information

  • Construction programmes and key dates

  • Tasks and notes

  • Timesheet and time-entry information

  • Project records

  • Drawings, documents and other files

  • Expense and receipt information

  • Other information entered by authorised users

Messages and user-generated content

Compound OS provides communication and collaboration functionality. We may therefore process:

  • Messages between users

  • Replies and reactions

  • Notes and comments

  • Photos and images uploaded or captured by users

  • Image markup and annotations

  • Attachments and other user-generated content

Device and technical information

We may process limited technical information required to securely operate and support Compound OS, including:

  • Device or application identifiers used to provide application functionality

  • Push-notification registration information

  • Authentication and session information

  • Technical information required to maintain the security, reliability and performance of the application

Compound OS may request access to device features such as the camera or photo library when a user chooses to take or attach a photo or capture a receipt.

2. How we use information

Information processed through Compound OS is used to:

  • Provide and operate Compound OS

  • Authenticate users and manage authorised access

  • Manage Compound construction projects and business activities

  • Enable project and team communication

  • Provide drawings, documents, programmes, tasks, timesheets and other project-management functionality

  • Record expense and receipt information

  • Upload and manage photos, files and other project information

  • Send relevant application and project notifications

  • Maintain application security and reliability

  • Diagnose and resolve technical problems

  • Meet Compound’s legal, contractual and business record-keeping obligations

We do not use Compound OS user information for third-party advertising.

We do not sell Compound OS user information to data brokers.

3. Sharing and service providers

Compound may use third-party technology and infrastructure providers to host, secure, operate and support Compound OS.

Information may be processed by these providers where necessary to provide their services to Compound. We require service providers handling Compound OS information to provide appropriate protection for that information and to use it only for the purposes for which it has been provided.

Information may also be disclosed where required by law, regulation, legal process or a lawful request from an authority.

Compound OS is an internal business application. Project and business information may be accessible to other authorised Compound users where this is required for their role or for the operation of a project.

4. Data retention

We retain information for as long as reasonably necessary for the purposes for which it was collected, including operating Compound OS, managing construction projects, maintaining business and contractual records, resolving disputes and meeting legal or regulatory obligations.

Retention periods may therefore differ depending on the type of information and the project or business purpose for which it is held.

Device push-notification tokens are deleted from our servers when a user signs out of the application.

When information is no longer reasonably required, it may be deleted, anonymised or securely retained where continued retention is required by law or legitimate business record-keeping requirements.

5. Account and data deletion

Compound OS accounts are provided to authorised users for business purposes.

Authorised users can submit an account deletion request directly within Compound OS by navigating to:

Settings → Security & privacy → Request account deletion

Users may also contact Compound to request access to, correction of, or deletion of personal information associated with their Compound OS account.

Where an account is no longer required, Compound may disable or delete the account and remove associated personal information where appropriate.

Some project, contractual, financial, health and safety, employment, communication or other business records may need to be retained where required for legitimate business purposes or by law. Where information must be retained, access will be limited as appropriate.

6. Device permissions

Compound OS may request access to certain device features when they are required for a function selected by the user.

For example:

  • Camera — when a user chooses to capture an expense receipt, site photo or task attachment.

  • Photos — when a user chooses to attach an existing image.

  • Notifications — to provide relevant messages and application notifications.

Users can manage device permissions through their device settings. Disabling a permission may prevent the associated Compound OS feature from operating.

Where enabled by the user, biometric authentication such as Face ID, Touch ID or device fingerprint authentication is performed entirely on the device using the operating system's secure authentication functionality. Compound OS does not access, transmit or store users' biometric data.

7. Security

Compound takes reasonable technical and organisational measures to protect information processed through Compound OS against unauthorised access, disclosure, alteration, loss or misuse.

Access to Compound OS is restricted to authorised users and is subject to authentication and application permissions.

Information transmitted between the application and Compound OS services is protected in transit. Access to stored application data is controlled through application and database access controls.

No electronic storage or transmission system can be guaranteed to be completely secure, and users should promptly notify Compound if they believe their account or information has been compromised.

8. International processing

Some technology providers used to operate Compound OS may process or store information outside New Zealand.

Where information is processed outside New Zealand, Compound takes reasonable steps to ensure that appropriate safeguards apply to the handling of that information.

9. User rights and privacy choices

Users may contact Compound to:

  • Request access to personal information held about them

  • Request correction of inaccurate personal information

  • Request deletion of personal information where applicable

  • Ask questions about how their information is used

  • Raise a privacy concern

Users can also manage permissions such as camera, photo and notification access through their device settings.

Rights may be subject to applicable law and to legitimate requirements to retain particular business or project records.

10. Children

Compound OS is an enterprise construction management application intended for adult workforce personnel aged 18 and over.

Compound OS is not directed at, designed for, or intended to be used by children.

11. Changes to this policy

We may update this Privacy Policy when Compound OS, our business practices or applicable requirements change.

The current version will be made available through Compound OS and/or the Compound website. The effective date at the top of this policy identifies when it was last updated.

12. Contact

For questions, requests or concerns relating to privacy or Compound OS, contact:

Compound Group Limited
Queenstown, New Zealand

Email: drew@compound.co.nz
Website: www.compound.co.nz

Privacy requests, including requests relating to access, correction or deletion of personal information, can be made using the contact details above.