Privacy Policy

1. Who we are

Marguerite Route Compass is operated by Northrule Ltd, a company registered in England and Wales. When we say “we”, “us” or “our” we mean Northrule Ltd. This policy covers this website and our WhatsApp compass service. Questions? Email hello@northrule.com.

2. What data we collect

Browsing the site

• Device and browser information, and approximate location from your IP address
• Pages visited, time on site, and referral source (via analytics, see Section 6)

Using the WhatsApp compass

• Your WhatsApp phone number, so we can recognise your subscription and reply to you
• Location pins you send, to calculate the nearest point on the route
• The messages you send to the bot, and the replies we send back

Subscribing & paying

• Your email address and subscription status
• Payment is processed by Stripe, we never see or store your full card details, only your billing email and a transaction reference

3. How we use your data

• To provide the compass, check your subscription and reply to your location with directions back to the route
• To take and manage your subscription payment via Stripe
• To operate, secure, and improve this site and the service
• To understand how visitors use the site, via analytics (see Section 6)

We do not sell your personal data, and we do not use your location or messages for advertising.

4. How we protect your data

We designed the compass to hold as little identifiable data as possible:

• Your phone number is never stored in plain text, only as a one-way cryptographic hash (to recognise your subscription) and, separately, in encrypted form
• Your location and message history are stored against an internal reference, not your phone number
• Data is held on secured servers and transmitted over encrypted connections

5. Legal basis (UK GDPR)

• Contract, processing your number, location and payment data is necessary to provide the service you subscribe to
• Legitimate interest, operating, securing and improving the site and service, and preventing fraud
• Consent, analytics cookies (see Section 6)

If you are in the EU, the equivalent rights under the EU GDPR apply.

6. Cookies and tracking

We use Google Analytics (GA4) through Google Consent Mode v2: on your first visit, tags load in a denied, cookieless state and set no analytics cookies until you accept. When you pay, Stripe’s checkout uses its own cookies for secure payment and fraud prevention.

You can change or withdraw your choice at any time using the Cookie settings link in the footer.

7. Who we share your data with

• Meta Platforms (WhatsApp), delivers messages between you and the compass
• Stripe, processes subscription payments
• Google, analytics, and Google Maps for the directions link in our replies
• Cloudflare, content delivery, DNS, and protection
• Our hosting provider, hosts the site and service on our behalf

We do not sell your personal data to any third party.

8. Data retention

• Subscription records, kept while active and afterwards as needed to run the service
• Message and location logs, kept only as long as needed to operate and improve the service
• Payment records, retained for 7 years as required by HMRC
• Analytics data, retained according to Google’s own retention policies

9. Your rights

Under UK GDPR (and EU GDPR where it applies) you can access, correct, delete, or port your data, and object to or restrict certain processing. To exercise any right, email hello@northrule.com; we respond within 30 days. You can stop the compass at any time by cancelling your subscription and messaging STOP to the bot.

10. Children

The service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time, posting the new version here with a revised date.

12. Complaints

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ICO). If you are in the EU, you may complain to your local authority (in Denmark, Datatilsynet).