Data protection
Access Compass · accesscompass.uk · last updated 2 October 2026
Access Compass has no accounts. Your settings, access profile and saved items stay on your own device and are not sent to us. That is true for every edition of the app, wherever it is used. We receive information only when you choose to send a report, when the app checks the video report counts, and in the standard logs of the servers that run the service. This statement sets out what that means under UK data protection law and, for our Victoria (Australia) edition, Australian privacy law. It covers the services the app relies on, your rights, and what an organisation needs to know before offering Access Compass to the people it serves.
1. Who is responsible for your data
Access Compass is provided by ADAI Digital Ltd ("we", "our", "us"), company number 17242851. Registered in England and Wales. Our registered office is Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE. You can check the official Companies House record. We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC208103 (check our ICO registration).
For anything you do inside the app on your own device, you remain in control of that information: it is held on your device, not by us. We are the data controller for the reports you choose to send us, for emails you send us, and for the standard logs of the servers that run the service. Our contact point is admin@adaidigital.co.uk.
2. Which law applies to you
Access Compass is offered in different regional editions. Every edition works the same way. Which privacy law and regulator applies depends on where you are:
- UK editions (for example Northamptonshire, Bedfordshire, Rutland, Warwickshire, Essex, Cambridgeshire and Accessible Air Travel): UK GDPR and the Data Protection Act 2018, regulated by the Information Commissioner's Office (ICO).
- Victoria, Australia edition: the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), regulated by the Office of the Australian Information Commissioner (OAIC).
What we actually do with your information is the same everywhere. The difference is mainly which law and regulator's name applies.
We have not appointed a data protection officer. Questions about privacy go to our data protection lead at ADAI Digital, at admin@adaidigital.co.uk.
3. What the app stores, and where it lives
Everything you set or save in Access Compass is stored in your own browser's storage on your device. It is not transmitted to us and there is no login that could link it to you.
| Information | Where it is stored | Who can see it |
|---|---|---|
| Items you save from the directory | Your device only (browser storage) | Only you, on your device |
| Your access profile | Your device only | Only you, on your device |
| Journey support plans, assistance requests, mobility-aid details and booking references | Your device only | Only you, on your device, unless you choose to share a plan |
| Display choices (text size, theme, contrast, reading font) | Your device only | Only you, on your device |
| A report that could not be sent yet, including any name and contact you typed | Your device, until the report reaches us | Only you, on your device, until it is sent |
| The videos you have reported | Your device only | Only you, on your device |
Because this data lives on your device, you can remove all of it at any time by clearing the site's storage in your browser. For this device data there is nothing for us to delete on your behalf, because we never held it.
4. What we, and our website host, actually receive
- Every visit. Like any website, the service that sends you the pages receives your device's internet address, your browser type and the address being requested. This is used to deliver the page and to keep the service secure and reliable. Firebase Hosting, the Google service that sits in front of our server, sees your internet address. It keeps internet addresses for a few months, as Firebase states. The log on our server itself shows Firebase Hosting's address, not yours, for requests that come through it.
- The video report count check, on every visit. When the app opens, and about every 5 minutes while it is open, it asks our server how many reports each video has had. The request sends no cookies, nothing you have saved and not the page you are reading. Like any request, it passes through Firebase Hosting, which sees your internet address and browser type. Many of these requests may be answered by Google's cache, so they never reach our server.
- A correction, if you send one. What you wrote, the item and page it is about, the time, and a name and reply route only if you add them.
- A video report, if you send one. Your ticks, any note, the time, the video, the place and the page. No name or contact details. Scrambled codes made from your internet address, so each person counts once and no connection can send too many reports. The report form says: "We keep what you tick, any note you write and the page you were on. A scrambled code made from your connection lets us count each person once. We never store your address. We delete it after 90 days."
- An email, if you send one, to admin@adaidigital.co.uk.
We do not use any of this to build a profile of you, we do not run advertising or tracking scripts, and we do not combine it with anything you set in the app. Our Privacy Policy gives the full detail of each one.
5. Lawful basis for processing
For each kind of processing we carry out, our lawful basis under UK GDPR is our legitimate interests:
- serving the website, and keeping it secure and working, including our server logs
- the video report count check, so a reported automatic video can be hidden quickly
- reviewing corrections, so the directory stays accurate, and replying if you asked us to
- reviewing video reports, counting each person once, and stopping misuse
- replying to emails you send us
Under the Australian Privacy Principles, this same handling is the minimum reasonably necessary to run the service and to respond to you, collected directly from you.
6. Access needs and other sensitive information
Some of what you may enter, such as your access profile, could relate to health or disability. Under UK GDPR this would be special-category data; under the Australian Privacy Principles it would be sensitive information, both of which carry extra protection. This is exactly why the app keeps it on your device and never sends it to us, wherever you are. We do not receive it, store it, or share it. If you choose to share a journey support plan, the previewed text goes directly from your device to the recipient you choose. Booking references, contact details and private notes are excluded by default.
A correction or video report is free text that you write. The forms ask you not to include health details, case details, safeguarding information or anyone else's personal information.
7. Services the app relies on
Access Compass is a Progressive Web App (a website that can work like an app). It relies on the services below. None of them receives your saved items or your access profile.
| Service | Purpose | What is sent |
|---|---|---|
| Google Firebase Hosting | Serving the website securely | Standard request data (section 4) |
| Our server at adaidigital.co.uk, on Google Cloud Run in London, with Google's Firestore database | Receiving corrections and video reports for review, and answering the video report count check | The report fields you enter (section 4), and standard request data for every count check that reaches it |
| Google Cloud Logging | Standard logs of requests that reach our server. We keep them for 30 days | Standard request data (section 4) |
| Google Workspace | Our email inbox | Emails you send us |
Some parts of the app also come straight from other services, which your device asks directly: map pictures (OpenFreeMap), video pictures and videos (YouTube), the weather (Open-Meteo), nearby accessible facilities (Overpass API, from OpenStreetMap data), place and postcode lookups (Photon by komoot, and postcodes.io), and the optional Access Mate download (Hugging Face and GitHub). Each sees your internet address and only what that feature needs. The place photos come from Wikimedia Commons under their open licences. They load from Wikimedia's servers, which may set their own cookie (WMF-Uniq). See the Wikimedia privacy policy. Our Privacy Policy says when each one is used, what it receives, and links to its privacy notice.
Where you choose to follow a link out to a listed service's own website, that takes you to a third party whose terms and privacy practices then apply, as set out in our Terms of Service.
8. International transfers
Our server runs in London, in Google Cloud's europe-west2 region. The reports it receives are stored in Google's database (Firestore), which is in London too. Google may handle some data outside the UK, for example to deliver pages from a location near you. Google's data processing terms say that when Google sends information to a country the UK does not treat as adequate, it uses an approved safeguard that it tells us about, or standard contractual clauses. We have accepted Google's data processing terms for this project. The services your device asks directly (section 7) may be outside the UK and outside Australia. Under the Australian Privacy Principles, reports from our Victoria edition are stored in the UK.
9. How long data is kept
- Data you set or save in the app stays on your device until you remove it. We do not hold copies.
- Video reports are deleted 90 days after they arrive. The scrambled codes are deleted up to 30 days after your last report about that video (one person and one automatic video), or sooner if we decide about the video. The other code (one connection and one day) is deleted after 2 days.
- We delete correction reports 6 months after they arrive.
- We keep our server's request logs for 30 days, Google Cloud's standard setting.
- Emails: we delete emails we no longer need. We review them at least once a year.
10. Your rights
If you are in the UK, under UK GDPR you have rights over your personal data, including the right to access it, correct it, erase it, restrict or object to its processing, and, in some cases, to data portability. If you are in Australia, the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) give you broadly equivalent rights to access and correct your personal information. Because your app data is on your own device, many of these you can exercise directly and immediately: you can view, edit and delete it yourself, without asking us. For anything we do hold, such as a report or an email exchange, contact admin@adaidigital.co.uk and tell us the receipt number the app showed you, if you have one. We will respond within one month.
11. Children
Access Compass lists support services for children as well as adults, and is intended to be used by families, carers and professionals. It does not create accounts or ask for personal details in ordinary use. The optional feedback form asks reporters not to include children’s, safeguarding, health or other sensitive personal information.
12. Security
The app is served over an encrypted connection and runs no user accounts or passwords. The only information we hold centrally is the reports people choose to send and our server logs. Our approach is set out in our security overview.
13. Data breaches
We hold no accounts and none of the data you save in the app. If a reportable breach affecting personal data we do control ever occurred, such as the reports or logs, we would assess and, where required, report it to the ICO within 72 hours and inform anyone affected.
14. For organisations considering Access Compass
Access Compass is designed to be straightforward for a local authority, NHS body, Australian state or NDIS provider, charity or other statutory organisation to offer to the people it serves. In normal use, the only personal data that reaches ADAI Digital is the internet address and browser type in the standard request data, including the video report count check. A report reaches us only when a person chooses to send one. This helps with assessment, whether your process is a UK Data Protection Impact Assessment (DPIA) or an Australian Privacy Impact Assessment (PIA).
- Roles. In ordinary use we do not act as your data processor (UK) or your contracted service provider handling personal information (Australia), because the app does not send us your people's data. Where a formal arrangement is needed, we will enter an agreement that reflects the actual data flows.
- Assessment support. We will support your DPIA or PIA and provide the data-flow information above in the format your information-governance team needs.
- Scope. Access Compass is an information and signposting directory. It is not a medical device and does not provide clinical, legal or financial advice.
- Accessibility. We design to WCAG 2.1 level AA as our target and keep improving. Our full position, and how we test, is in our accessibility and inclusion statement.
- Contact. Our ICO registration number is ZC208103. We have not appointed a data protection officer. For procurement or assurance questions, email our data protection lead at ADAI Digital, at admin@adaidigital.co.uk.
15. Changes and how to reach us
We will update this statement as the app develops and note the date at the top. For any data-protection question, contact ADAI Digital Ltd (company number 17242851; Registered in England and Wales; registered office: Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE) at admin@adaidigital.co.uk. If you are in the UK, you also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are in Australia, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Wherever you are, we would appreciate the chance to put things right first.
Check ADAI Digital Ltd on Companies House.
All policies · Privacy · Cookies · Security · Back to Access Compass