Privacy Policy

Last updated: January 8, 2026

At ComposeIt Technologies (Private) Limited ("ComposeIt", "we", "our", or "us"), a company incorporated under the laws of Zimbabwe (Company Registration No. 137770A0292026), headquartered at 12417 Unit C, Acacia Village, Westgate, Harare, Zimbabwe, we are committed to protecting your privacy and handling data with the utmost transparency and security. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access our website, use our visual canvas builder, or integrate our document automation REST APIs (collectively, the "Services").

1. Our Role: Data Controller vs. Data Processor

Depending on your relationship with ComposeIt and the nature of the data being handled, we operate in two distinct capacities under data protection laws (such as the EU/UK General Data Protection Regulation, or GDPR):

2. Zero-Retention & Ephemeral Architecture

Document automation should never compromise data privacy. We engineered ComposeIt with privacy-by-design and data minimization principles at its core:

• Volatile In-Memory Processing: Variables, customer records, and dynamic database payloads sent to our rendering endpoints are processed strictly in volatile RAM during compilation and are never saved or logged to persistent databases.
• Automatic 24-Hour File Purge: All generated documents (PDFs) and exported image assets stored temporarily in our cloud object storage (e.g. Cloudflare R2 / AWS S3) to allow download or webhook ingestion are permanently and automatically purged within 24 hours.
• Zero-Storage HTML & MJML: HTML and MJML email generations are rendered on-the-fly and streamed directly back to your application without ever being written to disk or saved in cloud storage.

3. Information We Collect

3.1 Account and Billing Information

When you register for an account or subscribe to a paid tier, we collect your name, email address, password hash, company name, and billing preferences. Financial payment details (such as credit card numbers) are collected and processed directly by our authorized Merchant of Record, Dodo Payments, and are never stored on ComposeIt servers.

3.2 Technical Usage and Telemetry Data

When you navigate our website or use the application, we automatically collect technical diagnostics, including IP addresses, browser type, operating system, referring URLs, API request status codes, and aggregate feature usage metrics to optimize performance and prevent platform abuse.

3.3 Cookies and Tracking Technologies

We use strictly necessary cookies to keep you signed in and secure your session, as well as performance analytics cookies (via privacy-conscious platforms like PostHog hosted within the European Union) to understand user engagement. You can manage or decline analytics cookies at any time via our on-site cookie banner or through your browser settings.

4. Artificial Intelligence & Third-Party LLM Usage

ComposeIt provides an AI Document Template Generator that allows users to create visual layouts and schemas from plain-text prompts. When using this feature:

• Your prompt text and design specifications are transmitted to third-party AI foundation model providers (such as Google Gemini) via enterprise API endpoints strictly to generate template markup.
• No Model Training: Under our enterprise API agreements, your prompt data and template structures are not used to train or improve public foundation models.
• Live customer document payloads and database merge records are never passed to AI models during generation.

5. Legal Bases for Processing (GDPR)

If you are an individual located within the European Economic Area (EEA) or the United Kingdom, our legal bases for collecting and processing your personal data under Article 6 of the GDPR are:

• Performance of a Contract: To create and manage your account, execute requested document generations, and deliver customer support.
• Legitimate Interests: To protect the security and integrity of our systems, prevent fraud, and improve our platform features.
• Legal Obligation: To maintain required financial, accounting, and tax records in accordance with applicable law.
• Consent: Where you have granted explicit consent, such as opting in to non-essential analytics cookies or promotional emails.

6. Third-Party Service Providers and Sub-processors

We do not sell, rent, or monetize your personal information. We share information only with trusted third-party sub-processors who adhere to strict data security and confidentiality agreements:

• Payment Processing: Dodo Payments (acting as Merchant of Record for billing and transactions).
• Cloud Infrastructure & Ephemeral Storage: Cloudflare (R2 object storage) and AWS (S3 object storage) subject to our automated 24-hour file purge.
• Product Analytics & Telemetry: PostHog (hosted on European infrastructure at eu.i.posthog.com) and Google Analytics for aggregate telemetry.
• AI Foundation Models: Google Gemini (strictly for AI template generation features).
• Legal Compliance: When compelled by valid legal subpoenas, court orders, or applicable regulations.
• Business Transfers: In connection with any merger, acquisition, financing, or sale of company assets, with notice provided to affected account holders.

7. International Data Transfers & EU Sovereignty

ComposeIt supports dedicated EU processing pipelines where rendering workloads, template configurations, and data for European Union customers are processed on servers located within the EU. Where cross-border data transfers occur, we rely on standard contractual clauses (SCCs) approved by the European Commission, along with technical encryption controls, to ensure your personal data remains protected to GDPR standards.

8. Data Retention Policy

We retain your account information for as long as your account remains active. If you delete your account or request data deletion, your account information and saved template files will be permanently purged within thirty (30) days, except where retention is required by applicable tax or financial audit regulations. As noted in Section 2, all ephemeral document generation files are permanently deleted within 24 hours of creation.

9. Your Data Protection Rights

Depending on your location, you have strong legal rights regarding your personal information, including:

• Right to Access: You may request a copy of the personal information we hold about you.
• Right to Rectification: You can correct inaccurate or incomplete account details directly through your account settings or by contacting us.
• Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and personal data.
• Right to Restrict or Object: You have the right to restrict or object to our processing of your personal data under certain circumstances.
• Right to Data Portability: You may request an export of your template configurations and account data in a structured, machine-readable format.
• Right to Withdraw Consent: You can withdraw consent previously granted for analytics or marketing at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a competent Data Protection Supervisory Authority in your jurisdiction.

To exercise any of these rights, please submit a request to privacy@composeit.app. We respond to all verified requests within thirty (30) days.

10. Notice for California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents are entitled to specific disclosures. In the preceding 12 months, ComposeIt has collected identifiers (name, email, IP address) and commercial internet activity data solely for business operations. ComposeIt does not sell or share personal information with third parties for cross-context behavioral advertising.

11. Children's Privacy

The Services are designed solely for businesses, developers, and professionals. Our platform is not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. If we become aware that personal data of a minor has been collected without parental consent, we will take prompt steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our technology, security practices, or legal obligations. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where appropriate, displaying a prominent notice within your account dashboard.

13. Contact Us & Data Protection Inquiries

If you have questions, feedback, or data privacy requests regarding this Privacy Policy or our data protection practices, please reach out to our privacy team:

By using ComposeIt, you acknowledge that you have read, understood, and agree to the data collection and processing practices described in this Privacy Policy.