Privacy

Who is responsible

Composium Oy (Business ID 3568278-5), c/o Silento, Topeliuksenkatu 21 A 14, 00250 Helsinki, Finland, is the controller for personal data processed to provide Conduct A Composition. For privacy questions or requests, contact support@composium.app. This is the privacy contact; it is not described as a Data Protection Officer.

What we process and why

We process the writing and intended action you submit, the generated Card, a private Card reference and access credential, and purchase records such as amount, currency, status, and Stripe identifiers. We use these data to create and deliver your Card, protect access, resolve payment or delivery issues, and meet legal obligations.

Your writing and intended action are sent to our AI service provider, Anthropic, to generate the Card. Composium stores source material, the Card, and purchase records in its application database so the service can complete and retrieve your purchase. Stripe processes Checkout and payment details; Composium receives payment and transaction identifiers, not your full card number. Supabase provides the application database and, if you choose to use Vault, passwordless email sign-in for that authenticated access. Railway hosts the application runtime when deployed there; host and network logs may be subject to its configuration.

We do not reuse raw customer writing for analytics, advertising, or model training. We do not promise that free-text inputs cannot contain sensitive information; please avoid submitting information you do not want processed by these providers.

Storage and retention

Before submission, writing and the Click are stored in same-tab browser session storage; they are not sent to the application server until Checkout is requested. These browser copies are not cleared by server cleanup and normally end when the tab’s session ends. The application does not store a timer timestamp in browser local storage.

After submission, raw writing and Click are retained during payment and fulfillment recovery. The application targets resolution within 48 hours. If Stripe reports a completed-but-unpaid session or its payment state cannot be confirmed, cleanup is held to avoid deleting material needed for a possible paid delivery; this exceptional state may exceed 48 hours and requires manual status resolution. Once unpaid closure is confirmed, or paid fulfillment stops at the cutoff, source writing and Click are removed. Customer-requested Card deletion also removes the associated Click.

An issued Card does not automatically expire after 48 hours. Its canonical address remains stable, but the address alone does not grant access: retrieval requires the active owner capability. The current browser cookie lasts 400 days. You may additionally access an issued Card through an authenticated Vault using Supabase passwordless email sign-in (a one-time emailed link); Vault access does not duplicate the Card or change its single canonical identity.

When a Card is successfully issued, raw writing is removed in the same database update; a keyed digest remains to bind retries to the original request. The Click and Card fields remain. If fulfillment is pending or retryable, writing is retained for recovery. Unpaid Checkout Sessions are closed and source writing removed within 48 hours where Stripe confirms the session is unpaid and closed. If paid fulfillment remains unresolved for 48 hours, the application stops automatic retries, removes raw writing, and marks the purchase for manual support reconciliation. The payment record remains; no automatic refund is issued. You can contact support@composium.app for review. You can also delete an issued Card from its private page; deletion clears its contents and revokes access while retaining the reference and legally necessary payment records. Purchase and payment records may be retained for periods required by accounting, tax, and other applicable law. Stripe may separately retain information under its own legal obligations.

You can ask about your data or request deletion by contacting us; we will assess and respond under applicable law. A request cannot override records we are legally required to keep.

Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction, or portability, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it. You may also complain to the Office of the Data Protection Ombudsman of Finland.

Contact

Composium Oy · Business ID 3568278-5
c/o Silento, Topeliuksenkatu 21 A 14, 00250 Helsinki, Finland
support@composium.app