Privacy policy

1. Who we are

Composal is operated by L6 Software LTD, trading as Composal, a company registered in England and Wales with company number 17436925. Our registered office is 3rd Floor 1 Ashley Road, Altrincham, Cheshire, United Kingdom, WA14 2DT. Contact support@composal.com for privacy questions or requests.

This policy explains how we collect, use, store, share, and delete personal information when you visit composal.ai, composal.com, or use our web, desktop and mobile apps and related services. Composal helps teams test web applications with AI browser agents, run acceptance tests, explore user journeys, and review findings with recordings and reproduction steps.

We act as a controller for account, billing, support, and service-operation information. When an organisation provides personal information in its applications, test data, or connected sources for us to process on its behalf, that organisation determines the purposes of processing. Its own privacy notices and any applicable data-processing agreement also apply.

2. Information we collect

• Account information: your name, email address, profile image, sign-in provider identifier, password hash if you use a password, organisation memberships, roles, and account preferences.
• Information you provide: support messages, feedback, project URLs, instructions, specifications, test scenarios, uploaded files, and other workspace content.
• Testing and connected-service information: content made available through integrations you enable, test-account credentials or session information you supply, browser interactions, page content, screenshots, recordings, logs, and test results. These can contain personal information visible in the application you ask us to test.
• Technical and usage information: IP addresses, browser and device details, request and error logs, feature usage, timestamps, and identifiers used to operate, secure, and understand the service.
• Billing information: billing contacts, subscription details, payment status, and transaction references. Payment providers process payment details under their own privacy policies.

We receive information directly from you, from your organisation and its users, from services you connect, and automatically when you use Composal. Please use disposable test accounts and avoid submitting sensitive personal information unless necessary and you have authority to do so.

3. Google, GitHub and Apple sign-in

If you choose Google sign-in, we request the openid, email, and profile permissions. Google supplies your account identifier, email address, name, and profile image where available. We use this information to authenticate you, create or link your Composal account, display your profile, and operate and protect your account. Google sign-in does not give us access to your Gmail messages, Google Drive files, contacts, or calendar.

• Access and use: we exchange your Google sign-in authorisation code for an access token and use it to request your basic profile from Google's user-information API. Your Google account identifier links future sign-ins to your Composal account. Your email, name, and profile image populate your account profile. The sign-in token is used to retrieve this profile rather than stored as an ongoing Google connection.
• Storage and protection: your Google account identifier, email, name, and profile-image URL are stored in our service database with your Composal account. They are covered by the access controls and encrypted connections described in section 7. Authorised personnel may access them for support, service operation, security, or legal obligations as described in section 5.
• Sharing: providers operating our hosting and storage systems process these account details to run Composal. Your account name and email may also be sent to PostHog, our service analytics provider, to associate service usage with your account. Your profile information may be visible to people with access to your workspace. The disclosures for legal requirements and corporate transactions in section 5 also apply to Google-derived account information.
• Retention and deletion: we retain Google-derived account information while it is needed to operate your account and for the purposes described in this policy. To request its deletion, email support@composal.com and identify the Composal account concerned; do not send your Google password or access token. We may verify your identity and coordinate with your organisation. The legal exceptions and backup retention described in section 8 also apply to this information.

GitHub sign-in similarly uses your GitHub identifier, email, name, and profile image. Signing in is separate from granting repository access through a connected integration. Additional integrations access the information covered by the permissions you grant and the features you choose to use.

If you choose Sign in with Apple in the iOS app, Apple supplies an account identifier and an email address, which may be an Apple private relay address if you choose Hide My Email. We verify Apple's authorisation to sign you in and store that identifier and email with your Composal account. We also store encrypted renewable authorisation so we can revoke Apple access during account deletion. A matching email address alone does not automatically link Apple to an existing Composal account. This sign-in does not give Composal access to your iCloud files, photos, contacts or messages. The account-use, sharing, security and deletion provisions in this policy also apply to Apple sign-in information.

We do not sell Google user data or use it for advertising. We do not use information obtained through Google sign-in to train general-purpose AI models. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where applicable.

You can revoke Google access through your Google Account connections and GitHub access through GitHub settings. Revoking access stops future authorised access but does not automatically delete your Composal account or information already stored. Contact us to request deletion. If Google or GitHub is your only sign-in method, contact us before revoking it if you need continued account access.

4. How and why we use information

We use information to provide accounts and workspaces, run tests and browser agents, generate reports, operate integrations, process subscriptions, respond to support requests, send service notices, troubleshoot failures, prevent abuse, and improve the service.

Under UK data protection law, our lawful bases depend on the activity: performance of a contract for providing the service you request; legitimate interests for running, securing, supporting, and improving Composal and managing business relationships; compliance with legal obligations for required records and lawful requests; and consent where required, including for optional marketing or optional tracking. You can withdraw consent without affecting processing that was lawful before withdrawal.

Browser agents and AI may analyse the instructions, page content, screenshots, and other context needed for the task you initiate. This information may be processed by AI and browser-infrastructure providers to produce test actions and findings. Do not include information you are not authorised to share. Test results are advisory and are not decisions about an individual's legal rights or eligibility.

5. Who receives information

Workspace information and reports are available to users with access to the relevant workspace and to destinations you choose, such as a connected repository. Your organisation's administrators may manage access to workspace content and account information associated with that organisation.

We use providers for hosting, storage, AI processing, browser execution, analytics, payment processing, and communications. They receive information needed to perform those services. For example, our implementation uses OpenAI for AI agent processing and PostHog for service analytics. Provider availability may change as the service develops.

Authorised personnel may access information when needed to provide support, operate the service, investigate security issues, or meet legal obligations. We may disclose information when required by law, to protect rights and safety, or in connection with a corporate transaction, subject to applicable data-protection requirements. We do not sell personal information.

6. Cookies, storage, and analytics

We use session cookies and browser storage to keep you signed in, protect requests, and remember settings. Server-side service analytics records account and feature activity. You can control cookies and storage in your browser, although blocking essential storage may prevent sign-in or other features from working.

We use PostHog across our website, Reflog and signed-in product, including authentication pages, to measure visits and interactions and record sessions. Analytics includes page URLs and titles, clicks and form interactions, browser errors, console logs, performance data, IP addresses and approximate location. Recordings may show ordinary page text and input values. Passwords and explicitly marked secret fields and containers are protected, and credential values are removed from captured URLs.

First-party analytics cookies preserve visitor and session identifiers for up to 365 days. When you sign in, we associate browser activity with your account. Signing out resets the analytics identity and collection continues anonymously. Internal-user filters exclude staff from analytics reports. This integration does not use the browser's Do Not Track setting to disable collection. Confirmed demo bookings are recorded separately from clicks expressing interest in a demo.

Mobile apps, local storage and voice

The iOS and Android apps save conversation history, workspace information, preferences and unsent drafts, including attachments and model choices, on your device for offline use. It refreshes saved information when connected. Signing out removes the active account and organisation's saved data from the app; this does not delete information held by the service.

Before using AI features in the iOS app, you can review and allow the sharing of your messages, conversation context and chosen attachments with the provider of your selected model, and relevant information with integrations you enable. Providers may include OpenAI, Anthropic, Google and xAI. Dictation and voice calls send microphone audio to OpenAI for transcription or spoken responses after you start recording or a call. Dictation inserts text into a draft for you to review and send. You can withdraw this device's AI-sharing permission in Settings → Privacy & AI; this prevents new requests from that app, but does not stop agent work already running elsewhere.

If you report AI-generated content in the app, the selected message excerpt, your explanation, message and workspace identifiers, account identity, platform and app version are sent to Composal staff to review the report. Other messages and attachments are not included in the report.

7. Storage, security, and international processing

Information is stored in our service databases, object storage, and systems used by the providers described above. We use measures such as access controls, encrypted connections, and password hashing to protect information. No system can guarantee absolute security.

Our service and providers may process information outside the United Kingdom, including in the United States. International transfers are subject to applicable data-protection requirements, including an adequacy decision or appropriate contractual safeguards where required. Contact us for information about the locations and safeguards applicable to your use of Composal.

9. Your rights and choices

Depending on applicable law, you may request access to your personal information, correction, deletion, restriction of processing, or a portable copy. You may object to processing based on legitimate interests and withdraw consent where processing relies on consent. These rights are subject to legal conditions and exceptions. Contact support@composal.com to make a request; we will respond within the applicable statutory period.

You can also complain to the UK Information Commissioner's Office or your local data-protection authority. We welcome the opportunity to address your concern first. If an organisation controls the information concerned, you can also contact its administrator or privacy contact.

10. Children and policy updates

Composal is a business service intended for adults and is not directed at children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We may update this policy as the service or legal requirements change. We will publish the updated version here and provide additional notice of material changes where required. Any new use of Google user data requiring consent will be disclosed before that use begins.