Privacy Policy

Compozor ("Compozor," "we," "us"), based in Canada, is a document-collection and client-communication tool for professional service firms (accounting, tax, legal, immigration, mortgage brokering, and similar practices). With a firm's authorization it reads the firm's connected inbox for client correspondence, collects and checks the documents clients send, drafts or sends replies, schedules meetings, and runs firm-defined workflows that prepare work from those documents.

This policy covers two different groups of people, and it says which applies where it matters:

• Firm users — the accountants, lawyers, brokers, and staff who sign up for and operate a Compozor account.
• Clients of a firm — the firm's own customers, who interact with Compozor only indirectly: by emailing the firm, or by uploading documents and completing questionnaires through a link the firm sends them. For this group, the firm is the party responsible for their data (see "Our role as a service provider," below) — questions about a specific firm's use of your information should go to that firm first.

Account & organization data. Name, email address, and authentication data (handled by our authentication provider, Clerk), plus the firm information entered during onboarding — firm name, a description of the practice, and jurisdiction.

Connected mailbox & calendar data. A firm can connect a Gmail or Microsoft 365 (Outlook) mailbox through the provider's own consent screen. We request only the permissions the features below need:

• Reading mail (Google gmail.readonly; Microsoft Mail.Read) — to read newly received messages and their attachments, match them to the firm's clients, and collect the documents clients send. Messages from senders who aren't one of the firm's clients, or whose sender can't be verified, are kept for the firm to review and may be classified automatically (for example as spam or a potential new client); they are not added to any client's file.
• Sending mail (Google gmail.send; Microsoft Mail.Send) — to send replies from the firm's own address that firm staff approve, or that the firm has chosen to send automatically.
• Calendar (Google calendar.freebusy and calendar.events; Microsoft Calendars.ReadWrite) — to check when the firm is free and to create meetings it schedules with clients.

The firm can disconnect its mailbox in Compozor, or revoke access in its Google or Microsoft account settings, at any time.

Uploaded documents. When a firm's client uploads files through a Compozor upload link, or sends them by email, we receive those files and any information entered alongside them. Depending on the firm's practice, this can include tax records, financial statements, identification documents, or immigration paperwork — whatever the firm has requested.

Questionnaire answers. When a firm asks a client to complete a questionnaire through its Compozor client portal, we receive the client's answers, including saved drafts, and keep a PDF copy of each submission for the firm. Before showing a questionnaire, we email a one-time code to the client's address on file to confirm it's them.

Work product. Reports, spreadsheets, and other files that Compozor prepares from those documents when a firm runs one of its workflows, along with a record of the steps taken to prepare them.

Usage & support data. Technical logs needed to operate and secure the service (timestamps, error reports, API request metadata), and any information provided when contacting us for support.

• To operate the service: matching emails to clients, checking and filing documents, tracking checklists, drafting or sending replies, scheduling meetings, and running the firm's workflows.
• To process email content and documents with AI models (see "Service providers & AI processing") in order to provide those features for the firm.
• To maintain and secure Compozor, including detecting and preventing abuse.
• To communicate with firm users about their account and the service.
• To comply with legal obligations.

We don't sell personal information, use it for advertising, or use a firm's or its clients' data to train AI models.

Compozor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Gmail and Google Calendar data only to provide and improve the user-facing features described in this policy.
• We transfer it to others only as needed to provide those features (for example, to the AI service provider that reads a document for the firm), to comply with law, or as part of a merger or acquisition with notice to users.
• We don't use it for advertising, sell it, or use it to develop, improve, or train generalized AI or machine-learning models.
• People at Compozor don't read it unless the firm asks us to (for example, for support), it's needed for security or to comply with law, or it has been aggregated and anonymized for internal operations.

We use the following service providers to run Compozor. Each processes data only on our instructions to provide the service, and none may use it to train general-purpose AI models or for its own purposes:

• OpenAI (United States) — reads email and document content to check and match documents, draft replies, and run workflows. OpenAI does not train its models on data sent through its API, and keeps it for up to 30 days before deleting it.
• Railway (United States) — hosts Compozor's application servers and database.
• Cloudflare R2 — stores uploaded documents and prepared files.
• Vercel — hosts the Compozor website. It does not store firm or client data.
• Clerk (United States) — handles sign-in and account sessions for firm users.
• Google and Microsoft — provide mailbox and calendar access under the firm's own authorization.
• Sentry — receives technical error reports so we can fix problems. Email and document content is removed before reports are sent.

For data belonging to a firm's clients, the firm decides what information to collect and why, and is the organization responsible for it under Canadian privacy law (such as PIPEDA and provincial private-sector privacy laws, including Québec's Law 25) and other applicable laws. Compozor processes that information only on the firm's behalf, as its service provider. Firms in the United States subject to the Gramm-Leach-Bliley Act and the FTC Safeguards Rule may rely on this section to document our role.

We keep account and client data while the firm's account is active. When a firm deletes a document, or permanently deletes an archived client, in Compozor, the stored files are removed from storage. A firm can download its clients' documents at any time, and can ask us to delete specific client records or its entire account by contacting support@compozor.com. We complete deletion requests within 30 days, unless we must keep something longer by law or to resolve a dispute. Data sent to our AI provider is deleted by it within 30 days.

We use administrative and technical safeguards designed to protect the data we hold, including encryption in transit, encryption at rest for stored documents and for mailbox sign-in credentials, separation of each firm's data, verification of an incoming email's sender before it's treated as a client's, and monitoring for security events. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach creates a real risk of significant harm, we'll notify affected firms without unreasonable delay so they can meet their own obligations.

Compozor uses only the cookies and browser storage it needs to work, described in our Cookie Policy.

Depending on where you live, you may have rights to access the personal information we hold about you, to correct it, to withdraw consent, or to request its deletion. We do not sell personal information, and we honor Global Privacy Control (GPC) opt-out signals where legally required. If you are a client of a firm that uses Compozor, we'll refer requests about your data to that firm where it is better placed to respond, unless the law requires us to respond directly. To exercise these rights, contact our Privacy Officer at support@compozor.com. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

Compozor and its service providers store and process data primarily in the United States. Information stored outside Canada is subject to the laws of the country where it is held, and may be accessible to that country's courts, law enforcement, and national security authorities.

Compozor is a business tool intended for use by professional service firms and their adult clients. It is not directed to, and we do not knowingly collect personal information from, children.

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify firm users directly.

Questions about this policy or your data can be sent to our Privacy Officer at support@compozor.com. Compozor is based in Canada.