Privacy Policy

Composition Holdings Inc. is responsible for the personal information collected through the Service. Our person in charge of the protection of personal information (Privacy Officer) can be reached as follows:

• Privacy Officer: Privacy Officer, Composition Holdings Inc.
• Email: compositionholdings@gmail.com

Information you give us

• Account information: your name, email address and password. Passwords are stored in hashed form; we cannot see them.
• Purchase information: payments are handled by Stripe, which collects your card details directly. We receive your name, email, billing country and postal code, card brand and last four digits, the amount paid, and the payment status. We never see or store your full card number.
• Communications: messages you send us, for example support requests or feedback.

Information collected automatically

• Technical and usage data: IP address, browser and device type, operating system, pages and features used, referring page, dates and times of visits, and error logs.
• Cookies and similar technologies: see section 6.

We do not intentionally collect sensitive information such as health, biometric or financial account information, and we ask you not to submit it.

We only use your information for these purposes, unless we ask for your consent or the law allows or requires another use. We do not make decisions about you based solely on automated processing.

We do not sell your personal information for money. We share it only with the following:

• Lovable — hosts the Service and provides our database, user authentication, email delivery and basic visitor statistics, using its own infrastructure providers.
• Stripe — processes payments. Stripe also uses some information for its own fraud prevention and legal obligations, under Stripe's privacy policy.
• Professional advisors such as accountants and lawyers, under a duty of confidentiality.
• Authorities, when required by law or to protect our rights, your safety, or the safety of others.
• A buyer or successor, if the Service is sold or transferred. We will tell you before your information becomes subject to a different privacy policy.

Our service providers may only use your information to provide services to us, and must protect it.

We are based in Quebec. Your information is stored in US East, and our service providers may process it in the United States and other countries, where privacy laws may differ from those where you live. Before sending personal information outside Quebec, we assessed whether it would receive adequate protection, including the provider's security and contractual commitments. For users in the EU and UK, transfers rely on adequacy decisions or standard contractual clauses.

We use:

• Essential cookies and local storage to keep you signed in, remember your cookie choices and protect the Service. These are always on because the Service can't work without them.

We do not use advertising cookies, ad pixels or third-party analytics tools. Basic visitor statistics (such as page views and approximate visitor counts) are provided by our hosting provider, Lovable, as part of running the Service. If we add analytics or advertising tools in the future, we will update this policy and ask for your consent first where the law requires it.

• Account information: while your account is open. When you delete your account, we delete it within 30 days. Copies may remain in backups for up to a further 30 days before being overwritten.
• Purchase and tax records: 6 years, as required by Canadian tax law.
• Support messages: up to 2 years after the conversation ends.
• Visitor statistics: kept by our hosting provider according to its own retention settings.

When we no longer need information, we delete or anonymize it.

Wherever you live, you can ask us to:

• access the personal information we hold about you and learn how it is used;
• correct information that is inaccurate or incomplete;
• delete your information (you can also delete your account in your account settings);
• receive a copy of the information you gave us in a structured, commonly used format;
• withdraw consent you gave, for example to marketing emails.

Quebec residents can also ask us to stop disseminating their information or to de-index links to it where the law allows, and can complain to the Commission d'accès à l'information du Québec.

EU and UK residents can also ask us to restrict or object to our processing, and can complain to their local data protection authority.

California and other US state residents can request to know, delete and correct their information. We do not sell your personal information or share it for targeted advertising. We will not treat you differently for using these rights.

To make a request, email compositionholdings@gmail.com from the address linked to your account. We may need to verify your identity. We will respond within 30 days.

We protect your information with encryption in transit (HTTPS), database access rules that limit each user to their own data, hashed passwords, and limited access to production systems. Card payments are handled by Stripe, which is certified to the highest payment industry security standard. No system is completely secure. If a security incident creates a risk of serious harm to you, we will notify you and the relevant authorities as required by law.

The Service is not intended for anyone under 16, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

We only send news and offers if you opt in. Every marketing email includes an unsubscribe link. Service emails, such as receipts and password resets, are part of running your account and continue while it is open.

We may update this policy. We will post the new version here with a new effective date, and email you about significant changes before they take effect.

Questions or requests: compositionholdings@gmail.com.

Related documents: Terms of Service and Refund & Cancellation Policy.