Privacy Policy

1. Who we are

ComposabilityScores ("we", "us", "the platform") is operated by Composability Ltd and its brands, composabilityPro and ComposabilityScores™. Composability Ltd is a private limited company registered in England & Wales under company number 14641260, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.

This Privacy Policy explains what data we collect when you use the platform at composability.pro, why we collect it, and your rights over that data. Contact us at support@composability.pro.

2. What we collect

• Account data: your name, email address, and profile image, provided via Google OAuth when you sign in.
• Company evidence you submit: pitch decks, financial files, text inputs, and any other documents you upload for scoring.
• Assessment outputs: the deterministic scores, categories, risks, and OKRs the platform produces from your evidence.
• Usage data: page views, button clicks, and API calls. Used only for operational reliability and product improvement.
• Technical data: IP address, browser user agent, and session identifiers, required to keep your session secure.

3. Why we collect it

• To authenticate you and keep your account secure.
• To run the deterministic scoring pipeline against the evidence you submit.
• To provide role-based views (Founder, Investor, Advisor) and portfolio access control.
• To comply with applicable laws, audit obligations, and lawful requests.

We do not sell your data. We do not share your data with advertisers. We do not use your data to train third-party models outside the scoring pipeline.

4. How we use Google user data

When you sign in with Google we receive your name, email address, and public profile image. We use this data solely to create and maintain your ComposabilityScores account and to display it back to you in the platform. We do not share Google user data with any third party other than the sub-processors listed in §6, and we do not use Google user data for advertising. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Legal basis (UK GDPR / EU GDPR)

We process personal data on the basis of (a) contract — to provide the service you have asked for; (b) legitimate interest — to keep the platform secure and to improve it; and (c) consent — where you have explicitly opted in, such as marketing communications.

6. Sub-processors

We use the following infrastructure partners to operate the platform. Each is bound by a data-processing agreement:

• Google LLC — Authentication (OAuth).
• MongoDB, Inc. — Primary database.
• OpenAI — Deterministic extraction from the evidence you submit. Inputs are sent via model-provider APIs and are not used to train their foundation models.
• Stripe, Inc. — Payments for credits and plan upgrades.
• Emergent — Application hosting.

7. Data retention

We retain your account data for as long as your account is active. You can request deletion at any time by emailing support@composability.pro. Upon deletion we remove your personal data and company evidence within 30 days, except where we are required by law to retain records (e.g. invoices for tax purposes).

8. Your rights

You have the right to access, correct, port, or delete your personal data, and to object to or restrict processing. You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

9. Security

We apply industry-standard controls including TLS 1.2+ in transit, encryption at rest, role-based access control, and audit logging on all sensitive operations. No system is perfectly secure; you are responsible for keeping your account credentials safe.

10. Changes

We will notify you by email of any material changes to this policy. Non-material changes (typos, clarifications) may be applied without notice. The "Effective" date at the top of this page always reflects the latest version.

11. Contact

For any privacy question, email support@composability.pro.