Composure Privacy Policy

Effective date: 12 October 2026.

Operator: Thaker Innovations

Privacy contact: tapan@thakerinnovations.com

Composure helps businesses create AI-assisted skills and carry out work using their connected services. This policy explains the information we process when you use Composure or communicate with it, including through email and WhatsApp.

Information we process

• Account and organization information: your name, phone number, notification email, organization name, memberships, roles, invitations and account settings.
• Work you provide: chat messages, skill drafts, ticket descriptions, comments, assignments, follow-up dates, instructions, uploaded documents, photographs, audio files and transcripts. These may contain information about your customers, employees or other people.
• Connected services: the account identifiers, permissions and authorization tokens needed to operate a connection, and the information accessed through that connection for your work.
• Task and approval records: task settings, proposed actions, relevant context, results, errors, decisions, who made them and when.
• Usage and technical information: service usage, model/token consumption, estimated costs, timestamps, request identifiers and operational errors. Our hosting provider also processes network and browser information, such as IP addresses, to deliver and protect the service.

We use this information to provide the product, authenticate users, manage organizations, produce AI responses, perform authorized actions, send service notifications, measure usage and costs, provide support, and investigate security issues. We do not sell personal information or use customer content for advertising.

Your organization and other people

Organization skills, their authoring conversations, and tickets with their activity and attachments are shared workspace information. Authorized people in that organization can access them according to the feature's permissions. Where a feature provides a personal conversation, its access is scoped to that user. Creating an organization conversation does not make it a private conversation with Composure.

Your organization chooses its connections, members and task permissions. It is responsible for having authority to provide information about other people and for giving them any required notices. We process that business content to provide the organization's requested service; we manage account, security and usage information to operate Composure.

Gmail

If you connect Gmail through Google consent, Composure receives the granted permissions and encrypted authorization credentials. Supported mail actions include reading and searching messages, accessing attachments, composing and updating drafts, sending messages, managing labels, and moving messages to Trash. We use them for the mail features you configure or request.

An organization connection can be used by its authorized workflows. Task policies determine whether each supported read or write action runs automatically or requires approval. Granting Google access and approving an individual task action are separate choices.

Relevant mail information may be processed by our hosting and AI providers, or included in notifications to the recipients your organization selects, when needed for the feature you use. Composure's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Disconnecting Gmail in Composure removes that organization's saved authorization grant and stops future access through it. You can also revoke Composure in your Google account. Disconnecting does not itself erase previously saved work or task records; you can request their deletion separately.

WhatsApp and notifications

When you communicate with Composure's WhatsApp business number, we receive information Meta supplies, which may include your phone number, profile name, message content, timestamps, delivery status and submitted form responses. We use it to handle the communication, provide enabled notification and approval features, and protect the service. Incoming webhook events are stored securely while they are processed.

Approval messages can contain your organization name, task name, a description of the proposed action and a link to its details. Email approval notifications may also contain action details and an email preview. This information is shared with the notification provider and the chosen recipient. Your organization should choose recipients who are authorized to see it.

An organization administrator may separately connect an organization-owned WhatsApp number through MSG91. During setup, we encrypt the supplied MSG91 auth key and process one-time verification messages and authenticated webhook callbacks to verify control of the number and callback. This organization connection is separate from Composure's own WhatsApp number and notification credentials.

You can change available notification preferences in Composure or contact us to stop WhatsApp notifications. Stopping notifications does not by itself delete your account or approval history.

Ticket follow-up dates are tracked inside Composure. They do not automatically send email or WhatsApp messages. External reminders must be configured through an organization’s skill and follow the permissions for that connection.

Recorded calls

After you explicitly connect a supported phone, Composure matches consented phone recordings and uploads eligible calls shorter than three minutes, whether or not a skill currently uses recorded-call events. OpenAI processes the audio to create a transcript. Composure deletes raw audio after successful transcription and makes the transcript searchable for 30 days only to current organization administrators through Ask Composure. Configured skills may receive a reference-only event and use the transcript during a run.

Transient transcription failures retry for up to three days. If transcription still fails, we notify the person who connected the phone when notification delivery is configured and retain the audio for up to 30 days so an organization administrator can listen and review the failure. Ask Composure replies may quote transcript content and, at your direction, those chat messages remain under the normal persistent conversation policy after the source transcript expires.

AI, files and voice

OpenAI processes the conversation context and relevant reference material needed to generate a response. Interactive microphone audio is streamed to OpenAI for realtime transcription; complete-file audio, including uploaded audio and eligible recorded phone calls, is also sent to OpenAI for transcription. Dictation language selections are suggestions and may include several languages for mixed-language speech. PDF and Word document extraction uses Cloudflare; images and extracted text may become part of an AI request.

Dictation audio is processed temporarily and is not saved as a Composure attachment. The final transcript becomes part of your conversation if you send it; interim transcription is not submitted as a message. Audio files you explicitly upload, their transcripts and other attachments are saved with the relevant workspace. For spoken replies, the selected reply text is sent to Sarvam AI to generate a voice. Generated audio is processed temporarily and played on your device; Composure does not save it as an attachment.

We do not use customer content, including connected Gmail data, to train general-purpose AI models. OpenAI's API does not use inputs or outputs for model training by default. Sarvam AI's data use and retention depend on the account configuration and its applicable terms; we require verification of the production account's model-improvement opt-out and retention settings before broader rollout. Providers may retain information for security or service operation under their applicable terms; using AI does not mean zero retention. See OpenAI's API data controls and Sarvam AI's privacy policy.

Services that receive information

We use Cloudflare for hosting, storage and document processing; OpenAI for AI responses and realtime or complete-file transcription; Sarvam AI for spoken replies; Google for Gmail authorization and mail operations; Resend for service emails; MSG91 for enabled WhatsApp delivery and organization connections; and Meta/WhatsApp for enabled WhatsApp communications. We share information needed for those functions. Google also receives network information when serving our app's web fonts. Providers may process information outside your country; we do not promise India-only storage.

Connections your organization supplies, such as Custom MCP servers, have their own operators and policies. Their account and tool metadata can be inspected to help author skills. Information is sent to them only as needed for supported connection features or actions. We may also disclose information when legally required or necessary to address fraud, abuse or security incidents.

Our staff access is limited to operational need. Access to connected Gmail content for support requires your specific permission, except where access is necessary for security or legal obligations.

Security, cookies and retention

We use HTTPS, access controls scoped to organizations and users, and encryption for stored OAuth and MSG91 credentials and WhatsApp webhook payloads. Application secrets stay on the backend. These measures reduce risk but cannot guarantee absolute security.

Composure uses essential sign-in and OAuth cookies. We do not currently use advertising trackers. Signing out ends your active session; expired authorization links or login codes becoming unusable does not necessarily mean every related record has been erased.

During the current pilot, saved workspace content and task records do not have an automatic deletion schedule. They remain stored until a deletion request is processed or another applicable deletion process removes them. We keep information only for the service purposes described here, and review retention when information is no longer needed. Limited records may need to remain for legal obligations, security investigations or resolving disputes. Providers' backups and retention rules can affect when residual copies disappear.

Access, correction and deletion requests

Contact tapan@thakerinnovations.com to ask about your information, request a copy or correction, withdraw an optional permission, raise a privacy complaint, or request deletion. For deletion, use the subject “Composure data deletion request” and tell us the account phone/email, organization, and information you want removed. Never send passwords, login codes or access tokens.

Requests are handled manually. We verify your identity and authority before acting. You do not need an active account to contact us. For organization-owned records, we coordinate with the organization and explain any records that must remain; this does not prevent you from requesting deletion of your personal information. People who communicated with our WhatsApp number can request deletion of their WhatsApp-related data through the same contact.

Removing a Composure record does not automatically delete a sent email or a message from recipients' devices or third-party accounts. We explain the outcome and any necessary retention exceptions when responding to your request. Your applicable law may provide additional rights.

Children and policy changes

Composure is intended for business users aged 18 and above. Contact us if you believe a child has provided personal information directly to Composure.

We update this policy when our practices change and display the effective date. Material changes will be communicated through the product or another appropriate service channel. We obtain further consent where required.

Request data deletion