Privacy Policy

Privacy Policy

This privacy policy applies to the Composway app for web browsers, together with any related services operated by BreweriiHQ Inc. (collectively, the "Application"). BreweriiHQ Inc. is hereby referred to as the "Service Provider".

Information Collection and Use

The Application collects information when you download and use it. This information may include information such as

• Your device's Internet Protocol address
• The pages of the Application that you visit, the time and date of your visit, the time spent on those pages
• The time spent on the Application
• your operating system you use

Cookies and tracking technologies

The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, or service delivery. Where required by applicable law, the Service Provider will obtain consent before using non-essential tracking technologies.

Your Rights

You may request access to, correction of, or deletion of your personal data held by the Service Provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the Service Provider at support@composway.ai.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. To exercise your CCPA/CPRA rights, contact the Service Provider at support@composway.ai.

Artificial Intelligence

The Application uses Artificial Intelligence (AI) technologies to enhance user experience and provide certain features. The AI components may process user data to deliver personalized content, recommendations, or automated functionalities. All AI processing is performed in accordance with this privacy policy and applicable laws. If you have questions about the AI features or data processing, please contact the Service Provider.

The Service Provider may use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.

For a better experience while using the Application, the Service Provider may require you to provide certain personally identifiable information, including but not limited to email. The information the Service Provider requests will be retained and used as described in this privacy policy.

MCP Connector and AI Assistants

The Service Provider offers a Model Context Protocol (MCP) server at mcp.composway.ai that lets you use Composway from AI assistants such as ChatGPT, Claude and Claude Code. You choose to connect it, and you can disconnect it at any time.

How you sign in.

When you connect an AI assistant, you sign in to your Composway account and approve the connection. The Service Provider stores the credentials needed to keep that connection active, together with your account identifier and your name or email address to label it. Access tokens and authorization codes are stored only in hashed form, and the session data linked to them is encrypted. Access tokens expire after about one hour. Refresh tokens expire after 30 days, and an assistant's app registration expires after 90 days, unless renewed by continued use. A browser cookie that remembers which assistants you have approved lasts up to 30 days.

What passes through the connector.

The Service Provider does not receive or store your conversations with the AI assistant. It receives only the requests the assistant makes to Composway's tools on your behalf. Each request contains the tool name and the details the assistant supplies, such as a website, a date range, a query, or text you ask it to save. Read tools return data from your Composway account, such as your workspaces, connected search performance data, tracked AI queries, campaigns and content. Write tools change your account only when you confirm the change. For example, they can save article text, update brand terms or competitors, or create a workspace or campaign. Anything saved this way is stored in your account and treated like other information you provide to the Application. Access is limited to the workspaces and connected properties your account can already see.

What the AI assistant provider does with your data.

Tool results are returned to the assistant you are using. The provider of that assistant (for example OpenAI or Anthropic) handles your conversation, including those results, under its own terms and privacy policy, not this one.

Third parties.

To fulfil certain tool requests, the Service Provider may send the minimum necessary request details to service providers that process them on its behalf. These include its authentication provider (Kinde), its hosting provider (Cloudflare), keyword data providers, and AI model providers used for features such as topic expansion. These providers do not use the data for their own purposes. The Service Provider does not sell data received through the connector.

Logs.

The Service Provider keeps operational logs of requests to the MCP server and its API, which may include the tool requested and its parameters, for security, debugging and abuse prevention. These logs are kept for up to 7 days.

Revoking access.

You can remove the connection in your AI assistant's settings. Unused connections expire automatically as described above. To have the Service Provider revoke all connections or delete data created through the connector, contact support@composway.ai.

Connected Search Performance Data

If you connect a Google Search Console or Bing Webmaster Tools account to the Application, the Service Provider accesses data for the websites you authorize. This includes search queries, page URLs, clicks, impressions, click-through rate, average position and related search performance metrics. The Service Provider also stores the authorization needed to keep the connection active, and that authorization is encrypted.

The Service Provider uses this data only to provide the Search Performance dashboard and related analysis and features in your workspace. The data is stored in your Composway account and processed by the Service Provider's trusted hosting and database providers on its behalf. The Service Provider does not sell this data and does not use it for advertising. It does not use this data to train generalized AI models and does not transfer it to third parties except as needed to provide the feature, comply with law, or as otherwise described in this policy.

The Service Provider's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a connected account at any time to stop future retrieval. Disconnecting does not automatically delete data that has already been stored. To request deletion of stored search performance data, contact the Service Provider at support@composway.ai.

Third Party Access

Only aggregated, anonymized data is periodically transmitted to external services to aid the Service Provider in improving the Application and their service. The Service Provider may share your information with third parties in the ways that are described in this privacy statement.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the Service Provider will use appropriate mechanisms.

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions or other legally recognized transfer mechanisms
• Your consent, where required and legally permitted

Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

The Service Provider may disclose User Provided and Automatically Collected Information:

• as required by law, such as to comply with a subpoena, or similar legal process;
• when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

Opt-Out Rights

You can stop further collection of information from your device by ceasing to use the website. Ceasing to use will stop the website from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.

To request deletion of your personal data, to withdraw consent, or to exercise any of your rights, contact the Service Provider at support@composway.ai.

Data Retention Policy

The Service Provider retains personal data based on its necessity for the stated purposes:

• User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law
• Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance
• Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
• Data required for legal compliance: Retained as long as required by applicable law

You may request deletion of your personal data, subject to any legal obligation to retain it. If you want the Service Provider to delete User Provided Data submitted through the Application, please contact them at support@composway.ai. Please note that some User Provided Data may be required for the Application to function properly.

Children

The Application is not intended for children under 13 years of age, or such higher age as required by applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

The Service Provider does not knowingly collect personally identifiable information from children. The Service Provider encourages all children to never submit any personally identifiable information through the Application and/or Services. The Service Provider encourages parents and legal guardians to monitor their children's Internet usage and to help enforce this Policy by instructing their children never to provide personally identifiable information through the Application and/or Services without their permission. If you have reason to believe that a child has provided personally identifiable information to the Service Provider through the Application and/or Services, please contact the Service Provider (support@composway.ai) so that they will be able to take the necessary actions. If you are under 13 years of age, your parent or guardian must provide consent on your behalf where permitted by law.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.

Data Breach Notification

If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.

Changes

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at support@composway.ai.

This privacy policy is effective as of 2026-10-19

Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at support@composway.ai.