Privacy policy

• Your business information belongs to you. We use it to run Componion for you and your team, and for nothing else.
• We don't sell your information, we don't show ads, and we don't use third-party tracking.
• Sibuyas, the AI helper in Componion, only works with the business you're in. It can't see other businesses.
• Your chats with Sibuyas are private to you. Everything else in a business is shared with its team.
• You can delete files, things Sibuyas remembers, a whole business, or your account at any time.

Your account

When you create an account, we collect your email address, your first name (and last name, if you add one), and your password. Your password is stored by our login provider in a scrambled (hashed) form, so no one at Componion can read it. If you choose "Continue with Google," Google shares your name, email address, and profile photo with us.

We also keep your settings, such as your theme and text size, and your progress through the setup steps.

Your business

When you set up a business, you tell us about it: its name, type, website, location or service areas, phone number, public email, booking link, social media links, hours, services and prices, the customers you serve, how you like to sound, and what makes you different. When you ask us to, we read your public website to fill in details like your phone number and hours.

What you add and create

This includes your to-dos, drafts, the things Sibuyas remembers about your business, and the files you upload (PDF, Word, text, Markdown, and CSV files). We store each file and the text we pull out of it, so Sibuyas can read it when it helps you.

Chats with Sibuyas

We store your messages to Sibuyas, its replies, and the changes you approve from a chat (for example, adding a to-do or updating your hours).

Website checkups

When someone on your team runs a website checkup, our checkup tool (ComponionBot) visits the website saved in your business profile. It reads a few public pages, the site's robots.txt file, and its sitemap. It never logs in, fills in forms, or collects personal information from the site. We store the results: your score, what we found, and how to fix it. To measure page speed, we may send your website's public address to Google PageSpeed Insights. You can read more on our About ComponionBot page.

Connected accounts

If an owner or admin connects Google, Google lets us read the information your business chose to share: search clicks and searches from Google Search Console, visitor numbers from Google Analytics, and, where available, calls, directions, website clicks, and reviews from your Google Business Profile. We store a summary of these numbers and refresh it from time to time. We only read this information. Componion never posts to Google on its own.

If an owner or admin connects WordPress, we store your site address, your WordPress username, and the application password you give us. We use them only to send a draft to your site when someone clicks Publish.

When you connect Google or WordPress, the access you grant is stored encrypted, and it is never shown to anyone, including your team.

Your team

When you invite someone, we store their email address and the role you chose for them. We also record who did what in your business (for example, "Maria added a to-do") so your team can see its recent activity.

Usage and technical information

We count what your business uses, such as Sibuyas messages, drafts, website checkups, and file storage, so we can apply your plan's limits. These records hold counts and timestamps, not the content of your messages or drafts.

Like most websites, our servers receive technical information with each request, such as your IP address, browser type, and the page you asked for. We use it to keep Componion working and secure, for example to slow down repeated login attempts. Our server logs are designed to leave out the content of your business.

Cookies

Componion only uses the cookies it needs to work: one to keep you logged in, one to remember which business you're working in, three to remember your theme, text size, and language, and a few short-lived ones that protect the login, email link, invite, and connection steps. We don't use advertising or analytics cookies.

We use your information to:

• run Componion for you and your team, including your Home, to-dos, website checkups, drafts, files, and connections;
• let Sibuyas answer your questions, suggest next steps, and write drafts in your voice;
• apply plan limits and prevent abuse, such as spam accounts or attempts to overload the service;
• keep Componion secure, find and fix problems, and improve how it works;
• send you emails about your account: confirming your email address, login links, password resets, email changes, and invites;
• meet our legal obligations.

We don't sell or rent your information. We don't use your business information to show you ads, and we don't use it to help any other business. We don't use your content to train AI models.

Sibuyas runs on an AI model provided by Anthropic. When you chat with Sibuyas, ask for a draft, or get the plain-English wording for a checkup, we send Anthropic the information needed for that request. That can include your message, parts of your business profile, recent messages in the same chat, relevant text from your files, and content from your website. Anthropic processes it to create the reply and sends it back to us, under its commercial terms for business customers.

If Sibuyas searches the web to answer a question, the search runs through Anthropic's search tool.

Text from websites, files, and reviews is treated as information, never as instructions. Sibuyas asks you before it changes anything in your business, and nothing changes until you say yes.

Your team. Everything in a business is shared with the people in it: the business profile, to-dos, drafts, files, what Sibuyas knows, checkups, connections, and activity. Your chats with Sibuyas are the exception: they are private to you, and your teammates can't read them. Owners and admins can manage the team, connections, and plan.

Our service providers. A small number of companies help us run Componion. They process information only to provide their service to us. They're listed in the next section.

When the law requires it. We may share information if we believe we must do so to follow the law, respond to a valid legal request, or protect the rights, safety, or property of the people who use Componion, the public, or Componion itself.

If Componion changes hands. If the operator of Componion is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that deal. This policy will keep applying to it unless you're told otherwise and given a choice where the law requires one.

People who work on Componion look at your business information only when needed to help you when you ask, to keep Componion secure, to change your plan, or to meet legal obligations.

• Supabase hosts our database, our login system, and file storage. Account emails, like login links and password resets, are sent by Supabase through the email delivery service we use.
• Vercel hosts the Componion website and the servers that run it.
• Anthropic provides the AI model behind Sibuyas.
• Google is involved only in these cases: when an owner or admin connects Google (Search Console, Analytics, and Business Profile), when you choose "Continue with Google" to log in, and when a website checkup measures page speed with Google PageSpeed Insights (which receives only your website's public address).
• Cloudflare Turnstile, when it is turned on, checks that the login and create-account forms are used by people and not bots. To do that, Cloudflare may process technical details such as your IP address and browser information.

You own the information and content you put into Componion, and the drafts Sibuyas writes for you are yours to use. We use your content only to provide Componion to you and your team. If you delete it, it's gone from Componion.

We keep your information for as long as your account or business exists, with these exceptions:

• Notifications are deleted after 90 days.
• Activity history is kept for 12 months.
• Usage counts are kept for up to 13 months, so plan limits keep working if a business is deleted and set up again.
• Records that slow down repeated attempts (for example, too many login tries) are deleted after 2 days.
• Uploads that never finished are removed automatically.
• Google numbers are refreshed from Google and replaced over time.

When you delete something, it's removed from Componion right away. Copies may stay in our providers' backups for a limited time until those backups are replaced.

• Things in a business. You can delete files, drafts, to-dos, chats, and the things Sibuyas remembers at any time.
• A business. The owner can delete a business from Settings > Danger zone. This deletes all of its information, files, and connections, and we ask Google to cancel Componion's access.
• Your account. You can delete your account from Settings > Danger zone. This deletes your login, your chats, and your personal settings. Businesses you own by yourself are deleted too. If you own a business that has other people in it, make someone else the owner or delete that business first. Things you created in a business that others still use, like to-dos and drafts, stay with that business without your name on them. Usage counts stay, as described above.

We protect your information with encrypted connections (HTTPS), with database rules that keep each business's information separate from every other business, with role-based permissions inside each business, and with encryption for the access you grant when you connect Google or WordPress. No online service can promise perfect security, so please tell us right away if you think something is wrong.

Componion is a tool for running a business, and it isn't meant for children. We don't knowingly collect information from children under 13 (or the minimum age in your country). If you believe a child has given us information, contact us and we'll delete it.

Our service providers may store and process information in the United States and in other countries. The data protection laws there may differ from the laws where you live. Wherever your information is processed, we protect it as this policy describes.

You can see and update most of your information directly in Componion, and you can delete it as described above. To ask for a copy of your information, or for anything you can't do yourself, contact us.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or limit how we use it, and to complain to your local data protection authority. We'll respond to requests as the law requires, and we may need to confirm your identity first. We won't treat you differently for using these rights.

When we change this policy, we'll update the date at the top of this page. If a change is significant, we'll let you know in Componion or by email before it takes effect.

If you have questions about this policy or your information, email us at the contact address on the Componion website.