Privacy, in plain language

Last updated 2026-07-16 · Controller: Ousios LLC (Kira Hancock) — company details on the Ousios legal notice · hello@composa.team

What happens when you take the assessment

Your answers are scored on your device, in your browser. Your result is saved to your browser's local storage so it's still there when you come back. By default, none of it is transmitted to us.

What we collect, and only when you choose to give it

• Your email — if you enter it to receive your guide or unlock your team plan, we receive your email address together with your result (archetype and axis scores, or team composition) and basic campaign attribution (how you found us). We use it to send you what you asked for and occasional Composa updates. Submissions are delivered to a private spreadsheet we control (via Google Apps Script), or — if configured — to Formspree, our form provider.
• Research responses — if you participate in our research study (a separate, clearly-marked flow with its own consent step), your answers are stored with an anonymous participant ID in a private spreadsheet we control. Research data is used only in aggregate.
• If you buy something — checkout is handled entirely by Stripe, our payment processor. You leave Composa to pay, and Stripe collects your name, email, billing address and card details directly. Card numbers never touch Composa and we never see them. We receive from Stripe only what we need to recognise the sale and support you: your name, email, what you bought, and the amount. Legal basis: performance of our contract with you (Art. 6(1)(b)). Stripe keeps transaction records for as long as tax and anti-fraud law requires, which is longer than our own retention windows and is not ours to shorten.
• If you book a call — booking is handled by Cal.com. You give them your name, email and chosen time; the booking is written into our calendar (Google) so we both get the invite. We use it to hold the call and to follow up about it. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b)).

What we deliberately don't do

• No advertising trackers, no cross-site tracking pixels, no selling or renting data — to anyone, ever.
• No cookies at all unless you accept the analytics ones — see Analytics below. Local storage is used only to keep your own results, and a first-party note of how you found us (campaign attribution), on your own device.
• No hidden collection: if a screen is about to transmit something, it says so next to the button.

Analytics

We use Vercel Web Analytics for privacy-first page counts. It is cookieless: visitors are counted with a hash of the request that resets every day, so you cannot be followed between days or between sites, and it reports only aggregate page views — never individual profiles. It is run by Vercel, our host, in the USA under a data-processing agreement with EU-approved safeguards (EU–US Data Privacy Framework and standard contractual clauses). Because it is cookieless and aggregate, it needs no consent and runs for every visitor.

Until 11 August 2026 this role was filled by Plausible, which also counted in-page actions such as starting the assessment or viewing a result. Those interaction counts now happen only through Google Analytics below. We would rather say this plainly than let you infer it: if you decline analytics, your actions on this site are not counted anywhere — only the anonymous page view is. A first-party note of how you found us (campaign attribution) is still kept in your browser’s local storage, and is now attached only to those consented Google Analytics events.

We additionally offer Google Analytics 4, which is a different proposition and we would rather be blunt about it: it sets first-party cookies (_ga, _ga_<id>, up to 2 years) carrying a random identifier for your browser, and sends your IP address and the pages you view to Google in the USA. Because that stores an identifier on your device, we ask first — it loads only if you press Accept, and until then no Google script is requested at all. Legal basis: your consent (Art. 6(1)(a)). You can withdraw at any time via analytics settings, which also deletes the cookies. Google Signals, ad personalisation, and all advertising uses are switched off, so it only counts visits to this site.

Shared result links

If you use the share feature, your result is encoded in the link itself. Anyone you send that link to can see that result — share accordingly.

Retention and deletion

Email leads are kept until you ask us to remove them. Research responses are stored under an anonymous participant ID and kept for up to 24 months, after which they're deleted or reduced to non-identifiable aggregates. You can ask us to delete your responses sooner — email us with your participant ID and we'll do it within 30 days. To clear your on-device results, clear this site's data in your browser.

Your rights

Everything above that reaches us does so with your consent (GDPR Art. 6(1)(a)) — which you can withdraw at any time. You can also ask for access, correction, deletion, restriction, a portable copy, or object to processing: email hello@composa.team and we'll confirm within a few business days (and always within one month). To protect your data from impostors, we act on requests sent from — or confirmed by — the email address the data concerns; research-data requests work via your participant ID. You can also complain to your local data-protection supervisory authority. Composa isn't directed at children under 16.

Where data lives

Form submissions and research data land in a private Google Sheet we control (US); if Formspree (US) is used as the form provider, it processes submissions on our behalf. The site itself is hosted on Vercel. None of these providers may use your data for their own purposes beyond providing the service.

Changes

If this policy changes materially, the date above changes with it, and we'll note what changed.