Composite

GDPR overview

There is no mention of the GDPR anywhere on this site. The term does not appear once in the privacy policy, the terms of use or any page collected, and no Article 27 EU representative, data protection officer, legal basis or GDPR response deadline is named. The privacy policy does acknowledge rights that vary with where you live, including access, deletion, correction, portability, objection, restriction, withdrawal of consent and the right to complain to your local data protection authority, all exercised through legal@composite.com. Beyond that, the text is written for United States law: the Californian CPRA is set out in detail with a 45-day response window extendable once, alongside Colorado, Connecticut, Virginia, Texas, Oregon and Montana. The terms mention European Commission Standard Contractual Clauses, but only where applicable law requires them. No data processing agreement is published and no certification is claimed.

Who owns the data?

Section 3.1 of the terms gives you, or your licensors, ownership of all User Content the Service collects from you, and section 3.4 states in capitals that Composite claims no ownership rights over it. In exchange you grant a non-exclusive, transferable, sublicensable, royalty-free and worldwide licence to use, copy, modify and create derivative works of your content and outputs, in order to run the Service, improve it, train Composite's proprietary models, and build aggregated or de-identified datasets the company may licence or sell. Identifiable content is never sold as a standalone dataset. Composite separately owns Usage Data that is not personal information, keeps the models it trains, and takes outright assignment of any feedback you send.

Reuse rights

Yes. Section 4.3 of the terms lets you use the Service's Output for any lawful purpose on a royalty-free basis, without asking permission first. Three limits come with it. Using an Output transfers no intellectual property rights in the Service itself. Composite may, at its sole discretion and simply by giving notice, restrict your use of an Output or require you to stop and delete every copy if it forms the view that the use could infringe a third party's rights. And you may not present an Output as human-generated, nor use Outputs to train your own machine learning models. The same section warns, in capitals, that Outputs may not be unique between users, may be inaccurate and may contain hallucinations, so you are expected to evaluate them yourself, human review included, with Composite disclaiming liability for what they contain. Nothing produced by the Service is offered as professional advice.

Data retention & training

Hosting summary

All data is stored on AWS infrastructure located in the United States, and no data residency option is offered anywhere else. Storage is described as access-controlled, and an automated redaction pipeline strips personal information before any Composite employee can reach stored data, a control the company presents as technical rather than merely procedural. Your content may be processed locally on your machine or through Composite's cloud infrastructure as needed. AI inference is routed either through Composite's own gateway or to third-party providers, named as Anthropic, Amazon Web Services, Google Cloud and OpenRouter, all of which are said to operate under zero data retention agreements, meaning they neither store inputs nor train on them. Business customers are pointed to trust.composite.com for the list of subprocessors, with notice and an opportunity to object before changes take effect, though that page is not reachable from outside the company. For a European buyer, the practical position is a United States jurisdiction with no alternative.