Privacy Policy - IOcomposer

Note: This document should be reviewed by qualified legal counsel before production use.

Provider: I-SYST Inc. (Québec, Canada) ("I-SYST", "we", "us")

Address: 50 de Lauzon, Boucherville, Quebec, Canada J4B 1E6

This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with IOcomposer.

            IOcomposer is designed to be local-first for development workflows. We do not store your prompts, source code, or AI outputs on our servers. We process certain data transiently to provide the Service, as described below.
        

1) What We Collect

Third-party SDK downloads (local). The IOcomposer installer may download third-party SDKs directly from their official upstream repositories and store them locally in a separate external/ folder on your machine. This activity typically does not involve collecting your prompts, source code, or AI outputs. Third-party SDKs remain governed by their own license terms.

1.1 Account Information

Email address and basic account identifiers
Authentication metadata (sign-in timestamps, security events)

1.2 Billing Information (if you purchase a plan)

Billing is processed by Stripe. We may receive:

Payment status (paid/unpaid), subscription plan, renewal/cancellation status
Limited billing metadata (customer ID, subscription ID)

We do not receive or store full card numbers.

1.3 Service Usage Information (metadata only)

To operate the Service and enforce limits, we may collect and store:

Feature usage counters (e.g., requests/day, tokens/month) — counts only, not content
Coarse device/app telemetry (e.g., app version, OS type) if enabled
Security logs (e.g., IP address, timestamps) for abuse prevention

We do not store:

Prompts or chat content
Project files or repositories
Retrieved code snippets from your local knowledge base
AI outputs returned to you

A Note on Secrets: While we employ best practices to redact sensitive data from logs, we cannot guarantee that user-submitted secrets (e.g., API keys, passwords, or private keys pasted directly into prompts) will be successfully redacted from crash reports or server-side error logs if an error occurs during processing. You are responsible for sanitizing your Content before submitting it to the Service.

1.4 Support Communications

If you contact support, we collect the information you provide in your message. Please avoid sending source code or secrets. If you do include such data, it may be handled as support content.

2) How We Use Personal Information

We use personal information to:

Provide authentication and account management
Deliver the Service and Desktop App features
Enforce plan limits, prevent abuse, and maintain security
Process billing and subscription status
Communicate service notices (e.g., critical updates)
Comply with legal obligations

3) How AI Processing & Routing Works

When you use AI features, the Desktop App sends a request to our AI gateway.

3.1 The Neural Router

To provide the Service, we use an automated classification system ("Neural Router") that analyzes the metadata and complexity of your request (e.g., token count, presence of code, file attachments) to determine the most appropriate AI model.

3.2 Model Providers

Based on this classification, we forward the required information to an AI model provider (currently Anthropic or OpenAI) to generate Output.

Simple Queries: May be processed by smaller, faster models to ensure speed.
Complex Queries: Are processed by high-reasoning models for better accuracy.

We use the latest available models from each provider. Current model families in use are published at: https://iocomposer.io/ai-models

3.3 No Storage of Content

Consistent with our local-first promise, prompts and snippets are processed transiently in memory to perform this routing and generation. They are not persisted by I-SYST. We may store non-content usage metadata (e.g., "Request ID 123 was classified as 'Complex' and used 3 quota units") for billing and plan enforcement.

4) Disclosure to Service Providers (Subprocessors)

We disclose personal information to third parties only as needed to operate IOcomposer:

Subprocessor	Purpose	Location
Supabase	Authentication, database, edge functions	USA
Stripe	Billing and subscription management	USA
Anthropic	AI model provider (Claude)	USA
OpenAI	AI model provider (GPT)	USA

These providers process data under their own terms and privacy policies and under contracts intended to protect personal information.

We maintain a list of subprocessors at: https://iocomposer.io/subprocessors

Note: "Location" indicates a primary processing region and may include other jurisdictions depending on service configuration.

5) Data Retention

We retain personal information only as long as necessary for the purposes described above:

Data Type	Retention Period
Account data	While account is active, plus a reasonable period after deletion for security/legal compliance
Billing metadata	As required for accounting and legal compliance
Security logs and usage metadata	90 days (metadata only; no prompts/code/output)

Because we do not store prompts, code, or output, we do not retain that content.

6) International Transfers

Service providers may process personal information outside Québec/Canada (for example, in the United States or other regions). Where applicable, we use contractual and organizational safeguards designed to protect personal information during such transfers.

7) Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including access controls and encryption in transit. No method of transmission or storage is 100% secure.

8) Your Choices and Rights

Depending on your jurisdiction, you may have rights to:

Access and correct personal information
Request deletion of your account data
Withdraw consent where processing is based on consent

To exercise these rights, contact: info@i-syst.com

9) Children's Privacy

IOcomposer is not intended for children under the age of 13. If you believe a child has provided personal information, contact us to request deletion.

10) Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version and update the effective date.

11) Contact

Privacy questions or requests: info@i-syst.com