Privacy Policy

1. Introduction

OrgGen AI ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, disclose and safeguard your information when you use our diagram-generation service (org charts, data models, software architectures).

We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using OrgGen AI, you agree to the collection and use of information in accordance with this policy.

2. Data we collect

2.1 Account information

• Email address (required for authentication)
• Display name (optional)
• Profile picture from OAuth providers (if you sign in with Google)

2.2 Project data

• Diagrams (org charts, ERDs, architectures) that you create
• Names, roles, ownership percentages and relationships between members
• Conversations with the AI assistant
• Version history and comments

2.3 Billing data

• Payment data processed by Stripe (card details are never stored on our servers — they are handled by Stripe under PCI-DSS Level 1 compliance)
• Billing address, VAT number, invoice history (retained by Stripe and our database)
• Subscription status (plan, period dates, end-of-period cancellation flag)

2.4 Usage data

• Device information (browser type, operating system)
• IP address (anonymised for analytics purposes — last octet truncated)
• Pages visited, features used, AI events triggered
• Activity timestamps

3. Voice and microphone

OrgGen offers voice input: one-off dictation (microphone button) and hands-free voice mode. The microphone never opens on its own — an explicit click is required — and an indicator stays on screen for as long as it is open.

• Who processes your voice: speech recognition is provided by your browser (Web Speech API). On Chrome and Edge, the browser sends the captured audio to Google's servers to convert it to text. This exchange happens between your browser and its vendor, without passing through our servers, and is governed by that browser's own privacy policy.
• What OrgGen receives: only the transcribed text. The audio recording never reaches us — we do not store it and we do not process it.
• What is retained: the transcribed text becomes an ordinary chat message (§2.2) — visible in the project history, retained and deletable like any other message. No audio trace is kept on our side.
• How to stop it: the "Stop" button on the listening indicator, or revoking microphone permission in your browser settings.

4. How we use your data

• Service provision: operating and maintaining the diagram-generation service
• AI processing: processing your natural-language prompts and generating diagrams via Anthropic Claude
• Billing: processing subscription payments via Stripe and sending invoices
• Communication: sending transactional emails (invitations, mentions, billing) via Resend
• Analytics: understanding how users interact with the service and improving it (only after explicit consent via the cookie banner)
• Security: detecting, preventing and addressing technical issues and abuse

5. Sub-processors

We use the following third-party sub-processors. Each operates under a Data Processing Agreement (DPA) that guarantees GDPR-compliant processing.

6. Your rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access: request a copy of your personal data
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your data (right to be forgotten)
• Right to data portability: receive your data in a machine-readable format (JSON export from your settings)
• Right to object: object to the processing of your data for certain purposes
• Withdrawal of consent: withdraw analytics consent at any time via the cookie banner

To exercise any of these rights, contact us at privacy@orggen.ai. You can also export or delete your data directly from your account settings.

7. Data retention

We retain your account and project data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (typically 10 years for accounting records tied to paid invoices).

8. Cookies

We use the following types of cookies:

• Essential cookies: required for authentication, billing and core operation. Set on every visit to the site.
• Analytics cookies (Google Analytics 4): help us understand how users interact with the service. Set only after your opt-in via the cookie banner. Google Consent Mode v2 is enabled — if you decline, no GA cookie is set and only anonymised, cookie-less pings are sent.

You can manage your cookie preferences via the banner shown on your first visit, or withdraw consent at any time by clearing your browser storage.

9. Security

We implement appropriate technical and organisational measures to protect your data: encryption in transit (TLS 1.3) and at rest, Row Level Security on the database, regular security reviews and access controls. Stripe processes all card data under PCI-DSS Level 1 compliance.

10. Contact us

For any question regarding this privacy policy or our data-processing practices:

Email: privacy@orggen.ai