GDPR & UK GDPR

This page summarises how Org Chart Studio complies with the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR. It sits alongside our Privacy Policy (the full detail) and our Sub-processor List — this page is the plain-language overview.

We are a small team, and we build privacy in at the code level rather than bolting it on. Where a choice is between collecting data and not collecting it, we default to not.

1. Controller and processor roles

For the employee and organisational data you put into your charts, you are the data controller and Org Chart Studio is your data processor — we process that data only on your documented instructions (see our Terms and the Data Processing Agreement available to customers on request).

For your own account data (your name, email, sign-in, billing, and the analytics you consent to), we are the data controller. The legal bases below distinguish the two.

2. Legal bases (Art. 6)

We do not ask you to route special-category data (Art. 9) or children's data through the service, and our persistence allow-list drops sensitive fields before they reach the database (see §5).

3. Your rights

You have the right to access, rectify, erase, restrict, and object to the processing of your personal data, to data portability, and to withdraw consent at any time. The Privacy Policy describes each in full. In practice, most rights are self-service:

• Erasure / account deletion — delete your account (and all its data) from account settings, one click, no email required.
• Portability — export your charts as CSV, PNG, PDF, or PowerPoint at any time.
• Withdraw consent — change analytics, session-replay, and marketing choices from the cookie settings in the footer; declining changes nothing about how the product works.
• Per-employee erasure — as a controller, remove a named individual from every saved version of your charts using the in-app erasure tool.

For access, rectification, restriction, objection, or anything not covered above, contact us (§7) and we will respond within one month.

4. Where your data lives

Your consented behavioural event analytics is processed by Rybbit Cloud and by Google Analytics (via Google Tag Manager). Rybbit states that its primary application and analytics infrastructure is hosted with Hetzner in Germany/EU; Google LLC processes analytics data in the United States under the EU-US Data Privacy Framework and SCCs. The first-party event payload contains pseudonymous identifiers and PII-scrubbed usage metadata — never your name, email, IP address, raw URL parameters, or org-chart employee data. Tinybird's Frankfurt workspace is retained temporarily as a legacy, read-only historical archive and rollback source.

Rybbit stores encrypted session-replay objects with Cloudflare R2 and its DPA permits processing outside the EEA subject to Standard Contractual Clauses or other recognized safeguards. We therefore do not claim that every replay byte remains exclusively in the EEA. Other sub-processors (including our current database, hosting, authentication, and payments) also process data in the United States. For applicable EU/EEA and UK transfers we rely on the EU-US Data Privacy Framework where the recipient is certified, and on Standard Contractual Clauses (EU SCCs 2021/914 + UK IDTA/Addendum) with a transfer impact assessment otherwise.

The full list — each sub-processor, what it processes, its region, and the transfer instrument — is on our Sub-processor List.

5. How privacy is enforced in the product

Rather than rely on policy alone, these protections are built into the code:

• Consent-gated by default. No analytics, session-replay, or marketing tool loads until you opt in, per purpose. Global Privacy Control (GPC) is honoured.
• Data-minimised analytics. Events carry pseudonymous IDs only — no names, emails, IP addresses, raw URL parameters, or employee data — and the primary Rybbit analytics infrastructure is in Germany (§4).
• Employee data is masked out of session recordings. Replay never runs on sign-in, verification, or checkout pages; input/editable fields are ignored and masked; employee details in chart nodes are replaced with neutral placeholder text in the recording (the real values are transformed in the browser and never transmitted); and surfaces listing employee data in full (people list, export previews, import comparisons) plus iframe content are blocked. The recorder does not capture our chart API request or response bodies.
• A server-side allow-list drops sensitive fields (for example phone, salary, date of birth, health) at the persistence boundary — by field name, before they ever reach the database.
• Retention is enforced automatically by a scheduled purge, not manual cleanup, and erasure rotates the identifiers that could re-link anonymised records.

6. Retention

We keep personal data only as long as needed for the purpose it was collected, then delete or anonymise it. The specific windows (and the mechanisms that enforce them) are listed in the Privacy Policy.

7. Contact and complaints

For any data-protection question, or to exercise a right, contact us at hello@orgchartstudio.com. We are a small team and handle these requests directly.

If you are in the EU/EEA or the UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.