Privacy Policy

1. Introduction

Welcome to Org Chart Studio ("we," "our," or "us"). We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our organizational chart creation and management service.

By using Org Chart Studio, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

Data controller / processor note: Org Chart Studio acts as a data processor for the employee and organizational data you enter into charts. You, as the account holder, are the data controller for that information and are responsible for ensuring you have appropriate authority to store and process it.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name
• Email address
• Authentication credentials (managed securely by our authentication provider, Stytch)
• Profile information you choose to provide

2.2 Organizational Chart Data

When you use Org Chart Studio, we may store:

• The chart structures you create
• Information you enter or import about people, including names, titles, departments, and reporting relationships
• Chart details such as creation dates, changes, and version history
• Layout and visual preferences

Spreadsheet files selected in the browser application are processed in your browser. We do not upload or retain the original file as part of that import. If you save the chart to your account, we store the chart data created from the import.

Agent integrations work differently. Spreadsheet content submitted through an agent integration is sent to our service for processing. If you ask the integration to create or save a chart in your account, we save the chart you create, not a copy of the spreadsheet.

2.3 Usage Information

We automatically collect certain information when you use our service:

• Device information (browser type, operating system)
• IP address and general location data
• Usage patterns and interactions with our service
• Session data and authentication timestamps

2.4 Browser Storage

We may keep chart drafts and recovery copies in your browser. This data remains on your device until Org Chart Studio removes it or you clear your browser data. For charts saved to your account, saving or autosaving also stores the chart content in your cloud account.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our service
• Authenticate your identity and manage your account
• Store and retrieve your organizational charts
• Process your chart exports (PNG, PowerPoint, and PDF downloads)
• Process payments for export passes via our payment provider (Stripe)
• Enforce plan limits and entitlements (chart counts, node limits, features)
• Improve and optimize our service through usage analysis
• Communicate with you about service updates, security alerts, and support
• Detect, prevent, and address technical issues or security vulnerabilities
• Comply with legal obligations and enforce our Terms of Service

We do not use your data to train AI models. Your organizational chart data and employee information are never used to train, fine-tune, or improve any artificial intelligence or machine learning system.

4. Third-Party Services

4.1 Google OAuth (Sign in with Google)

We offer Google OAuth as an authentication option, allowing you to sign in using your Google account. When you choose to sign in with Google, we access the following information from your Google account:

• Email address (to create and identify your account)
• Name (to personalize your experience)
• Profile picture (optional, for display purposes)

We do not use your Google data for advertising, data brokering, or any other commercial purposes. Your Google account information is processed through our authentication provider (Stytch). You can revoke access at any time through your Google Account permissions page.

4.2 Authentication Provider (Stytch)

We use Stytch to manage user authentication, registration, and session management. Stytch processes your email address, name, and authentication credentials. Stytch's privacy practices are available at https://stytch.com/legal/privacy.

4.3 Database Provider (Neon)

We store your organizational chart data in a PostgreSQL database hosted by Neon. Data is encrypted in transit and at rest. Neon's privacy practices are available at https://neon.tech/privacy-policy.

4.4 Hosting Provider (Vercel)

Org Chart Studio and its agent integrations run on Vercel. Information sent to server-based features is processed through Vercel's infrastructure. Vercel handles this information as our service provider under its applicable terms and privacy commitments. Vercel's privacy policy is available at https://vercel.com/legal/privacy-policy.

4.5 Payment Processing (Stripe)

We use Stripe to process payments for export passes and optional subscriptions. When you purchase a pass or start a subscription, Stripe collects your payment card details directly, we never see or store your full card number. For a subscription, Stripe stores the billing agreement and processes each renewal charge. Stripe may also collect billing name, email, and IP address for fraud prevention purposes. Stripe's privacy practices are available at https://stripe.com/privacy.

If Stripe confirms a payment but we cannot safely fulfill it automatically, Org Chart Studio places a limited reconciliation case in our own database. The case contains the Stripe Checkout Session, Subscription, or programmatic-payment PaymentIntent identifiers, amount and currency, bounded pass or subscription metadata, timestamps, and a link to your account while that account still exists. It does not contain your card number, wallet private key, billing details, email address, or Stripe's full metadata record. An authorized operator uses this queue to fence a verified refund or record that no value is due; entitlement fulfillment remains on the application's established automated payment path.

4.6 Analytics and Session Recording

Only after you accept the analytics purpose, our first-party event endpoint records pseudonymous page and product events and delivers them to OpenPanel. OpenPanel's browser SDK loads on our pages only after you accept analytics, and the events are PII-scrubbed before delivery. These events contain random or opaque user, account, anonymous, and session identifiers; event names; URL paths without query strings; safe attribution and coarse usage properties; and browser information. We do not put names, email addresses, IP addresses, raw URL parameters, or org-chart employee data into the product-event payload. A minimal server-side page-visit event also fires only after analytics consent. After you accept analytics, we use Google Analytics for traffic and usage analysis; Google may collect device/browser identifiers, IP address (anonymized per our GA4 configuration), and page/event telemetry. Google Tag Manager can additionally coordinate optional advertising conversion tags, and loads only when you accept both analytics and marketing measurement.

Service records are separate from analytics. Business facts — account creation, chart saves, exports, payments, and revenue — are recorded by us on our own systems. They are written by our servers, not by a browser script, and they do not depend on analytics consent. We treat them as part of operating and accounting for the service, on the same footing as the operational records we already keep, and we use them to run the product, enforce plan limits, and reconcile payments (see Sections 3 and 6).

After analytics consent, Help search submissions are also stored in our first-party database for up to 30 days. Each record contains the bounded search text, a normalized form and hash, a small snapshot of returned Help destinations, and whether a destination was opened, together with pseudonymous identifiers. Search text is sent only to this consent-gated first-party endpoint; it is excluded from OpenPanel and Google Analytics. We use these records to manually review real search language and evaluate Help relevance. Help search remains local for matching, sends no chart or employee data, and does not send the question to an AI model or use it to train one.

Session replay is a separate opt-in purpose, and recording is currently paused. No replay recorder is loaded today, so nothing is being recorded: the purpose exists and a consent choice for it is honoured, but no session is captured until a verified recorder is enabled. When it is enabled — and only after you accept the purpose — the OpenPanel replay script, built on rrweb, records how our site and chart studio are used, except on sign-in, verification, and checkout pages, which are never recorded. Text and inputs are masked by default, so text areas, selects, and editable fields are ignored and masked. In the chart studio the employee details in your charts (names, titles, custom fields) are replaced with neutral placeholder text — the transformation happens in your browser, so the recording never contains the real values — and surfaces that list employee data in full — the people list, export previews, and import comparisons — are blocked entirely, along with embedded frames. We send only an opaque first-party actor id — never your name, email, or account traits. The replay recorder captures DOM changes and interactions, not our chart API request or response bodies. OpenPanel does not store IP addresses: a request's raw IP is used transiently to derive coarse location and a daily-rotating anonymous identifier, then discarded. When recording is enabled, replays are deleted after 30 days.

Anonymous counters that do not depend on your choice. Separately from everything above, we keep two counters that contain no information about you as an individual: how many times each page was loaded, and how far down each page was read together with how long each tenth of it stayed on screen. These set and read no cookie, store no identifier of any kind — no visitor id, session id, IP address, or browser user-agent — and record no web address beyond the name of the page itself. Each one adds 1 to a running total shared by everyone who did the same thing that day on the same type of device, so there is no record of you to look up, export, or delete, and nothing that could be traced back to you. We keep them because every other measurement on this page only runs if you accept analytics, which leaves us unable to tell a page nobody visits from a page whose visitors decline the banner. We rely on our legitimate interest in knowing whether the pages we publish are read at all.

Analytics, session replay, and marketing are each controlled by a separate consent toggle — you can accept some purposes and decline others. You choose via the cookie banner when it appears, and can change any choice at any time using the cookie settings link in our footer. Until you accept a specific purpose, the trackers for that purpose do not load. We also honor the Global Privacy Control (GPC) browser signal: if your browser sends GPC and you have not explicitly accepted, we treat it as a decline for all optional purposes.

Provider policies: OpenPanel Privacy Policy · OpenPanel Data Processing Agreement · Google (partner sites)

5. Data Security

We implement appropriate technical and organizational security measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for database storage
• Secure authentication protocols (passwordless magic links and Google OAuth)
• Regular security updates and monitoring
• Content Security Policy reporting to help detect injection attempts
• PII scrubbing in session replay tools (see Section 4.6)

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

6. Data Retention

We keep personal data only as long as we need it. You can delete your account at any time from your account settings; deletion is processed immediately.

How long we keep things

• Saved account and chart data, including chart data created from imports, is kept until you delete the chart or your account, subject to the service's version-history settings.
• Original spreadsheet files selected in the browser application are not retained by our service.
• Spreadsheet content sent through an agent integration is processed for the requested task and is not saved as a separate customer file.
• Drafts and recovery copies stored in your browser may remain on your device until Org Chart Studio removes them or you clear your browser data.
• OpenPanel product and site analytics — retained while our OpenPanel account remains active. OpenPanel does not currently enforce a maximum retention period on analytics events, and deletes the data within 30 days of account termination.
• OpenPanel session replays — none are collected while recording is paused; when recording is enabled, replays are deleted after 30 days
• Google Analytics data — subject to the GA4 property's configured retention (user-level data expires per the Google Analytics retention setting)
• Legacy LogRocket history — retained only during migration validation, then deleted or allowed to expire under the prior retention settings
• Checkout attribution records (session identifiers, UTM source, amount) — 24 months. These are first-party analytics records, not the regulated payment record; Stripe holds payment-instrument records subject to its own retention obligations.
• Payment-reconciliation cases — open cases and refunds in progress are kept until the verified outcome is complete. Detailed standard Checkout case evidence is kept for 24 months after automatic fulfillment or a final operator decision, then removed. Programmatic-payment attempt and final-disposition rows remain as pseudonymous settlement and replay proof after their direct account link is removed. These records are needed to prevent a resolved payment from being misclassified, paid twice, or processed inconsistently later.
• Cookie-consent records — 24 months
• Sign-in (magic-link) email logs — 30 days
• Full payment-instrument and regulated financial records — held by Stripe, our payment processor, subject to its own financial and legal retention requirements (typically up to 7 years for regulated records)

When you delete your account

• Your organizational charts and account information are permanently deleted
• Your sign-in and pending-checkout emails are deleted
• Any remaining analytics rows are stripped of the identifiers that link them to you (anonymized), and your cookie-consent records are deleted
• Any direct account link on an unresolved payment reconciliation case or durable programmatic-payment attempt is removed. The case remains until its payment outcome is completed, and a minimal terminal replay fence remains afterward as described above.
• We delete your customer record with our payment processor
• Deleting your account clears locally saved chart drafts in the browser you use. Drafts in other browsers or on offline devices remain until you clear them there.
• Backup copies may persist for up to 30 days as part of our disaster-recovery procedures

7. Your Rights

Depending on your location, you may have certain rights regarding your personal data. EU/EEA and UK users can also see our GDPR page for the legal bases and a plain-language summary:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (or delete your account directly from settings). Deletion removes your account, charts, and identifiers immediately. Analytics rows are anonymized; consent records are deleted.
• Portability: Export your organizational chart data as CSV, PNG, PowerPoint, or PDF
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing your data
• Withdrawal: Withdraw consent for any optional purpose (analytics, session replay, marketing) at any time via the cookie settings link in our footer

If you are an employee named in someone else's org chart (i.e., you are not an account holder but appear as a person in a chart), the account holder is the data controller for that data and is the appropriate first contact. We assist account holders on request with removing an individual from all stored chart versions. Contact us if you need assistance directing your request.

To exercise these rights, please contact us using the information provided in Section 12. EU/EEA residents may also lodge a complaint with their local supervisory authority.

8. Cookies and Tracking

We use two categories of cookies and browser storage:

8.1 Strictly Necessary (no consent required)

• Authentication session cookies (Stytch), required to keep you signed in
• Browser storage keeps unsaved chart drafts on your device unless a draft is saved to your account
• Cookie-consent preference (ocs_cookie_consent_v2 / v3), stores your per-purpose consent choices (analytics, session replay, marketing) so we can honor them on later visits and on the server

8.2 Analytics (opt-in per purpose, off by default)

Three separate consent purposes — each controlled independently:

• Analytics — first-party page and product events stored in OpenPanel, plus the first-party identifier (ocs_analytics_anon_id, a random id containing no directly identifying information). OpenPanel's browser SDK loads on our pages only after you accept analytics; events pass through our consent and PII-scrubbing endpoint before delivery. OpenPanel's client secret stays on our servers — the browser SDK authenticates with a public client id.
• First-touch attribution — after you accept analytics, the first-party, httpOnly ocs_first_touch cookie stores a bounded page path without its query string, selected campaign fields, and the referring hostname for up to 90 days. A data-free ocs_first_touch_pending coordination cookie may also exist for up to 15 seconds while that grant is recorded. Withdrawing analytics consent clears this attribution storage, and the application rejects attribution from an older consent choice.
• Session replay — currently paused: no recorder is loaded, so no session is recorded today. When enabled, OpenPanel across the site (never on sign-in, verification, or checkout pages), with text and inputs masked by default, chart employee details replaced with placeholder text, and employee-data surfaces and embedded content blocked. OpenPanel may use consent-scoped browser storage for pseudonymous visitor and replay-session state. Replays are deleted after 30 days.
• Marketing measurement — optional advertising conversion tags, such as Reddit or LinkedIn, coordinated through Google Tag Manager. These load only when both analytics and marketing measurement are accepted. This setting does not enroll you in a marketing email list.

Each purpose is off until you accept it. You choose via the cookie banner or the cookie settings link in our footer; declining a purpose — or sending a Global Privacy Control signal without an explicit acceptance — keeps the trackers for that purpose from loading. Your consent choices do not affect your ability to use the service.

9. Children's Privacy

Our service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws different from those in your country. For transfers from the EU/EEA and UK, we rely on the EU-US Data Privacy Framework (and UK Extension / UK-US Data Bridge) where the recipient is certified, and on Standard Contractual Clauses (EU SCCs 2021/914 + UK IDTA/Addendum) supplemented by a transfer impact assessment where SCCs are the operative mechanism.

The following sub-processors receive personal data and are involved in international transfers. A full listing — including data categories, purposes, regions, and transfer instruments — is on our Sub-processor list.

DPF = EU-US Data Privacy Framework / UK Extension (Art. 45 adequacy). SCCs = EU Standard Contractual Clauses 2021/914 + UK IDTA/Addendum (Art. 46). Programmatic (x402) USDC payments settle through Stripe (our payment processor above) — there is no separate crypto-payment sub-processor.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of the service after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: