Privacy Policy

1. Introduction

Welcome to Org Chart Studio ("we," "our," or "us"). We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our organizational chart creation and management service.

By using Org Chart Studio, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

Data controller / processor note: Org Chart Studio acts as a data processor for the employee and organizational data you enter into charts. You, as the account holder, are the data controller for that information and are responsible for ensuring you have appropriate authority to store and process it.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name
• Email address
• Authentication credentials (managed securely by our authentication provider, Stytch)
• Profile information you choose to provide

2.2 Organizational Chart Data

When you use our service, we store:

• Organizational chart structures you create
• Employee/person data you input (names, titles, departments, manager relationships)
• Excel or CSV files you import
• Chart metadata (creation dates, modification history, versions)
• Layout preferences and visual settings

2.3 Usage Information

We automatically collect certain information when you use our service:

• Device information (browser type, operating system)
• IP address and general location data
• Usage patterns and interactions with our service
• Session data and authentication timestamps

2.4 Local Storage

Our application stores draft charts locally in your browser's localStorage to preserve your work between sessions. This data remains on your device and is not transmitted to our servers unless you explicitly save to the cloud.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our service
• Authenticate your identity and manage your account
• Store and retrieve your organizational charts
• Process your chart exports (PNG, PowerPoint, and PDF downloads)
• Process payments for export passes via our payment provider (Stripe)
• Enforce plan limits and entitlements (chart counts, node limits, features)
• Improve and optimize our service through usage analysis
• Communicate with you about service updates, security alerts, and support
• Detect, prevent, and address technical issues or security vulnerabilities
• Comply with legal obligations and enforce our Terms of Service

We do not use your data to train AI models. Your organizational chart data and employee information are never used to train, fine-tune, or improve any artificial intelligence or machine learning system.

4. Third-Party Services

4.1 Google OAuth (Sign in with Google)

We offer Google OAuth as an authentication option, allowing you to sign in using your Google account. When you choose to sign in with Google, we access the following information from your Google account:

• Email address (to create and identify your account)
• Name (to personalize your experience)
• Profile picture (optional, for display purposes)

We do not use your Google data for advertising, data brokering, or any other commercial purposes. Your Google account information is processed through our authentication provider (Stytch). You can revoke access at any time through your Google Account permissions page.

4.2 Authentication Provider (Stytch)

We use Stytch to manage user authentication, registration, and session management. Stytch processes your email address, name, and authentication credentials. Stytch's privacy practices are available at https://stytch.com/legal/privacy.

4.3 Database Provider (Neon)

We store your organizational chart data in a PostgreSQL database hosted by Neon. Data is encrypted in transit and at rest. Neon's privacy practices are available at https://neon.tech/privacy-policy.

4.4 Hosting Provider (Vercel)

Our application is hosted on Vercel's infrastructure. Vercel may collect certain usage and performance data. Their privacy policy is available at https://vercel.com/legal/privacy-policy.

4.5 Payment Processing (Stripe)

We use Stripe to process payments for export passes. When you purchase a pass, Stripe collects your payment card details directly, we never see or store your full card number. Stripe may also collect billing name, email, and IP address for fraud prevention purposes. Stripe's privacy practices are available at https://stripe.com/privacy.

If Stripe confirms a payment but we cannot safely fulfill it automatically, Org Chart Studio places a limited reconciliation case in our own database. The case contains the Stripe Checkout Session or programmatic-payment PaymentIntent identifiers, amount and currency, bounded pass metadata, timestamps, and a link to your account while that account still exists. It does not contain your card number, wallet private key, billing details, email address, or Stripe's full metadata record. An authorized operator uses this queue to fence a verified refund or record that no value is due; entitlement fulfillment remains on the application's established automated payment path.

4.6 Analytics and Session Recording

Only after you accept the analytics purpose, our first-party event endpoint records pseudonymous page and product events and delivers them to Rybbit. These events contain random or opaque user, account, anonymous, and session identifiers; event names; URL paths without query strings; safe attribution and coarse usage properties; and browser information. We do not put names, email addresses, IP addresses, raw URL parameters, or org-chart employee data into the product-event payload. A minimal server-side page-visit event also fires only after analytics consent. Also only after you accept the analytics purpose, we use Google Tag Manager to coordinate our tracking tools and Google Analytics for traffic and usage analysis; Google may collect device/browser identifiers, IP address (anonymized per our GA4 configuration), and page/event telemetry. Tinybird is retained temporarily as a read-only historical archive and rollback source.

Session replay is a separate opt-in purpose. After you accept it, the Rybbit replay script records how our site and chart studio are used — except on sign-in, verification, and checkout pages, which are never recorded. Inputs, text areas, selects, and editable fields are ignored and masked. In the chart studio the employee details in your charts (names, titles, custom fields) are replaced with neutral placeholder text — the transformation happens in your browser, so the recording never contains the real values — and surfaces that list employee data in full — the people list, export previews, and import comparisons — are blocked entirely, along with embedded frames. We send only an opaque first-party actor id — never your name, email, or account traits. The replay recorder captures DOM changes and interactions, not our chart API request or response bodies. As with any direct browser request, Rybbit receives the network IP address transiently; IP storage is disabled for our site.

Anonymous counters that do not depend on your choice. Separately from everything above, we keep two counters that contain no information about you as an individual: how many times each page was loaded, and how far down each page was read together with how long each tenth of it stayed on screen. These set and read no cookie, store no identifier of any kind — no visitor id, session id, IP address, or browser user-agent — and record no web address beyond the name of the page itself. Each one adds 1 to a running total shared by everyone who did the same thing that day on the same type of device, so there is no record of you to look up, export, or delete, and nothing that could be traced back to you. We keep them because every other measurement on this page only runs if you accept analytics, which leaves us unable to tell a page nobody visits from a page whose visitors decline the banner. We rely on our legitimate interest in knowing whether the pages we publish are read at all.

Analytics, session replay, and marketing are each controlled by a separate consent toggle — you can accept some purposes and decline others. You choose via the cookie banner when it appears, and can change any choice at any time using the cookie settings link in our footer. Until you accept a specific purpose, the trackers for that purpose do not load. We also honor the Global Privacy Control (GPC) browser signal: if your browser sends GPC and you have not explicitly accepted, we treat it as a decline for all optional purposes.

Provider policies: Rybbit Privacy Policy · Rybbit Data Processing Agreement · Google (partner sites)

5. Data Security

We implement appropriate technical and organizational security measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for database storage
• Secure authentication protocols (passwordless magic links and Google OAuth)
• Regular security updates and monitoring
• Content Security Policy headers to mitigate injection attacks
• PII scrubbing in session replay tools (see Section 4.6)

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

6. Data Retention

We keep personal data only as long as we need it. You can delete your account at any time from your account settings; deletion is processed immediately.

How long we keep things

• Account & chart data — for the life of your account (deleted when you delete your account)
• Rybbit product and site analytics — up to 5 years on the Pro plan required for session replay, unless deleted earlier. Rybbit deletes or returns personal data after termination as described in its DPA.
• Session replay — subject to Rybbit's provider retention and deletion controls, and never longer than the applicable Rybbit plan retention above
• Google Analytics data — subject to the GA4 property's configured retention (user-level data expires per the Google Analytics retention setting)
• Legacy Tinybird and LogRocket history — retained only during migration validation, then deleted or allowed to expire under the prior retention settings
• Checkout attribution records (session identifiers, UTM source, amount) — 24 months. These are first-party analytics records, not the regulated payment record; Stripe holds payment-instrument records subject to its own retention obligations.
• Payment-reconciliation cases — open cases and refunds in progress are kept until the verified outcome is complete. Detailed standard Checkout case evidence is kept for 24 months after automatic fulfillment or a final operator decision, then removed. Programmatic-payment attempt and final-disposition rows remain as pseudonymous settlement and replay proof after their direct account link is removed. These records are needed to prevent a resolved payment from being misclassified, paid twice, or processed inconsistently later.
• Cookie-consent records — 24 months
• Sign-in (magic-link) email logs — 30 days
• Full payment-instrument and regulated financial records — held by Stripe, our payment processor, subject to its own financial and legal retention requirements (typically up to 7 years for regulated records)

When you delete your account

• Your organizational charts and account information are permanently deleted
• Your sign-in and pending-checkout emails are deleted
• Any remaining analytics rows are stripped of the identifiers that link them to you (anonymized), and your cookie-consent records are deleted
• Any direct account link on an unresolved payment reconciliation case or durable programmatic-payment attempt is removed. The case remains until its payment outcome is completed, and a minimal terminal replay fence remains afterward as described above.
• We delete your customer record with our payment processor
• Local browser data (drafts) remains on your device until you clear browser storage
• Backup copies may persist for up to 30 days as part of our disaster-recovery procedures

7. Your Rights

Depending on your location, you may have certain rights regarding your personal data. EU/EEA and UK users can also see our GDPR page for the legal bases and a plain-language summary:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (or delete your account directly from settings). Deletion removes your account, charts, and identifiers immediately. Analytics rows are anonymized; consent records are deleted.
• Portability: Export your organizational chart data as CSV, PNG, PowerPoint, or PDF
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing your data
• Withdrawal: Withdraw consent for any optional purpose (analytics, session replay, marketing) at any time via the cookie settings link in our footer

If you are an employee named in someone else's org chart (i.e., you are not an account holder but appear as a person in a chart), the account holder is the data controller for that data and is the appropriate first contact. We provide account holders with a per-employee erasure tool that removes an individual from all stored chart versions. Contact us if you need assistance directing your request.

To exercise these rights, please contact us using the information provided in Section 12. EU/EEA residents may also lodge a complaint with their local supervisory authority.

8. Cookies and Tracking

We use two categories of cookies and browser storage:

8.1 Strictly Necessary (no consent required)

• Authentication session cookies (Stytch), required to keep you signed in
• Draft chart localStorage, stores unsaved work on your device only; never transmitted
• Cookie-consent preference (ocs_cookie_consent_v2 / v3), stores your per-purpose consent choices (analytics, session replay, marketing) so we can honor them on later visits and on the server

8.2 Analytics (opt-in per purpose, off by default)

Three separate consent purposes — each controlled independently:

• Analytics — first-party page and product events stored in Rybbit, plus the first-party identifier (ocs_analytics_anon_id, a random id containing no directly identifying information). Rybbit does not load in the browser for this purpose; events pass through our consent and PII-scrubbing endpoint.
• First-touch attribution — after you accept analytics, the first-party, httpOnly ocs_first_touch cookie stores a bounded page path without its query string, selected campaign fields, and the referring hostname for up to 90 days. A data-free ocs_first_touch_pending coordination cookie may also exist for up to 15 seconds while that grant is recorded. Withdrawing analytics consent clears this attribution storage, and the application rejects attribution from an older consent choice.
• Session replay — Rybbit across the site (never on sign-in, verification, or checkout pages), with inputs ignored/masked, chart employee details replaced with placeholder text, and employee-data surfaces and embedded content blocked. Rybbit may use consent-scoped browser storage for pseudonymous visitor and replay-session state.
• Marketing — future marketing communications (no marketing list is currently active; this consent purpose is reserved)

Each purpose is off until you accept it. You choose via the cookie banner or the cookie settings link in our footer; declining a purpose — or sending a Global Privacy Control signal without an explicit acceptance — keeps the trackers for that purpose from loading. Your consent choices do not affect your ability to use the service.

9. Children's Privacy

Our service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws different from those in your country. For transfers from the EU/EEA and UK, we rely on the EU-US Data Privacy Framework (and UK Extension / UK-US Data Bridge) where the recipient is certified, and on Standard Contractual Clauses (EU SCCs 2021/914 + UK IDTA/Addendum) supplemented by a transfer impact assessment where SCCs are the operative mechanism.

The following sub-processors receive personal data and are involved in international transfers. A full listing — including data categories, purposes, regions, and transfer instruments — is on our Sub-processor list.

DPF = EU-US Data Privacy Framework / UK Extension (Art. 45 adequacy). SCCs = EU Standard Contractual Clauses 2021/914 + UK IDTA/Addendum (Art. 46). Programmatic (x402) USDC payments settle through Stripe (our payment processor above) — there is no separate crypto-payment sub-processor.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of the service after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: