Privacy Policy

1.What we collect

When you use OrganicDeck

• Account: your email, your name if you add it, your language, the projects you belong to and your role in each.
• Sign-in and security: the one-time codes we send you, when you sign in, your active sessions and the browser they use, and the IP address from which a code is requested, which we keep for one day to stop abuse.
• Your content: the accounts and links you add, groups, notes, saved ideas, the questions you ask Intelligence and its answers, the images you attach, and your project's website and description.
• Billing: your project's plan, its status and history, and the identifiers that connect it to its subscription. Stripe and Link collect your payment details directly, and we never see your full card number.
• Logs: records of requests to our servers, with IP address, browser type and time, and records of the measurements and readings your projects requested.

When you ask for access

• Your work email and the language of the page, so we can write to you when your access is ready.

Public data from social platforms

• About each public account a customer adds: username, display name, profile picture, bio and bio link, follower and post counts, and how they change over time.
• About its public posts: caption, hashtags, publication date, link, cover and slide images, video, and counts such as views, likes, comments and shares over time.
• What our AI produces about those posts: a description of each slideshow or video, labels for its hook and structure, and a short explanation when a post does much better than the account's usual.

We get this data from what the platforms show publicly, with our own systems and third-party data collection services. We don't access private accounts, private messages or anything that requires signing in.

2.How we use it and why

We use personal data for these purposes, on these legal bases:

• To provide OrganicDeck: create your account, sign you in, run your projects, measure accounts, read posts and answer your questions. Basis: our contract with you or your company.
• To bill your plan and keep financial records. Basis: contract and legal obligations.
• To send you service emails, such as sign-in codes, your access, and notices about your plan, billing and these policies. Basis: contract and legitimate interests.
• To keep OrganicDeck secure and prevent abuse, such as repeated sign-in attempts, repeated trials or account rotation. Basis: legitimate interests.
• To measure public posts for our customers. Our customers and we have a legitimate interest in understanding how public content performs. We limit this to what people choose to publish, and we honor objections (see the next section).
• To answer your requests and support questions. Basis: contract and legitimate interests.
• To improve OrganicDeck with aggregated information about how it's used. Basis: legitimate interests.
• To comply with the law and enforce our terms. Basis: legal obligations and legitimate interests.

We don't sell personal data or share it for advertising. We don't use your content to train AI models. We don't make decisions with legal or similarly significant effects about anyone based solely on automated processing.

3.If your account is measured in OrganicDeck

If you have a public account on one of these platforms, a customer may have added it to a project, usually because you create content for their brand or they want to learn from what you publish.

We only measure what's public on your profile and posts. The customer sees your posts' numbers, images and AI readings inside their project. OrganicDeck doesn't let them contact you.

You can object at any time. Write to [email protected] with the link to your account and a way to confirm it's yours, such as writing from the email in its bio or posting a code we give you. We'll stop measuring it and delete what we hold about it, except anything the law requires us to keep.

4.Who we share it with

We share personal data only with companies that help us run OrganicDeck, under contracts that limit its use to that work, and each one receives only what it needs:

• Render: hosting of the app, the database and its backups.
• Cloudflare: private storage of post images and of backups.
• Supabase: sign-in with email codes.
• Resend: delivery of our emails, like sign-in codes.
• Google (Gemini API): AI reading of slideshows and videos, and answers to questions. It receives the post images and videos, your questions, attached images and the project context the answer needs.
• Third-party data collection services: help us collect public data from social platforms. They receive only the public usernames and links being measured, never information about you or your team.
• Stripe and Link: payments, taxes, receipts and fraud prevention. They act as independent controllers under their own privacy policies (Stripe, Link).

Other people who see data:

• Members of your projects see your name and email and the content added to each project.
• Other customers never see your content or which accounts you track. The public measurements and AI readings of a public post may be shown to every customer that tracks it.
• Authorities or others, when the law requires it or to protect rights and safety, and a buyer or successor if we're part of a merger or sale, under the protections of this policy.

5.Cookies

We use a single cookie, app_session, to keep you signed in. It's strictly necessary, lasts up to 30 days and is removed when you sign out.

Your browser also keeps your language and a few view preferences, like list or grid, in local storage.

We don't use analytics, advertising or tracking cookies, so there's no cookie banner. Stripe's checkout pages, on Stripe's own domain, use Stripe's cookies for payments and fraud prevention.

6.International transfers

OrganicDeck is run by a U.S. company, and our systems and the companies we work with are mainly in the United States. Our team may also access data from other countries, such as Argentina.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's standard contractual clauses and their UK and Swiss equivalents, or on the EU-U.S. Data Privacy Framework when the recipient is certified.

7.How long we keep it

• Your account: while it exists. If you ask us to delete it, we do so within 30 days, except what the law requires us to keep.
• Projects and their content: while they have a plan, and up to 12 months after the plan ends, as our Terms explain.
• IP addresses of sign-in requests: one day.
• Images attached to a question you never sent: two hours. Images in a question you sent: as long as the conversation exists.
• Videos: we don't keep them. Each one is downloaded to be read, sent to the AI and deleted when the reading finishes.
• Access requests: until we give you access or you ask us to delete yours.
• Public data about accounts and posts: as long as it's part of the history of a project that tracks or tracked the account. We delete it when the account's owner objects.
• Backups: 30 days.
• Billing records: as long as tax and accounting law requires.

8.Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, get a copy in a portable format, object to or restrict how we use it, and withdraw consent where we rely on it.

To use these rights, write to [email protected]. We'll reply within 30 days and may ask you to confirm your identity. Using them won't change how we treat you.

If you're in the European Economic Area, the United Kingdom or Switzerland, you can also complain to your data protection authority.

California. We collect the categories of personal information described above: identifiers such as email and IP address, commercial information such as plans and purchases, internet activity such as logs, and professional information people publish on social media. We use them for the purposes above. We don't sell personal information or share it for cross-context behavioral advertising. You can ask to know, delete or correct your personal information, directly or through an authorized agent.

9.Security

We protect data with encrypted connections (HTTPS), private storage, one-time sign-in codes, access limited to the people who need it and daily backups. No system is completely secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires.

10.Children

OrganicDeck isn't meant for anyone under 18, and we don't knowingly collect children's data. Some public accounts may belong to minors. If you believe a child's account is measured in OrganicDeck, write to us and we'll remove it.

11.Changes to this policy

We'll post any change here with a new date. If it's significant, we'll tell you by email or in the app before it takes effect.