Privacy Policy

1.What we collect

When you use OrganicDeck

• Account: your email, your name if you add it or the one a project gives you, your language, the projects you belong to and your role in each.
• Sign-in and security: the one-time codes we send you, when you sign in, your active sessions and the browser they use, and the IP address from which a code is requested or a Google sign-in comes back, which we keep for one day to stop abuse. If you sign in with Google, the only thing we get from Google is the email of the account you pick, and we use it to find your account.
• Your content: the accounts and links you add, groups, notes, saved ideas, the questions you ask Intelligence and its answers, the images you attach, the links of the web pages you ask it to read, your project's website and description, your slideshow drafts, the links of the Pinterest boards you import, and the images you upload.
• TikTok accounts you connect: when you connect a TikTok account to send it drafts, TikTok gives us its ID, username, display name and profile picture, and the tokens that let OrganicDeck send drafts to its inbox. We keep the tokens encrypted and use them only to send the drafts you ask for. We don't read or post anything else on that account.
• Billing: your project's plan, its status and history, and the identifiers that connect it to its subscription. Stripe and Link collect your payment details directly, and we never see your full card number. We keep the identifier Stripe gives your card (a fingerprint, not its number) so each card gets one free trial.
• Logs: records of requests to our servers, with IP address, browser type and time, and records of the measurements and readings your projects requested.

When you ask for access

• Your work email and the language of the page, so we can write to you when your access is ready.

Public data from social platforms

• About each public account a customer adds: username, display name, profile picture, bio and bio link, follower and post counts, and how they change over time.
• About its public posts: caption, hashtags, publication date, link, cover and slide images, video, the sound it uses, and counts such as views, likes, comments, shares and saves over time.
• What our AI produces about those posts: a description of each slideshow or video and labels for its hook and structure.
• What Intelligence reads when a customer asks: the most liked comments of a post, with their likes, replies and dates but not who wrote them, and the public profile and newest posts of an account the customer doesn't follow. We keep both for one day and never add that account to a project.
• From Pinterest, when a customer imports a board: the board's name, its owner's username and the links of its images. We keep the links, not the images.

We get this data from what the platforms show publicly, with our own systems and third-party data collection services. We don't access private accounts, private messages or anything that requires signing in.

2.How we use it and why

We use personal data for these purposes, on these legal bases:

• To provide OrganicDeck: create your account, sign you in, run your projects, measure accounts, read posts and answer your questions. Basis: our contract with you or your company.
• To bill your plan and keep financial records. Basis: contract and legal obligations.
• To send you service emails, such as sign-in codes, your access, and notices about your plan, billing and these policies. Basis: contract and legitimate interests.
• To keep OrganicDeck secure and prevent abuse, such as repeated sign-in attempts, repeated trials or account rotation. Basis: legitimate interests.
• To measure public posts for our customers. Our customers and we have a legitimate interest in understanding how public content performs. We limit this to what people choose to publish, and we honor objections (see the next section).
• To answer your requests and support questions. Basis: contract and legitimate interests.
• To improve OrganicDeck with aggregated information about how it's used. Basis: legitimate interests.
• To comply with the law and enforce our terms. Basis: legal obligations and legitimate interests.

We don't sell personal data or share it for advertising. We don't use your content to train AI models. We don't make decisions with legal or similarly significant effects about anyone based solely on automated processing.

3.If your account is measured in OrganicDeck

If you have a public account on one of these platforms, a customer may have added it to a project, usually because you create content for their brand or they want to learn from what you publish.

We only measure what's public on your profile and posts. The customer sees your posts' numbers, images and AI readings inside their project. OrganicDeck doesn't let them contact you.

OrganicDeck also publishes pages of its own, open to anyone, with the public accounts that post about an app: their usernames and profile pictures, and their posts' numbers, covers, slides and AI readings.

You can object at any time. Write to [email protected] with the link to your account and a way to confirm it's yours, such as writing from the email in its bio or posting a code we give you. We'll stop measuring it, take it off those pages and delete what we hold about it, except anything the law requires us to keep.

4.Who we share it with

We share personal data only with companies that help us run OrganicDeck, under contracts that limit its use to that work, and each one receives only what it needs:

• Render: hosting of the app, the database and its backups.
• Cloudflare: private storage of post images and of backups.
• Google (sign-in): if you sign in with Google, you do it on Google's own page, so Google knows you're signing in to OrganicDeck. It tells us the email of the account you pick. Google's privacy policy applies there.
• Resend: delivery of our emails, like sign-in codes.
• Sentry: error reports, so we can find and fix failures. A report says what failed and on which browser or device, and identifies you only by an internal ID.
• Google (Gemini API): AI reading of slideshows and videos, and answers to questions. It receives the post images and videos, your questions, attached images and the project context the answer needs.
• Third-party data collection services: help us collect public data from social platforms. They receive only the public usernames and links being measured, never information about you or your team.
• Stripe and Link: payments, taxes, receipts and fraud prevention. They act as independent controllers under their own privacy policies (Stripe, Link).
• TikTok: when you send a draft, TikTok receives its slides as images, with the title and description you write, and puts them in the inbox of the account you chose. From there, TikTok's privacy policy applies.

Other people who see data:

• Members of your projects see your name and email and the content added to each project.
• Other customers never see your content or which accounts you track. The public measurements and AI readings of a public post may be shown to every customer that tracks it.
• Authorities or others, when the law requires it or to protect rights and safety, and a buyer or successor if we're part of a merger or sale, under the protections of this policy.

5.Cookies

We use a cookie, app_session, to keep you signed in. It's strictly necessary, lasts up to 30 days and is removed when you sign out. If you sign in with Google, a second one, google_login, links Google's answer to your browser. It lasts 10 minutes at most and is removed as soon as you're back.

Your browser also keeps your language and a few view preferences, like list or grid, in local storage.

We don't use analytics, advertising or tracking cookies, so there's no cookie banner. Stripe's checkout pages, on Stripe's own domain, use Stripe's cookies for payments and fraud prevention.

6.International transfers

OrganicDeck is run by a U.S. company, and our systems and the companies we work with are mainly in the United States. Our team may also access data from other countries, such as Argentina.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's standard contractual clauses and their UK and Swiss equivalents, or on the EU-U.S. Data Privacy Framework when the recipient is certified.

7.How long we keep it

• Your account: while it exists. If you ask us to delete it, we do so within 30 days, except what the law requires us to keep.
• Projects and their content: while they have a plan, and up to 12 months after the plan ends, as our Terms explain.
• IP addresses of sign-in requests: one day.
• Images attached to a question you never sent: two hours. Images in a question you sent: as long as the conversation exists.
• Videos: we don't keep them. Each one is downloaded to be read, sent to the AI and deleted when the reading finishes.
• Images you upload to a board: until they're removed from it and no slideshow uses them, or until the project's content is deleted.
• A connected TikTok account: until you or a project owner disconnect it, which also removes our access on TikTok. The slides of a draft sent to TikTok: until TikTok takes them, one day at most.
• Access requests: until we give you access or you ask us to delete yours.
• Public data about accounts and posts: as long as it's part of the history of a project that tracks or tracked the account. We delete it when the account's owner objects.
• Backups: 30 days.
• Billing records: as long as tax and accounting law requires.

8.Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, get a copy in a portable format, object to or restrict how we use it, and withdraw consent where we rely on it.

To use these rights, write to [email protected]. We'll reply within 30 days and may ask you to confirm your identity. Using them won't change how we treat you.

If you're in the European Economic Area, the United Kingdom or Switzerland, you can also complain to your data protection authority.

California. We collect the categories of personal information described above: identifiers such as email and IP address, commercial information such as plans and purchases, internet activity such as logs, and professional information people publish on social media. We use them for the purposes above. We don't sell personal information or share it for cross-context behavioral advertising. You can ask to know, delete or correct your personal information, directly or through an authorized agent.

9.Security

We protect data with encrypted connections (HTTPS), private storage, one-time sign-in codes, access limited to the people who need it and daily backups. No system is completely secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires.

10.Children

OrganicDeck isn't meant for anyone under 18, and we don't knowingly collect children's data. Some public accounts may belong to minors. If you believe a child's account is measured in OrganicDeck, write to us and we'll remove it.

11.Changes to this policy

We'll post any change here with a new date. If it's significant, we'll tell you by email or in the app before it takes effect.