Privacy Notice

Orgline is operated by Jeffrey Duane Madsen, a sole proprietor trading as Orgline. For the personal data described below, Jeffrey Duane Madsen is the data controller. Where you upload information about your own employees or team members, you are the controller of that data and we act as your processor, handling it only to provide the Service.

What we collect and why

• Account data (name, email address, login credentials or Google sign-in identifier) — to create and secure your account and provide the Service. Legal basis: performance of a contract.
• Workspace and people data you enter (employee names, job titles, reporting lines, departments, work contact details, photos, role descriptions) — to build and display your org chart and directory. Legal basis: performance of a contract; you are responsible for your own lawful basis for the employee data you upload.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Usage and telemetry, device identifiers, IP address, error logs — for security, fraud prevention, debugging, and improving the product. Legal basis: legitimate interests.
• Subscription status (plan, seat limits, renewal state) received from our payment provider — to apply your plan entitlements. Legal basis: performance of a contract. Card details are never seen or stored by us.

Who we share data with

• Merchant of Record — Paddle.com Market Ltd handles the sale, payments, subscription management, tax compliance, and invoicing for our products.
• Service providers / subprocessors — hosting, database, authentication, and email infrastructure providers who process data on our instructions.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to protect our legal rights.

We do not sell personal data or share it for third-party advertising.

Public share links

If you create a public chart link, the chart content you chose to publish becomes readable by anyone with the link until you revoke it. You can hide contact details when creating the link.

International transfers

Our providers may process data in the United States and other countries. Where data is transferred out of the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Retention

We keep workspace data for as long as your account is active. After account closure we delete or anonymise workspace data within 90 days, except records we must keep for legal, tax, or accounting purposes (typically up to 7 years). Audit and security logs are kept for up to 12 months.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent. UK and EEA residents may also complain to their supervisory authority. We respond to requests within one month. Contact privacy@orgline.co.

Security

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls that isolate each workspace, least-privilege service access, and audit logging of administrative changes.

Cookies

We use essential cookies and local storage to keep you signed in and remember interface preferences (for example, whether to play the sign-in intro). We do not use advertising cookies. You can clear or block cookies in your browser, but essential ones are required to sign in.

Contact

Jeffrey Duane Madsen (trading as Orgline) — privacy@orgline.co.