Skip to content
ORG-APP
Legal

Privacy policy

Version 1, in effect since Oct 24, 2026.

About this policy

ORG-APP is an online service that organizations use to run their people, units, time, leave, training, events, giving, money, governance, messages, documents and websites. It is run by VantageTech Apps Limited ("VantageTech", "we", "us" and "our"), a federal corporation incorporated under the laws of Canada and registered in Ontario, corporation number 1827120-8. Our Privacy Officer is accountable for how we handle personal data, and you can reach them at legal@org-app.com.

This policy explains how personal data is handled on ORG-APP. It is for:

  • people who visit org-app.com;
  • the Owners and administrators of the organizations that use ORG-APP;
  • the people whose records an organization keeps on ORG-APP, such as its staff, volunteers, members, board members, trainees and donors;
  • people who book an organization's events, give to it, sign up on its website, or join one of its groups or classes;
  • people from outside an organization who speak at its programs or teach its classes;
  • people who apply to our partner program, ask us for a quote or report a page to us.

Most of the personal data on ORG-APP is held for the organizations that use it, not for us. The next section explains the difference, because it decides who you should ask about your data.

Our two roles

For an organization's records, the organization decides

Organizations use ORG-APP to keep records about their people. For those records, the organization is in control: it decides what is kept, why, who can see it and for how long. Data protection laws call it the controller, or the organization accountable for the data. We are its processor, or service provider: we store and handle those records only to provide ORG-APP to the organization, and only as it instructs. Our Data processing agreement with each organization sets this out.

If an organization keeps records about you, its own privacy notice applies to them, and your questions and requests go to the organization first. An organization can link its notice from its website and from every public form on it, in Settings › Your data › Your privacy notice. "Your rights" below explains how to ask.

For our own records, we decide

We are in control of the data we use for our own purposes:

  • the account of each organization that is our customer, including the names and email addresses of its Owners and administrators, its plan, its billing and the record of its agreement to our terms;
  • what organizations send us to be verified, and their requests to change their name or address;
  • our dealings with partners, with people who ask us for a quote, and with people who report a page to us;
  • visits to org-app.com;
  • the records we keep to protect ORG-APP, such as counts of failed sign-ins.

This policy describes those records in full. It also describes, in outline, what organizations can keep on ORG-APP, so that you know what the service may hold about you.

What we collect for our own purposes

When someone creates an organization

We ask for:

  • the organization's name and its web address on ORG-APP;
  • the person's first name, last name and email address;
  • what kind of organization it is, and its country, time zone and currency;
  • the plan they chose and, if they have one, a partner's code.

We email a link to confirm the address and set a password. The person who creates the organization becomes its first Owner.

The record of our agreement

An organization agrees to our Terms of service and our Data processing agreement by checking a box: when it is created, when the first Owner of an organization we set up opens their account, or when an Owner is asked to agree later. We keep a record of each agreement: the organization, the person who checked it, which versions of the documents they agreed to, when, how, and the IP address the agreement came from. When we change one of those documents, we also record which Owners we told, and when. This record is the evidence of our agreement with the organization, and we keep it for as long as we keep the organization's account records.

While an organization uses ORG-APP

We keep:

  • its plan, trial dates and add-ons, and any discount or waived fee;
  • its invoices, payments and refunds, and the reference of any payment made outside Stripe;
  • when it pays online, the customer and subscription references Stripe gives it;
  • which partner introduced it, if any;
  • the support requests its people raise with us, what they write in them, and our replies;
  • the notices we send its Owners about bills, trials and changes to our legal documents or sub-processors.

When an organization asks to be verified, which it must be before it can take payments, it sends us its legal name, the register it is in and its number there, its official website, and the name and phone number of a person we can call. It may also send a copy of its registration certificate. We delete that copy from storage as soon as we have decided, and keep only the rest of the request. When an organization asks to change its name, product name or web address, we keep the request and our decision.

We use its Owners' and administrators' names and email addresses to run the account: to bill, to give support and to send those notices.

We never see or keep card numbers. Cards are entered on Stripe's own pages, and Stripe holds them.

Partners, quotes and reports

If you apply to our partner program, we keep what you give us: your company's name, your name, email address, country and website, and what you tell us about your work. If you become a partner, we also keep your tier, your referral code, the organizations you introduced and the payouts we make to you. If you ask for a quote, we keep your organization's name, your name, email address and country, and the quote itself. If you report a page to us, we receive the page's address, what you say is wrong with it, and your email address if you give one, by email; ORG-APP itself keeps nothing of the report.

Visits to org-app.com

Our host, Vercel, keeps logs of the requests made to ORG-APP's servers, which include the IP address, the browser and the page asked for. When something fails, the error is recorded there too, and it can occasionally include a detail from the request, such as an email address. We use these logs to run and secure the service. Our hosting provider keeps request logs for a short period set by its plan; we keep no copy of them.

Some forms use Cloudflare Turnstile to check that a person, not a program, is sending them: signing in, asking for a sign-in code, resetting a password, creating an organization, booking a public event, giving on an organization's website, signing up on it, joining a group or a class, and reporting a page. When you use one of these forms, Cloudflare receives information from your browser, and your IP address, to decide whether you are a person.

We don't use analytics, advertising or tracking tools. We don't sell personal data, and we don't share it for advertising. We do count how many times each page of the app is opened each day, and by which organization, so that we know which features are used. That count never records which person opened a page.

If your browser tells us that it blocked something on one of our pages, we log the report, with any private codes in its web addresses removed.

Keeping ORG-APP secure

To stop people guessing passwords or sending forms by the thousand, we count attempts at signing in and at sending some forms, by email address and by IP address. Each count is deleted within a day once it is more than 15 minutes old, unless a lockout it caused is still running.

When someone asks for a sign-in code by email, we keep the code (only in a form that cannot be read back), the email address and the IP address it was asked from, for 30 days.

When someone activates their account, resets a password, joins a group through a public link, or agrees to our terms for an organization, the IP address and browser they used are recorded in the organization's audit trail. When an Owner or administrator signs in from a browser that has not signed in as them before, we email them to say so, naming the kind of browser; which browsers are known is kept in a cookie in the browser itself, not by us.

Each time you sign in, we keep a record of where you are signed in: the device, as your browser describes itself (for example "Safari on an iPhone or iPad"), when you signed in and last used it, and, if you chose to have it remembered, until when. We don't record the device's IP address for this. You can see the list, and sign out of any other device, under Account › Where you're signed in. When a device becomes remembered, we tell you, by email too. The record is deleted 30 days after the device was last used. When somebody downloads the whole organization, or 25 or more people's contact, pay, giving or safeguarding details, every Owner and administrator is emailed who took it, what, and when. Our own staff's sign-ins and actions in our console are recorded in the same way.

When a page or a scheduled job fails, our team is emailed what failed, so that we can put it right: a failed page by where it failed and the kind of error, and a failed job by its errors, with any email address in them taken out.

Why we use this data

Canada's privacy law asks for your consent to collect, use and disclose personal data, and lets it be implied where the purpose is obvious and the data is not sensitive. We use the data above only for the purposes this policy gives, which are the ones you would expect when you use ORG-APP. Where a law such as the GDPR asks instead for a legal basis, ours are:

  • to provide ORG-APP and run each organization's account: the contract with the organization;
  • to keep the record of that contract: our legitimate interest in being able to show what was agreed, and our legal obligations;
  • to bill, and to keep accounting and tax records: the contract, and our legal obligations;
  • to verify organizations before they take payments: our legitimate interest in protecting the people who pay them, and in keeping ORG-APP from being used for fraud;
  • to give support and to tell Owners about changes: the contract, and our legitimate interest in running the service well;
  • to keep logs, secure the service and prevent abuse: our legitimate interest in keeping ORG-APP, and the people who use it, safe;
  • to run the partner program, answer requests for quotes and act on reports: the steps you asked us to take, and our legitimate interest in running our business.

What organizations can keep on ORG-APP

What an organization keeps depends on the features it uses and what it chooses to record. It can include:

  • Profile and contact details: name, preferred name, names in another script, pronouns, email addresses, phone numbers, home address, date of birth, nationality, languages, photo and staff number.
  • Emergency contacts: who to call, how they are related, and how to reach them.
  • Roles: the units and positions a person holds, the groups and teams they belong to, when they started and left, and why they left.
  • Time and attendance: when a person clocked in and out, including by scanning an ID card at a door kiosk, their timesheets and corrections, and reasons for absence.
  • Location at clock-in: where the person's device was when they clocked in or out, if they let their browser share it.
  • Leave: requests, types, dates, reasons and balances.
  • Training, courses and classes: the courses and classes a person is on, and their answers to a class's joining questions; attendance at each session, which the register can suggest from whether the person was in the session's video call for at least half of it; work handed in, quiz answers, marks, feedback and reviews by classmates; which lessons of a self-paced course they marked as read, and their progress along a learning path, worked out from their courses; completions, renewals and certificates; and, for a paid class, what is owed and paid for a place. Anyone who has a certificate's number can check it on the organization's page, which shows the organization's name, the name printed on the certificate, the course, its dates and whether it still stands.
  • Checks: background checks, references, right-to-work checks and qualifications, with their outcomes, dates and reference numbers, and copies of identity and right-to-work documents.
  • Pay details, where an organization uses them: pay rate, bank account, tax reference and pension enrollment.
  • Events and bookings: the name and contact details of the person who booked, each attendee's name and, where the booking asks for them, their date of birth, gender, middle name and their own email and phone, answers to the booking's questions, waivers agreed to, check-ins, rooms and payments; and, where a program has a checklist, what each traveler gives for it: details such as a passport's number and expiry and an emergency contact, agreements, and photos or PDFs of documents such as a passport's photo page, a visa, insurance or a medical form.
  • Donors and gifts: donors' names, email addresses, phone numbers and postal addresses, how they prefer to be contacted, notes about them, their gifts and pledges, the thank-yous and yearly statements sent to them, and what people give or promise on an organization's Give page. Each thank-you or statement email carries a link to the donor's own page, where they can see their receipts and statements and change how they are contacted; each link works for about a year, and only a hash of it is kept.
  • Money: ledgers, budgets, levies, expense claims with photos of receipts, bills and suppliers with their contact and payment details, and bank statements with their lines; the bank accounts, QR codes, payment pages and Stripe accounts its units are paid through; and the payments recorded for bookings and for places on classes, which are posted to the unit's books, including those matched from a payment page's export.
  • Governance: boards and committees, meetings and who attended, minutes, votes, declarations of interest and resolutions.
  • Communication and work: messages and their attachments, reports of messages, posts, comments and who has read a post, reports and the notes and photos written towards them, and documents in Drive, with their earlier versions and who opened them.
  • Video calls: who joined a call and when, who asked to share their screen and who was let, each person's answer if they were asked whether a call may be recorded, and the name of any person from outside the organization invited to a call by a personal link, with their email address until the invitation ends.
  • Follow-up: people who signed up on the organization's website or at an event, their contact details, and notes about keeping in touch.
  • Participants directory: one record for each person who registered for or attended one of the organization's programs, or was on one of its courses, whether or not they have an account: their first, middle and last name, email address, mobile number, WhatsApp number where it is a different number, gender and date of birth, and the programs, courses, groups and follow-ups they took part in, which are read from the organization's own records. Nothing else a program asks, such as a church, a T-shirt size, a health need or an emergency contact, goes into it. The same person is recognized by their email address or mobile number; a name and a date of birth alone only suggest it to somebody who checks. The organization's people who may see people where the person took part can see it, and the record links to the person's account once they have one.
  • Outside contacts: speakers, trainers and others the organization books who are not its members.
  • The audit trail: who did what and when, and for some actions the IP address and browser used.

Some of this is sensitive. Answers to booking questions, and to a class's joining questions, can include medical, dietary and accessibility needs, and a program's checklist can hold passport details and medical forms. Reasons for leave or absence can reveal health. Background checks can concern criminal records. Records about children may be kept, for example for events for young people. And belonging to, or giving to, some organizations can reveal a person's beliefs.

The organization decides what to keep, and it is responsible for having a lawful reason to keep it. We don't use these records for our own purposes. Our staff look at an organization's records only when it asks for support, or when we must: for example, to restore lost data, to carry out a request under data law or to deal with a security incident. "Security" below describes how a support visit is limited.

Guest accounts

Somebody who booked a program, was booked onto one by somebody else, was invited to a call, or was booked to speak at a program can sign in to that organization with a code emailed to them, where the organization allows it, to see their own bookings, calls, checklists, receipts and the programs they speak at there in one place. There is no password, and a guest account is never a member's account: it holds no role in the organization and opens nothing of the organization's but what is the guest's own. For each guest account we keep, for that organization alone: the email address it signs in with, the name it gives, when it was made and when it last signed in, and the devices it is signed in on (each device as its browser describes itself, when it was signed in to and last used, and until when; no IP address). We keep this so that its holder can sign in again and see what is theirs. What a guest account shows is read from the organization's own bookings and invitations at the time, and nothing of them is copied into it: if an organization changes the email address on a booking, the booking leaves that guest account at once. One organization's guest account is separate from another's, even for the same email address. A sign-in lasts 90 days on a device; signing in on another device asks for a code again. Its holder can sign out of any device, change the name, and delete the account, from its own page; deleting it removes the account and its devices, and the bookings stay with the organization, which keeps them as described in this policy. A guest account is deleted 12 months after its last sign-in, once nothing is coming up for it, and where a guest account is signed in is deleted 30 days after it was signed out, or its 90 days ended.

Outside speakers

An organization can keep somebody from outside it, such as a visiting speaker, in its Resources with their name and email address, and book them to speak at one of its programs. Once the booking is agreed, that email address can sign in to the organization with an emailed code, as a guest account, and its page shows where they are speaking: the program, its days and place, their own lines of its running order with their times, and the answer they gave. It never shows anybody else's name or photo, the program's crew or participants, its notes or its money, and what it shows is read from the booking at the time: if the organization changes the email address, or calls the booking off, it leaves that guest account at once.

On the organization's behalf and under its name, ORG-APP emails an outside speaker when the organization would like to book them, when their part, its times or the place change (at most one email an hour), when the booking is called off or the program canceled, and the day before their first line. Each says why it came and that it isn't a mailing list, and they stop when the booking is called off or the program ends. The "I'll be there" and "I can't" buttons in these emails open a page that answers that one booking and nothing else: we keep only a hash of the link, it works only while the email address is still the one it was sent to and until the program ends, and it stops when the booking is called off; opening it changes nothing until a button on the page is pressed. Their answer, and any note they add, go to the people at the organization who keep and booked them, and the organization's log records it without the link.

An outside speaker who adds the organization's site to their phone's home screen and signs in there may turn on phone notifications for that device. They are told only that their part changed, that it was called off, or that it is tomorrow, with a short title and a link and no names, never at night in the program's own time zone, and the emails still go. Nothing is sent to a device once its sign-in has run out, or to an address that has since become one of the organization's members. For this we keep the device's push address and keys with their guest account and the device it was turned on from; turning it off, signing that device out, deleting the guest account, or the organization turning guest accounts off deletes them.

Classes, and people from outside who join or teach them

A class can ask questions of the people who join it, as a booking can. An organization can mark some of those questions as sensitive: their answers are shown only to the people from the organization who run the class, one person's at a time and only when they choose to look, and each look is recorded. A person's answers are deleted when they leave the class or are taken off it, and when they are erased. Everybody else's are deleted 12 months after the class finished or was canceled, apart from a signed waiver, which stays with the place, as a booking's does. Answers sent with a request to join a class are kept until the request is answered: they move to the person's place if it is accepted, and are deleted if it is not, or else 12 months after the class finished or was canceled. Where classmates review each other's work, the reviewer is not shown whose work it is, and the person reviewed is not shown who reviewed it; the people who run the class see both names.

Where a class allows guests, somebody from outside the organization can join it from its link: they give their name and email address, prove the address with a code emailed to them, and confirm that they are 18 or older. The organization keeps their name, their email address and when they proved it, with their place on the class. They sign in with a code emailed to them, and see only their own learning: their classes, quizzes, work and certificates. Their name is shown to the people who run the class.

An organization can also ask somebody from outside it, kept in its Resources, to teach one of its classes. They are emailed an invitation, and sign in with a code emailed to them. For that class alone, they see its sessions and the register; its learners' names, and their work and marks; their answers to its joining questions, except any marked sensitive; and its materials, which they can add to; and they can set work, mark it and give feedback, and send messages to the class. They never see the organization's other classes, its directory of its people, contact details beyond any a learner gives in answer to the class's joining questions, answers marked sensitive, or the course's own page or its settings. Their access ends 30 days after the class's last session, at once if the class is canceled, or sooner if the organization ends it; the sessions they taught stay on the organization's record.

The account made for a learner who joined as a guest, or for a teacher from outside, is a guest account made for a class, not the guest account for bookings and calls described above: it is erased 12 months after the last class it was on ended, or after it was made or last signed in, if later, as "How long data is kept" describes.

Stay in touch

After a program or a call, somebody who booked it, was invited to it or joined it by its shared link, and somebody signed in to a guest account, may check "Stay in touch" to get that organization's news about its programs and events by email; the box is never checked for them, and nobody can add them to the list by hand. Where the address is one the organization invited, or a guest account signs in with, checking the box is enough, and we send them a short email saying how to stop; where it is the address on a booking, or one they type, all it is sent is a link to confirm, which works once and for 7 days, and they get news only after they press it. For each, the organization keeps the email address, the name given, where and when they asked, and which words they agreed to; only the organization's people who may send its broadcasts see the address. Every news email carries, at its foot and in its headers, a link that stops it at once, and deleting the guest account, or the person being erased, stops it too. Asking for news is kept until it is stopped; once withdrawn, only a coded form of the address, when and how are kept, for 2 years, and then deleted. An email address typed to ask for news and never confirmed is deleted 7 days later, when its link runs out.

Who we share data with

Our sub-processors

We use other companies to run ORG-APP. They handle data for us, and for the organizations that use ORG-APP, under contract. They are called sub-processors:

  • Supabase runs ORG-APP's database, which holds every organization's records, in Singapore.
  • Vercel hosts ORG-APP and runs the servers that handle every request, in Singapore. Each request reaches those servers through Vercel's network, which spans many countries, and Vercel keeps the logs described above, in the locations Vercel's own terms describe, which may include the United States.
  • Cloudflare stores the files organizations upload, such as documents, photos, receipts and attachments, in its R2 storage, in the locations Cloudflare's own terms describe for it, which may include the United States. It also runs the check on public forms, Turnstile, on its global network.
  • Resend delivers the emails ORG-APP sends, in the locations Resend's own terms describe, which may include the United States.
  • Google runs our own email, Google Workspace, so it holds what you send to an org-app.com address, such as support@org-app.com, in the locations Google's own terms describe, which may include the United States.
  • Anthropic translates a message when its reader presses Translate, where Translate is switched on. It receives that one message's text, in the United States, and ORG-APP stores neither the text it sent nor the translation.
  • Stripe takes card payments for ORG-APP plans, when online payment is switched on, in the locations Stripe's own terms describe, which may include the United States.
  • Hetzner Online hosts our video server, meet.org-app.com, in Helsinki, Finland. A call's audio and video, and the names people join with, pass through it while the call lasts, and it does not record them.

The current list, with what each company does and where, is on our Sub-processors page. Before we start using a new sub-processor, we tell every organization's Owner by email, at least 30 days ahead.

Video rooms

ORG-APP's own video rooms run on our own video server, meet.org-app.com, which Hetzner Online hosts for us in Helsinki, Finland. A call's audio and video, and the names people join with, pass through it while the call lasts, and it does not record them. Each person joins with their own signed link, which names them and expires, so a room's address alone lets nobody in. Nobody in a call is shown another person's email address. Whoever runs a call can invite one person from outside the organization, such as a visiting speaker, by a personal link that names them, says whether they may share their screen, and works only from half an hour before the call starts until it ends. If the host gives the guest's email address, ORG-APP sends the link to it and clears the address once the invitation has ended; otherwise the host copies the link and sends it themselves. ORG-APP keeps only a hash of such a link, and the organization's log records the guest's name and who invited them, never the link. The email carries a calendar file for the call with the same link, and 15 minutes before the call ORG-APP sends that address one reminder that the room is open, with a second link of its own to the same invitation, also kept only as a hash; somebody who booked a call is sent the same reminder with a link to their booking. A guest is never a host of the call, and where somebody under 18 may be in the room, a guest waits until an adult host lets them in. Whoever runs a call can also make one shared link for it, for any number of people from outside the organization: each gives the name the call shows, with Guest beside it, and waits in the lobby until a host lets them in. ORG-APP keeps only a hash of that link and when it was last used, never the names typed at it. Whoever runs a call can record it to their own computer, in a browser such as Chrome or Edge, but never a call that somebody under 18 may be in; the call tells everybody in it who is recording, and the recording is saved on that computer alone and never reaches ORG-APP. An organization can instead hold its calls on its own service, such as Zoom, Google Meet or Microsoft Teams, by adding the call's link.

Services an organization or you choose

Some services are turned on by an organization, or by you, and work under their own terms:

  • Card payments. An organization that we have verified can take card payments for its events and its paid classes through a Stripe account of its own, which it connects for one of its units and which works under its own agreement with Stripe. For a booking, we give Stripe the event's title, the booking code and the email address of the person who booked; for a place on a class, the course's and the class's names, the place's reference and the learner's own email address. We never give it the attendees' or learners' names or dates of birth. ORG-APP keeps Stripe's reference for each payment with the amount paid, never the card's details, and we take no fee from it.
  • Payment pages. An organization can send the people who pay it to a payment page it chooses, such as Zeffy, Donorbox or Givebutter. The company behind that page is the organization's choice, works under its own terms, and is not one of our sub-processors: ORG-APP opens the organization's page as it is, and sends it nothing. If the organization downloads its payments from that page and imports the file, ORG-APP reads it to match each payment to its booking or class place, by its reference, or by the payer's email address and the exact amount owed. It keeps the payments it matched, with the page's number for each, and keeps neither the file, nor the names in it, nor the rows it did not match.
  • Sign in with Google. Where ORG-APP offers it, and unless an organization turns it off, you can sign in with your Google account. Google tells us your verified email address, and we use it only to find your account. Signing in with Google never creates an account.
  • Notifications on your devices. If you allow them, your browser's push service, usually run by the browser's maker, delivers them. Each carries a short title and a link, never the message itself.
  • An organization's own services, such as its own storage for files, its own video service joined by a link, a payment page it links to, or a map it links to for an event's place.
  • Calendar apps. If you subscribe to your ORG-APP calendar in another app, that app fetches your events through a private link. You can replace the link at any time, which stops the old one working.

Other disclosures

We may also disclose personal data:

  • when the law requires it, for example to comply with a court order. We check that a request is lawful, disclose no more than it requires, refer it to the organization concerned where we can, and tell the organization unless the law forbids it;
  • to our professional advisers, such as lawyers and accountants, who must keep it confidential;
  • to a company that takes over our business, which must then protect it as this policy does.

Where data is held

We are in Canada. ORG-APP's database and servers are in Singapore, our other sub-processors handle data in the places listed above, and our staff reach it from Canada when they support an organization. The organizations on ORG-APP, and their people, are in many countries, so personal data is often handled outside the country where it was collected. While it is held in another country, the courts, law enforcement and national security authorities of that country may be able to reach it under that country's laws. We protect it by contract with each sub-processor, so that it keeps a level of protection comparable to the one this policy describes. Where a law asks for a particular safeguard for data leaving a country, such as the European Union's standard contractual clauses, we use it.

How long data is kept

Our own records

  • Billing and tax records, such as invoices, payments and refunds: six years.
  • Organization accounts, support requests and the record of each organization's agreement to our terms: two years after the organization leaves.
  • Partner applications, partner records and quotes: two years after our last contact; the payouts we make to partners are kept with our tax records.
  • A request to be verified: the copy of a certificate is deleted as soon as we decide; the rest is kept with the organization's account records.
  • Reports of a page: for as long as we need them to act on what they report.
  • Server logs: kept by our hosting provider for a short period set by its plan; we keep no copy of them.
  • Counts of attempts: deleted within a day once they are more than 15 minutes old, unless a lockout is still running.
  • Sign-in codes, with the email address each was sent to and the IP address it was asked from: 30 days.
  • Where you are signed in, as described under "Keeping ORG-APP secure": deleted 30 days after the device was last used.
  • The mail provider's reports of bounces and complaints are deleted after 7 days; the list of addresses mail no longer goes to is kept, because it is what stops mail to them.

An organization's records

An organization's records stay on ORG-APP for as long as the organization keeps them there. Its administrators can change or delete most records at any time, and its Owners and Organization admins can erase a person (see "Your rights"). Safeguarding checks and identity documents are kept as long as the organization's own policy says, and deleted by the organization from the person's page. ORG-APP also removes some things by itself, on the same schedule for every organization, which is shown in Settings › Your data:

  • the answers to a booking's questions are deleted 12 months after the event ends, apart from a signed waiver, which stays with the booking;
  • an attendee's date of birth, gender, middle name and own email and phone are blanked 12 months after the event ends; the booking itself, each attendee's name, payments and check-ins are kept;
  • a person's record in the Participants directory (their first, middle and last name, email, mobile, WhatsApp, gender and date of birth, and the programs, courses and follow-ups they took part in) is deleted 3 years after their last activity, unless they have an account; the yearly blanking of a booking's details does not empty it;
  • the answers a person gave to a class's joining questions are deleted when they leave the class or are taken off it, and otherwise 12 months after the class finished or was canceled, apart from a signed waiver, which stays with the place; answers sent with a request to join a class are deleted if it is declined or withdrawn, and otherwise at the same time;
  • a traveler's files for a program's checklist (a passport's photo page, a visa, insurance, a medical form) and the checklist details marked sensitive, a passport's always, are deleted 90 days after the program ends, or 30 or 365 days, as its organizers choose; that each thing was done, and checked, stays with the booking;
  • where, and on which device, somebody clocked in or out is blanked 90 days after the punch; the time and the unit stay;
  • the network address and browser on the audit trail, and the network address on the register of sensitive reads, are blanked after 12 months, and the audit trail is sealed again;
  • an email that was never delivered is deleted 90 days after it was queued;
  • a notification not read, or not dealt with, is deleted after 12 months;
  • where somebody is signed in (each device's description, when it was signed in to and last used, and until when it is remembered) is deleted 30 days after the device was last used;
  • a guest account (the email address it signs in with, the name it gives, and when it last signed in) is deleted 12 months after its last sign-in, once nothing is coming up for it, with the devices it was signed in on;
  • where a guest account is signed in is deleted 30 days after it was signed out, or its 90 days ended;
  • a guest account made for a class — a learner who joined a class as a guest, or a facilitator from outside the organization (its name, the email address it signs in with, and when it was made and last signed in) — is erased 12 months after the last class it was on ended, or after it was made or last signed in, if later: its name, address and every way in go, and the class's register, work and marks then read "Erased person"; it is kept longer while it holds a place or a request on a class, money owed for a place, a group, or a certificate still in force, while its own record in the Participants directory has had activity in the last 3 years, or while its address is on a booking, a donor's record, a promise, a follow-up, a request for news or a guest account the organization keeps;
  • the answer link in an outside speaker's email (a hash of it, the address it was sent to, and when it was last used) is deleted the day after it stops working, when the program ends or the link is withdrawn, and at once when the booking is called off or the contact is removed;
  • the link in a donor's thank-you or statement email (a hash of it, the donor it opens, why it was sent, and when it was last used) is deleted 30 days after it stops working; until then, a link that has run out can still ask for a fresh one to be emailed to the donor;
  • an email address typed to ask for news and never confirmed is deleted 7 days later, when its link runs out; asking for news is kept until it is stopped, and once withdrawn, only a coded form of the address, when and how are kept, for 2 years, and then deleted;
  • a deleted file stays in the Drive bin for 30 days, and is then deleted from storage;
  • an upload that was started and never finished is removed after 24 hours;
  • a photo taken for a report's notes and never sent with it is removed a year after the report was sent;
  • the copy of an email kept for sending is deleted 30 days after it is sent;
  • a notification that has been read and dealt with is deleted after 90 days;
  • the record that somebody read a post in a group is deleted 30 days after they read it;
  • an outside contact nobody has booked for two years is deleted;
  • the link in a booking confirmation stops working after 400 days.

An email that could not be sent is kept for 90 days, so that it can be sent again, and is then deleted. The audit trail is not deleted automatically while the organization uses ORG-APP, so that the record of who did what stays whole; only the network address and browser on each entry are blanked, after 12 months. Everything else is kept while the organization uses ORG-APP, until it leaves and asks for it to be erased.

When an organization leaves

Before an organization leaves, an administrator of the whole organization can download an archive of its records in Settings › Your data, and each of its people can download their own data from Your account. When an organization leaves, we close it: it becomes read-only, so its people can still sign in and see their records, but nothing can be changed, and nothing is deleted. Until its records are erased, its Owner can still download a copy of its records, including its people's messages, in Settings › Your data. When an organization asks us to erase its records, we agree a day with its Owner, at least 7 and at most 90 days ahead, a second member of our team approves, and on that day we delete every record of the organization that we hold: people's accounts and details, bookings, checks, pay records, messages, reports and files, its audit trail, its pages and its web address. We keep the organization's name, its invoices and payments to us, and our own record that the erasure was done, with counts and nothing else. We tell its Owners the day once it is approved, and again when it is done. Until then its records stay protected as this policy and our data processing agreement describe and used for nothing else, and the removals listed above go on as before. On the organization's request, we erase any one person from its records at any time. Copies in backups remain for as long as those backups are kept, which our database host's plan sets.

Your rights

Depending on where you live, you may have the right to:

  • know whether we hold personal data about you, and get a copy of it;
  • have it corrected;
  • have it deleted;
  • limit or object to how it is used;
  • receive it in a form you can take elsewhere;
  • withdraw your consent, where something is based on consent;
  • complain to a data protection authority.

Records an organization keeps about you

Ask the organization: it decides, and it can act directly.

  • You can correct many of your own details yourself, under Your account, including your contact details and your emergency contacts.
  • You can download a copy of your own data, under Your account, as a spreadsheet. The file says what it does not include, and how to ask for the rest. It includes your record in the organization's Participants directory, and Your account shows the programs and courses it lists.
  • To be removed from an organization's Participants directory, ask the organization: the people who manage its people where you took part can remove your record, and erasing you removes it. Removing it does not remove your bookings or courses, which the organization keeps as this policy describes.
  • You decide whether your unit's page on the organization's website may name you, under Your account. It doesn't until you say it may.
  • The organization's administrators can correct other details and close your account. Its Owners and Organization admins can download a copy of what is held about you — including what your own copy leaves out, as far as their own keys allow, and also once your account is suspended — and can erase you from its records: your identity is replaced by a mark saying that someone was erased, your personal details are deleted, and the files you own are deleted from storage. Each such download is recorded.
  • The organization can ask us for help with a request under data law.

If you ask us instead, we pass your request to the organization and let you know that we have, unless the organization has asked us to answer for it. We never give out anyone's data on the strength of an email address alone.

Records we keep for our own purposes

Email legal@org-app.com. We answer within 30 days, or sooner where the law requires it. We may first ask you to confirm who you are.

Complaints

If you are unhappy with how your data has been handled, please tell our Privacy Officer first, at legal@org-app.com. You can also complain to the Office of the Privacy Commissioner of Canada, at priv.gc.ca, or to the data protection authority where you live or work.

Cookies and storage on your device

ORG-APP uses only the cookies it needs to work. It uses no analytics, advertising or tracking cookies, so it doesn't ask you to accept any. On our secure site, some of the names below begin with __Secure- or __Host-, which tells your browser to send them only over HTTPS.

Cookies

  • authjs.session-token: keeps you signed in. Signed in for this time only, it works for 12 hours from when you sign in. If you choose "Remember this device" as you sign in, it works for as long as you chose (7, 30 or 90 days, or less where your organization allows less, and never more than 30 days for an administrator), and stops sooner if the device isn't used for 14 days. Using ORG-APP never makes it last longer than you chose. Your browser keeps it for at most 90 days, and it stops working at once if your password is reset or changed, if you sign out of that device, or if your account is suspended.
  • authjs.csrf-token and authjs.callback-url: set while you sign in, to protect the form against forged requests and to remember where to return you. They end when you close your browser.
  • authjs.pkce.code_verifier and oa-google-org: set only while you sign in with Google, to check Google's answer and to remember which organization you are signing in to. They last at most 15 minutes.
  • org_known: remembers, for a year, which accounts have signed in from this browser before, so that an Owner or administrator is told when their account is used from a new one. It holds a coded mark for each account, never a name.
  • org_device: only if you choose "Remember this device" as you sign in. It names the device, so that you are not asked for your authenticator code again here until the remembering ends; your password is still asked. It holds a coded mark for each account remembered here, never a name, and lasts at most 90 days.
  • org_guest: only if you sign in to an organization with an emailed code, as somebody who booked or was invited there. It keeps you signed in to that organization's own pages, and is sent to them alone, for 90 days on that device. It names your guest account and the device with a coded mark, never a name or an email address, and stops working at once if you sign out, delete the account, or the organization stops letting guests sign in.
  • org_confirmed: after you confirm it's you by typing your password again, and the code from your authenticator app if you use one, lets you make important changes for 15 minutes without being asked again.
  • org-app.display: remembers your color theme, text size, spacing, how you left the menu and similar choices, and the day it was last written, so that pages look the way you set them from the moment they open. It lasts a year, and is written again each day you use ORG-APP.
  • org_kiosk: only on a tablet an organization has set up as a door kiosk, so that it can record card scans without anyone signing in. It lasts five years, and stops working as soon as the organization removes the kiosk.
  • org-app-platform, org-app-platform-challenge and org-app-enter: only for our own staff: they keep a staff member signed in to our console, for at most 12 hours, hold the five minutes between their password and their code, and hold a support visit, for at most 30 minutes.

Other storage on your device

  • Your display and layout choices are also kept in your browser: your theme, text size and spacing, which parts of the menu you keep open, the width of panels, your calendar view, the language you translate messages into, where you put a call's window, your microphone and camera settings for calls, whether you turned the single-key shortcuts off, the unit you last chose to clock in at, whether you dismissed the offer to install the app, and when you last put off the offer to turn on notifications, which is made again a week later. On an outside speaker's phone, it also keeps whether they were already asked to turn on notifications, so they are asked once.
  • While a tab is open, it also remembers how far you scrolled the menu and, during a call, which call you are in, so that the call carries on as you move between pages. Both are forgotten when you close the tab.
  • If you clock in or out, send a report or a note, or make an expense claim with photos of its receipts while you have no connection, ORG-APP keeps it on your device and sends it when the connection returns, but only while you are signed in. Anything not sent within a month is deleted. Anything the organization refuses on arrival is kept on the device until you have seen why, for up to 30 days.
  • So that you can clock in, write a report or make a claim with no connection at all, ORG-APP keeps on your device the state of your clock (for a week), the questions of the one report you last opened (for 72 hours), and the units and accounts you may claim at (for a week). None of these names you.
  • If the connection drops as you post an entry to the books, the entry is kept on your device as a draft for 30 days, shown only to you.
  • If you open a booking or a call by its link, your browser keeps the calls and bookings you opened by their link on this phone: their title, times and link, to list them on the organization's page until they end; nothing of it is sent to ORG-APP, and it names nobody. That page lets you forget each of them, or all.
  • A door kiosk keeps the card scans it takes while offline until it can send them.
  • ORG-APP keeps one page on your device, to show when you are offline.
  • On a device you chose to remember when you signed in, the installed app keeps its main pages on the device, so it opens at once, even with no signal; a browser tab keeps none of them. They are removed when you sign out. Once the app has not connected while you were signed in for 72 hours, they are never shown again, and are deleted the next time ORG-APP is opened on that device. Your organization can turn this off. Nothing is kept on a device signed in for this time only, or during a visit from ORG-APP's support, and the device keeps one person's copy at a time: when somebody else signs in on it, what it kept is removed first.
  • On a device you chose to remember when you signed in, ORG-APP keeps your recent messages so Messages opens at once: the 40 newest conversations in your inbox, and the last 50 messages of each of the 20 you opened most recently, as they were last shown to you. It never keeps their attachments, or anything you were still writing. Whatever ORG-APP shows you next replaces it.

Services inside our pages

The check on public forms comes from Cloudflare, which may use its own cookies or similar storage under Cloudflare's own policy. Video rooms are shown from our own video server, meet.org-app.com, which sets no cookies. It keeps its own settings, such as your camera, your microphone and the name you show, the signed link you last joined with, and a list of your recent calls and their polls in your browser's storage, for that server only. A video service an organization joins by a link, such as Zoom, opens on that service's own site.

Children

ORG-APP is for organizations and the people who work and volunteer with them. A person under 13 may have an account only with a parent's or guardian's approval, which the organization records on the person's page: the parent's or guardian's name, how they are related to the child, and how the approval was given, whether in person, on a paper form, by phone or online. No email address or phone number is asked of the parent or guardian. Until that approval is recorded, a person under 13 is given no sign-in, joins no group, and is added to nothing that sends them messages. A person of 13 or over may have an account without an approval, because of how messages are safeguarded, as set out next. An organization that marks a group as being for young people asks everybody joining it for their date of birth.

Messages to and from anybody under 18 keep these rules. Nobody under 18 can have a one-to-one conversation with anybody, adult or child; they write, and are written to, in group conversations only. A group conversation that includes somebody under 18 has at least two adults in it. Messages in such a conversation are never withdrawn or edited by anybody, and can be reported to the organization's safeguarding lead. A person under 13 does not send messages; a message addressed to them is delivered to a parent or guardian the organization has linked to them, marked as being for the child, and with no linked parent or guardian who can sign in, the child cannot be messaged at all. Where an online meeting includes somebody under 18, the call starts with its lobby on, private chat off and recording off.

Organizations may keep records about children: for example, when a parent books a child onto an event for young people, or in a youth or school program. On any booking with a person under 18 on it, the booker confirms that they are the child's parent or guardian and agrees, and that confirmation is kept with the booking, with the booker's name and the time. The organization is responsible for those records, including any consent a parent or guardian has to give. When a booking is paid by card, Stripe never receives the attendees' names or dates of birth.

Security

We protect personal data in these ways:

  • Each organization's records are kept apart by the database itself, and ORG-APP connects to its database in a way that cannot get around that separation.
  • Data travels encrypted: pages over HTTPS, and ORG-APP's connection to its database, whose identity is checked.
  • Files are kept in private storage and opened only through signed links that expire.
  • Passwords are stored only as strong one-way hashes, and so are the codes in the links and the sign-in codes we email.
  • Two-step sign-in with an authenticator app is open to everyone, and is required by default for anyone with an organization-wide role, and for anyone who can see pay or safeguarding checks or post to the books.
  • Signing in slows down and locks after repeated failures. A sign-in lasts 12 hours, unless you choose to have your device remembered: then it lasts as long as you chose, up to 90 days (never more than 30 for an administrator, and less where your organization allows less), and ends after 14 days unused. Every sign-in on every device ends when the password is reset or changed, and you can sign out of any device from your account.
  • Before important changes, such as where payments go or downloading the whole organization, ORG-APP asks you to confirm it's you: your password, and the code from your authenticator app if you use one.
  • A change to where a unit is paid, such as its bank account or its Stripe account, is recorded and told at once to every Owner and Organization admin, by email too. A Unit coordinator or Finance officer can only propose such a change, which another Owner or Organization admin approves.
  • Within an organization, people see only what their roles allow. An organization can keep its members' names from the levels above a unit, mark documents as sensitive or restricted, and keep some board business confidential.
  • Important changes are written to an audit trail that is sealed against tampering and checked every night. Reads of sensitive data, such as medical answers on bookings, are recorded too.
  • Before an organization can take payments, we check who runs it.
  • Our staff enter an organization only when it asks for support. They must give a reason and the reference of the organization's request, and confirm who they are with a fresh code. The visit is read-only, lasts at most 30 minutes, cannot see pay, safeguarding or confidential board business, and is recorded in the organization's own audit trail.
  • Notifications on a phone's lock screen show only a short title.

No system is perfectly secure. If a breach affects an organization's records, we tell the organization without undue delay, so that it can tell the people affected and any authority it must. If a breach of our own records creates a real risk of significant harm to anyone, we tell the people affected and report it to the authorities, as the law requires.

Changes to this policy

The version of this policy and the date it took effect are shown at the top of this page. When we change it, we tell every organization's Owner by email at least 30 days before the new version takes effect. This page then shows the change that is coming, and a "What changes" page shows exactly what changes, line by line.

Contact us

  • VantageTech Apps Limited
  • Our Privacy Officer: legal@org-app.com
  • Help with ORG-APP: support@org-app.com