Privacy Policy

This policy explains what personal data orgcanvas collects, why, where it is kept and what you can ask us to do with it.

Who we are

orgcanvas is a service of Soft Planet LLC, registered in the Republic of Armenia. For any question about personal data, write to info@orgcanvas.am.

Two kinds of data, two roles

Data about you as a visitor or a customer (the website, your account, invoices). For this data Soft Planet decides how it is used and is responsible for it.
Data your company puts into orgcanvas about its employees (positions, people, pay, goals, test results and the like). Your company decides what to put in and why, and is responsible for it. Soft Planet only stores and processes it on your company's instructions, as set out in the Data Processing Agreement.

What we collect

On the website (orgcanvas.am): nothing until you accept cookies. If you accept, Google Analytics counts the pages you visit and the clicks on the demo and on the waiting list. If you decline, nothing is collected. You can change your choice at any time with "Cookie settings" at the bottom of every page.

When a company registers: the company name, the e-mail and password of the person who registers (the password is stored only in a protected, irreversible form), the contact person, contact e-mail and phone.

For invoices: the company's legal name, tax number (ՀՎՀՀ), legal address and country, the plan chosen, invoices and payments.

While the service is used: the e-mail and role of each user, the time of the last sign-in, the number of employees and users per month (to apply the right plan), the number of AI requests (not their content), and a log of changes made in the company's data, so that changes can be traced and undone.

E-mails: the invitations and notices orgcanvas sends, and the letters you write to info@orgcanvas.am.

What the AI receives

Some tasks (for example a draft job description) use an AI model from OpenAI. The model receives only anonymised context: job titles, departments, the company profile and similar. Names, contact details, ID numbers and salaries are never sent to the model. Under OpenAI's terms for its API, this data is not used to train its models. Nothing the AI writes counts until a person in your company confirms it.

Employees who are not users

Tests, surveys and goal setting open from a personal link, without an account. Engagement survey answers are anonymous: orgcanvas shows only totals for groups of at least five people and never shows who answered what.

Why we use the data

to provide the service your company signed up for (the contract);
to send invoices and keep accounting records (the law);
to keep the service secure and to fix problems (our legitimate interest);
website statistics, only with your consent.

We do not sell personal data and we do not use it for advertising.

Where the data is kept and who helps us

The database is in the European Union, in Frankfurt, Germany. These companies help us run the service and may process data on our behalf:

Supabase — database and sign-in (EU, Frankfurt);
Vercel — hosting of the website and the application;
Cloudflare — the orgcanvas.am domain;
Resend — sending and receiving e-mail;
OpenAI — AI drafts, anonymised context only;
Google — website statistics, only after consent.

Some of them are based in the United States. They are bound by their own data protection terms and process data only to provide their service to us.

How long we keep it

Your company's data is kept while the account is active.
When an account is closed, its data is deleted within 90 days, or earlier if your company asks.
Invoices and payment records are kept as long as Armenian tax law requires.
Website statistics are kept by Google for no more than 14 months.

How the data is protected

Each company's data is separated in the database. Roles decide who sees what, and pay is visible only to roles allowed to see it. Data travels encrypted (HTTPS) and is encrypted where it is stored. Every change is logged.

Your rights

You can ask us to show you the personal data we hold about you, to correct it, to delete it, or to stop using it, and you can withdraw your consent to statistics at any time. Write to info@orgcanvas.am; we answer within 30 days.

If you are an employee of one of our customers, please contact your employer first: they decide about the data in orgcanvas, and we will help them answer you.

If you think we have not respected your rights, you can complain to the Personal Data Protection Agency of the Republic of Armenia.

Children

orgcanvas is a service for companies and is not meant for anyone under 16.

Changes

When we change this policy, we change the date at the top. If a change matters for our customers, we tell them by e-mail before it applies.