Privacy notice

Who we are

OrgSync is operated by Fushimi AI Inc, based in Halifax, Nova Scotia, Canada. Our privacy officer, the founder, is responsible for our privacy practices. Contact the privacy officer at support@orgsync.co (Monday to Friday, 9:00–17:00 Toronto time).

This notice covers orgsync.co, the web app and OrgSync's connection to your AI app. Your AI app and its provider have their own privacy terms.

Company content and account information. Your company decides how its company content is used. We process that content on its behalf to provide OrgSync. We are responsible for our own account, sign-in, billing and support records.

What we collect

• Accounts and sign-in. Your name and email address, sign-in times, IP address and browser details. Google sign-in also provides your Google identifier, profile photo address and sign-in tokens. Email sign-up stores a password hash, never the password itself. We use cookies to keep you signed in.
• Company and work profiles. Company name, purpose, location, business stage and help areas; members, permission profiles and invitation email addresses; and work profiles, responsibilities, reporting relationships and earlier versions.
• Drafts and shared knowledge. Summaries and excerpts your AI app submits, links to their originals when provided, optional company tags, shared sources and revisions, knowledge statuses, correction proposals and problem reports. A draft stays private to its author until shared.
• Company files. Files members upload, with each file's name, type, size, who added it and when, and its folder. We also keep text that OrgSync reads from PDF, Word and text files so that members' AI apps can use it. Folder names and who may open each folder are company records.
• Goals and weekly reviews. Company and personal goals, success criteria, responsible people, dates, statuses and revisions; review check-ins, progress descriptions, next-week priorities, exact contribution references and the drafts selected for sharing. Optional goal review schedules include local time, time zone and moved or skipped occurrences. These are company-readable records, not private notes.
• To-dos and reminders. To-dos you save through your AI app or on the web: a title, an optional note, dates, times, repeats, reminders, optional links to a goal, request, source or colleague, and their state. A to-do is private to you: other members, including Owners, cannot read it. We also keep your to-do time zone and when your reminders came due.
• Human collaboration. Requests, manager assignments, recipients, reviewers, criteria, acknowledgment, agreement, date proposals, blockers, selected evidence, responses and review judgments with their exact revision history. These records are readable by current company members and their permitted AI connections. They are unsuitable for confidential or participant-only work. Framework selections and their history are also company records. External links do not give OrgSync or another member access to the linked content.
• Stories and discussion. We store derived stories and source references, generation metadata, story preferences, daily selections, seen state, likes and comments with their authors, revision numbers, edit and removal timestamps, moderation metadata and links to reviewed company-record changes. Comments are company-readable discussion. Editing a comment replaces its stored body; removing it blanks that body. We do not keep a full comment edit history.
• Home brief. Each person's latest Home brief, the records it cites and read, and a record of when each was written.
• Onboarding chat. Messages you enter to describe a role are sent to our AI provider to draft a work profile. OrgSync does not store the conversation. It saves the profile you confirm and a record that the chat was used.
• Connections and confirmations. Connected AI apps, use times, cited-source references, and records of the exact versions and changes you confirmed. AI app access tokens are stored as fingerprints, not as the tokens themselves.
• Answers on the web. When you approve or answer on the web, we record that you did, when, and what was shown: for approvals given together, which items were listed and which you opened.
• Usage and billing. Plan, credit, usage, payments and free-trial records; guide-use events and answer-usefulness verdicts. These measurement records do not contain your conversation or free-text feedback. Stripe handles card details. We also count, per day, how often our pages and features are opened, which buttons are pressed and which kind of site sent a visitor. These counts use no cookies and store nothing that identifies you or your company: your browser keeps only the last day it opened our site, so each visit is counted once that day. We keep the counts for 13 months.
• Product feedback. Feedback about OrgSync that you ask your AI app to send: its kind, product area and impact, your paragraph and the day it arrived. It is stored without your name, email, company or AI connection. Only OrgSync's team reads the text, outside the web app, and Anthropic's Claude helps us group and summarize it.
• Reminders. Whether you opted in, the weekday and time zone you chose, your consent record, and send and unsubscribe records.
• Support and recovery. Messages you email us, technical status and error logs, and a separate recovery journal of identifiers for events such as revocations and deletions. That journal contains no names or content. Technical logs are designed to exclude content, IP addresses and tokens; sign-in records are separate.

How we use information

• To sign you in, manage membership and permissions, store company records and return relevant context with citations.
• To store company files, show each file only to the people and AI employees its folder allows, and let a member's AI app read the text of a file they may open, in a folder that allows AI apps.
• To save goals and reviews, draft work profiles, and send verification links and one welcome email.
• To summarize company updates and personalize For you stories using work profiles, responsibilities, role objectives, active goals and story preferences. Owners can pause automatic generation and set its shared credit budget. In Settings, people can choose their importance level, categories, and the teams, projects, topics and people they follow or mute. Likes and comments do not automatically change company records.
• To write a short brief on Home from records the person can already see there.
• To send a weekly review reminder only if you opt in. It contains the company name and counts, not goal titles, priorities or shared text. You can turn it off in Settings or through an email's unsubscribe link.
• To bill for use, manage credit, prevent misuse, answer support requests, secure and recover the service, and meet legal obligations.
• To improve OrgSync using aggregate counts, timings, costs, usefulness verdicts and the product feedback you choose to send.

OrgSync does not automatically capture conversations or read your other tools. Your AI app submits the material you ask it to prepare. When you use import or refresh, access to the original tool happens through connections in your AI app.

Who can see your information

Your company. Members can see company-shared content, goals, reviews, collaboration requests and responses, blockers, selected evidence and their history, along with names, email addresses, permission profiles and work profiles. Your to-dos are private to you, like your unshared drafts. OrgSync checks each person's access before returning context. Other members cannot read your private drafts. Company files follow their folder's access: the people, teams and AI employees an Owner or folder manager allows. Owners can open every folder.

Service providers. We use AWS for hosting, file storage, backups, embeddings, recovery, logs and service emails; Supabase for database storage; and OpenRouter routed to Microsoft Azure for AI processing. Stripe handles payments. Google provides optional sign-in and our support mailbox, and Namecheap forwards support email. Anthropic's Claude helps our team group and summarize product feedback. Google Fonts receives connection details when fonts load.

Our Security and data handling page at orgsync.co/security lists each provider, its purpose, the information it receives and its processing location. It also explains the older data copy still held on a stopped Fly.io server.

Operational access. Our operator can technically reach stored data while running OrgSync, for example when taking or testing a recovery point. We access content only to operate, secure, recover or support OrgSync, at your request, or when the law requires it.

We may disclose information when the law requires it or to protect people's rights and the service. If the business is sold or reorganized, information may transfer to a successor required to follow this notice, and we will tell company owners.

AI processing and your AI app

Shared text is sent to OpenRouter and Microsoft Azure to build the search index. Onboarding chat messages use the same route to draft profiles. Both model routes require zero data retention and deny data collection. Private drafts are not sent to OrgSync's model or embedding providers until shared.

Company files and the text read from them are not sent to OrgSync's AI model or embedding providers. A file's text reaches a member's own AI app only when that app reads a file the member may open, in a folder that allows AI apps.

Story generation sends eligible company-readable source text, goals, reviews and work-profile changes to OpenRouter for significance assessment, summarization, grounding verification and personalization. Personalization also sends the person's permitted work profile, responsibilities, role objectives, active goals and category preferences. OrgSync checks access before sending inputs and before returning results. Private drafts and raw discussion are not story-model inputs.

Stories uses OpenRouter's global API pinned to Microsoft Azure's US endpoint, azure/us, with zero data retention required, data collection denied and no provider fallback. This does not guarantee end-to-end United States residency through OpenRouter.

A person can hand a selected comment to their own AI app for a deliberately confirmed change through the existing review process.

Amazon Bedrock, using Cohere Embed, receives shared text, search requests and the asking person's work profile to create search vectors. Amazon states that Bedrock does not store these inputs by default or use them to train models.

A provider's zero-retention setting does not delete records you save in OrgSync. Their retention is described below.

Context returned by OrgSync, including cited excerpts and other records you request, goes to your connected AI app. Your AI provider's terms govern its use of that information. OrgSync cannot recall copies already delivered or exported. Disconnecting stops future access.

Processing outside Canada

OrgSync is run from Canada. Its application and database process information in the United States. When Azure's US model endpoint is unavailable, shared text and onboarding messages may use its EU endpoint. Our operator also holds encrypted database backups in Canada.

Stories uses OpenRouter's global API pinned to Microsoft Azure's US endpoint, azure/us, with zero data retention required, data collection denied and no provider fallback. This does not guarantee end-to-end United States residency through OpenRouter.

Information processed abroad is subject to the laws of those countries and may be accessible to their courts and authorities. Payment, sign-in, support and font providers operate their own infrastructure; the provider register at orgsync.co/security links their privacy information.

How long we keep information

• Company content. Shared knowledge, work profiles, goals, reviews, collaboration records, framework selections and their history stay while the company uses OrgSync, until deleted under the rules below. Completing a goal does not delete its history.
• Stories and discussion. Stories and discussion follow the company-content retention rules. Deleting a parent source blocks access immediately and removes its stories and discussion during cleanup. Permitted earlier-version discussion can remain inspectable while its parent record is retained. Content-free generation and accounting receipts remain separately after content deletion.
• Home brief. Deleting a source removes any Home brief written from it. Deleting the company removes every brief.
• Private drafts. Unshared draft text is deleted 14 days after creation or the last explicit edit, or when you discard it.
• Company files. Kept until someone allowed to edit their folder deletes them, or the company is deleted. Deleting a file stops access at once and removes the stored file, normally within minutes. Its record and any text read from it can remain in backups for up to 30 days.
• To-dos. Done, dropped and handed-off to-dos are deleted 30 days after you close them. You can delete a to-do at any time. If you leave a company, your to-dos there are deleted.
• Deletion. Deleting a source or the company stops access at once. We remove active copies, aiming to finish within 7 days. Backups that contain them expire within 30 days after that.
• After paid access ends. You have 30 days to export or restart your plan. We then delete company content under the same rules. Content can remain in backups for up to 67 days after paid access ends.
• Companies without a paid plan. A company that has never had paid access, or whose free trial ended without a plan, keeps its content until an owner deletes it. OrgSync may delete a company that has gone 90 days without paid access or a free trial, after emailing its owners at least 14 days before.
• Records kept after company deletion. Company content, profiles, goals, reviews, to-dos, company files and folders, collaboration records, framework selections, reminder preferences, approvals and feedback are removed. People's accounts, membership and invitation records, and content-free usage records remain. The recovery journal permanently keeps identifiers so a restore cannot bring back deleted content or removed access.
• Product feedback. Kept while it helps us improve OrgSync. Because it carries no name or company, it remains after company deletion, and we can find a message to delete only if you tell us its text.
• Accounts and sign-in records. We keep accounts while they are in use. There is no self-serve account deletion; contact us to request it. Signing out deletes that sign-in record. Expired sign-in records are deleted when next presented, but no scheduled cleanup currently removes records that are never presented again.
• Backups and logs. Each recovery point expires within 30 days of capture. Automatic daily disk snapshots are kept for 5 days. Technical logs are kept for 30 days.
• Support, billing and audit. Support emails are kept as long as needed for the request, up to 2 years. Billing and minimal audit records are kept as long as the law requires, without deleted company content.

How we protect information

We use encrypted connections, encrypted disks and backups, separate company search indexes, and server-side access checks. The Security and data handling page at orgsync.co/security explains our safeguards and current limitations.

No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and tell the affected people and companies as soon as feasible.

Your rights and choices

• Request access to your personal information, a correction or account deletion by emailing the privacy officer.
• Export the company's shared knowledge from Settings › Data. Exports do not include private drafts or to-dos. The ZIP export also includes the company files you may open, and each file downloads from the Files page.
• Company exports include story discussion and source references, not every Stories table. They do not include a complete copy of generated stories, preferences, selections, seen state or likes.
• Discard your drafts, delete sources you are authorized to delete, or revoke an AI connection. Owners can correct work profiles and delete company content after cancelling renewal.
• Turn weekly reminders off in Settings or unsubscribe from the email.
• Delete your to-dos from your AI app.
• Withdraw consent, subject to legal or contractual limits. We will explain any effect on the service and any information we must retain.

Send requests to support@orgsync.co. We may verify your identity and will respond within 30 days. For company-controlled content, we may direct your request to the company's owners.

You can complain about our handling of personal information to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

Children

OrgSync is a business service for people aged 18 or older. We do not knowingly collect personal information from children.

Changes to this notice

We update the date above when this notice changes. We will tell company owners by email at least 30 days before a material change takes effect.

Contact

Privacy questions and requests: support@orgsync.co (Monday to Friday, 9:00–17:00 Toronto time). Fushimi AI Inc is based in Halifax, Nova Scotia, Canada.