Privacy

[to be completed: name, address and contact of the controller, and a data protection officer if one is required]

Organizations that use Organica decide for themselves what they collect from their members. For that data they are the controller and the operator of this installation is their processor — which needs a written agreement between them ([to be completed]).

• Your identity: the subject id your login provider issues, plus the first name, last name and username you choose in your profile. Your email address stays with the login provider; Organica’s own database does not keep it.
• What you do in an organization: the objects, cards, comments, chat messages, votes, checklist ticks, check-ins and points your work produces, each recorded with your name and the time. Every change to an object is kept in a change log, and every action a module reports is kept in an event log.
• Files you upload: stored in object storage. Private files are readable only through short-lived links; files you mark public get a stable address anyone who has it can open.
• Documents you scan (a till receipt, a shop’s digital receipt, a leaflet page): the photo or PDF itself is read and then discarded — it is never stored, not in the app, not in the price service, not in a log. What you check and send in — shop, date, total and the lines — is stored twice: as an object in your organization, under your name like everything else you do there, and in the price service (see below), where it carries only your organization’s short name, never yours.
• Your position is asked for in one place: an app’s “Where to shop?”. It is rounded on your device to about a hundred metres, sent together with the open items of the list to work out the plan, and not stored. Your browser asks you first; if you decline, there is no plan and nothing is sent.
• Alert channels you connect (for example your own Telegram bot): the credentials are encrypted before they are stored.

Application, database and object storage run in Frankfurt, Germany (DigitalOcean, region fra1). Database connections are encrypted.

• Other members of an organization you join see what you contribute there, under your name. An organization can publish an app that anyone with the link may open.
• The login provider (Keycloak, run by the operator) handles sign-in and holds your email address and login times. [to be completed: tenant region and the transfer safeguards relied on]
• The AI provider, when an organization uses an AI feature (chat summaries, the in-chat assistant, card drafting, the configuration assistant, an app's voice assistant): the text handed to that feature — which can include chat transcripts, and what is currently on the app's screens — is sent to the configured endpoint. A spoken request is sent as audio for transcription and discarded right after; recordings are never stored. The same holds for a picture you show an app's assistant. [to be completed: which provider and endpoint this installation uses, and the agreement with them]
• The AI provider that reads scanned documents. A receipt or leaflet page you scan is read by a vision model: the photo is sent to it as you took it — so whatever is on the picture travels along, including the payment lines at the bottom of a receipt unless you fold them away or leave them out of the frame. Of a PDF only its text is sent, but all of it: an invoice from a pick-up or delivery order carries your name, address and customer number, and those are part of that text. The reader is instructed not to return any of this, and the software enforces the part it can: nothing about the payment has a field to land in, and an address found in a PDF is kept only when it is that of a shop the price service already knows — otherwise the reading comes back without any address. A long screenshot is cut into pieces on your device first, nothing more is added. [to be completed: which provider reads the documents at this installation — at the time of writing OpenAI — whether it is the same as above, and the agreement and transfer safeguards with them]
• The price service (Marketbase) runs as part of this installation. It keeps what scanned receipts and leaflets say — chain, shop, date, total, lines and prices — together with the short name of the organization that sent them, and no account, name or other identifier of a person. The prices, offers and the dictionary of receipt abbreviations learned from them are open: anyone can read them, without the organization names. Because a receipt there is not tied to a person, it is not part of your data export and is not removed when you erase your account or leave; an organization of one should therefore pick a name that does not give its member away.
• Telegram, if you connect a Telegram channel for alerts: the alert messages are delivered through it.
• Your browser’s push service (Google, Apple or Mozilla, depending on the browser), if you switch on web push.
• OpenStreetMap: map views load map tiles from tile.openstreetmap.org, which sees your IP address while a map is on screen. The list of shops the price service knows is fetched from OpenStreetMap by the server, not by your device.

An organization can declare in its configuration how long it keeps its event log, its change log and its chat messages; older entries are then deleted automatically. Where nothing is declared, the data is kept until it is deleted by hand — by you, or by an admin deleting the organization. Data brought in by a datasource is bounded by that datasource’s own settings. Prices and offers in the price service are kept without a time limit; they say what something cost in a shop, not who bought it.

You can exercise two of them yourself, on your profile page:

• Download my data — a copy of everything stored about you, as one JSON file (Art. 15, 20).
• Erase my account — your profile, alert channels and memberships are deleted, your personal organisms are deleted with everything in them, and what you contributed to a shared organization stays with that organization under an anonymous placeholder instead of your name (Art. 17). Private files you uploaded are deleted; files you made public stay with the organization that uses them. Free text you wrote — a chat message, a description — is content of that organization and is not rewritten; ask its admins to delete it.

Rectification (Art. 16) is the profile form. For restriction (Art. 18), objection (Art. 21) or a complaint, contact the controller named above; you may also complain to a supervisory authority.

[to be completed: the legal bases relied on — typically Art. 6(1)(b) for running an account a person asked for, Art. 6(1)(f) for keeping an organization’s record of its own work, and consent where an organization collects more than that]