Privacy Policy

• Account data — your name, email address, and a securely hashed password. If you enable two-factor authentication, we store an encrypted TOTP secret and hashed backup codes.
• Organization data — organization names, member roles and invitations, and subscription/plan details.
• Deal data — the deals, scenarios, assumptions, rent rolls, operating statements, documents you upload, memos, portfolio actuals, and comments you create in the Service.
• Usage and security data — session records, IP address, and an audit log of significant actions, used to secure accounts and operate the Service.

We use the information above to:

• provide, maintain, and secure the Service and your workspace;
• authenticate you, enforce roles, and prevent abuse and fraud;
• run the deterministic calc engine and, when you enable it, AI-assisted extraction on your documents;
• send transactional email (verification, invitations, password resets, notifications); and
• comply with legal obligations and enforce our Terms.

We do not sell your personal data, and we do not use your Customer Data to train third-party foundation models.

We rely on a small set of vetted service providers to operate the Service. Each processes data only as needed to provide its function:

• Render — application hosting and managed PostgreSQL database (data storage and compute).
• Anthropic — powers glass-box AI document extraction, only when your organization connects an API key and uploads a document for extraction.
• Resend — delivery of transactional email, when email is enabled.
• Stripe — subscription billing and payment processing, when billing is enabled. Origentic does not store full card numbers.

We retain Customer Data for as long as your account and organization remain active. When you delete your account, we delete your profile and any organization for which you are the only member, which cascades to that organization’s deals, scenarios, documents, and related records. Data in organizations that continue to have other members is retained for those members. Limited records may persist where required for legal, security, or audit purposes; backups are purged on a rolling schedule.

You can access and update your profile at any time from account settings. You may also:

• Export a machine-readable copy of your data using the “Export my data” control in Settings → Profile;
• Delete your account and associated solo-owned organizations using the delete control in Settings → Profile; and
• request access, correction, or deletion, and exercise other rights you may have under applicable law (including GDPR and CCPA), by contacting us.

Depending on your organization’s configuration, some requests may need to be directed to your organization’s owner or admin, who controls the workspace data.

Origentic uses a single, essential, first-party cookie to keep you signed in (an HTTP-only session cookie). We do not set advertising, analytics, or third-party tracking cookies. A small amount of information (such as your acknowledgment of our cookie notice) may be stored in your browser’s local storage. Because the session cookie is strictly necessary to operate the Service, it cannot be disabled while you are signed in.

We protect your data with encryption in transit, hashed passwords (bcrypt), encrypted two-factor secrets, host-only session cookies, role-based access control, rate limiting, and audit logging. No method of transmission or storage is perfectly secure, but we work continuously to protect your information.

For privacy questions or to exercise your rights, contact us at hello@origentic.ai.