Privacy Policy

Organicmanage (https://www.organicmanage.com) is a content planning and publishing tool for creators. It is operated by Organic Manage, the "controller" of your personal data. Questions about this policy or your data go to contact@organicmanage.com.

Account details, when you sign up:

• Your full name and email address.
• Your password, which is never stored as typed. We keep only a one-way bcrypt hash.
• If you use "Sign in with Google": your Google account ID, name, email address, and profile picture URL. We ask Google only for your basic profile and email (the openid, email, and profile scopes). We never see your Google password, and we cannot read your Gmail, Drive, or contacts.
• When you accepted these Terms and this Privacy Policy, and which version.
• When your account was created and last updated.

Your settings: whether to confirm before deleting, your default posting time, and whether you want email notifications.

Content you create or upload in a workspace:

• Posts, drafts, captions, schedules, revisions, tags, and comments.
• Images and videos you upload, plus the AI analysis we make of them (for example transcripts, hooks, and edit suggestions).
• Brand voice, content strategy, reports, client review links and the feedback left on them, and AI suggestions together with whether you accepted, edited, or rejected them.
• An activity log of who did what in a workspace, so teams can see changes.
• Workspace members, their roles, and invitations you send. Inviting someone means we store and email their address.

Connected social accounts:

• When you connect Facebook, Instagram, or Threads, Meta gives us an access token. We store it encrypted and use it only to do what you ask: list your Pages and accounts, publish and schedule posts, read post performance, and, if you turn on the engagement inbox, read and reply to comments.
• The Meta permissions we ask for are: pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish, business_management, threads_basic, and threads_content_publish. With the engagement inbox we also ask for instagram_manage_comments, pages_read_user_content, pages_manage_engagement, threads_read_replies, and threads_manage_replies.
• We also store each connected account's handle, display name, avatar URL, connection status, and post metrics (such as reach, likes, and comments) for your analytics.
• TikTok, YouTube, X, and LinkedIn channels are only added by hand. We store the handle you type and never receive a token for them.

Optional integrations: if you connect Plausible Analytics, we store your site ID and API key, and the key is encrypted.

Technical data: our server logs record each request's method, path, status code, and duration. Our hosting provider may also record IP addresses in its own infrastructure logs.

We do not use cookies, advertising trackers, or third-party analytics on this site. We keep a few small items in your browser's own storage so the app works:

• Session storage (cleared when you close the tab): your sign-in token, and whether the Ora mascot has already greeted you.
• Local storage (kept until you clear it): your light or dark theme, the workspace you last opened, calendar filters, and similar display choices.

When you use "Sign in with Google", Google's own sign-in script runs on our sign-in and sign-up pages and may set its own cookies, under Google's privacy policy.

• To create and secure your account and sign you in.
• To run the features you use: planning, publishing to your connected accounts, analytics, reports, AI writing and media tools, and client review.
• To send service emails: workspace invitations, approval requests and decisions, publishing failures, reconnect reminders, and, if you turn them on, weekly briefs and reports. You can turn optional emails off in Settings.
• To keep the service safe, debug problems, and prevent abuse.
• To meet legal obligations.

We do not sell your personal data, show you ads, or use your content to train AI models.

Legal bases (GDPR / UK GDPR): we rely on performance of our contract with you for running the service, on your consent for connecting social accounts and optional emails (which you can withdraw at any time), and on our legitimate interests for security and debugging.

We share data only with providers that help run the service, and only as much as each one needs:

• Railway: hosting, our Postgres database, and file storage for uploaded media.
• OpenRouter, and the AI model providers it routes to: the text, captions, transcripts, and media you send to AI features, so they can produce a result.
• Resend: delivering our emails (recipient address, subject, and message).
• Google: verifying "Sign in with Google".
• Meta (Facebook, Instagram, Threads): publishing and reading your connected accounts, as described above.
• Plausible: only if you connect it, to read your site analytics.

Some features read public data from other services for you: social listening reads public Reddit and Hacker News posts, and the Shorts tool fetches the YouTube videos whose links you paste.

Some providers may process data outside your country, including in the United States. Where the law requires it, we rely on standard contractual clauses or equivalent safeguards.

• Account and workspace data: for as long as your account exists.
• Media you move to the trash: purged automatically after 30 days.
• When you delete your account, your account and personal data are removed straight away. Backups that our hosting provider keeps roll off on their normal schedule.

Depending on where you live (for example under GDPR, UK GDPR, India's DPDP Act, or California's CCPA), you may have the right to access, correct, export, or delete your data, to object to or restrict some processing, and to withdraw consent.

• Delete your account yourself under Settings → Delete account. This permanently deletes your account, your settings, and every workspace where you are the only member, including its posts, media, and connections. In a workspace shared with others, your membership is removed, and the posts and media you created stay with that workspace for its remaining owner.
• For anything else, including a copy of your data, email contact@organicmanage.com. We reply within 30 days.
• Disconnect a social account at any time from the Channels page. You can also remove our access from your Facebook or Instagram settings (Business Integrations) or from Threads.
• Remove Google sign-in access at any time at myaccount.google.com/permissions.
• You can complain to your local data protection authority.

Passwords are hashed with bcrypt. Social and analytics access tokens are encrypted at rest. All traffic uses HTTPS, and sign-in sessions expire after 7 days. No system is perfectly secure, so if we learn of a breach that affects you, we will tell you and the relevant authorities as the law requires.

Organicmanage is not for children under 13, or under the age of digital consent where you live (for example 16 in parts of the EU, or 18 under India's DPDP Act). We do not knowingly collect their data. If you believe a child has signed up, email contact@organicmanage.com and we will delete the account.

If we make a material change, we will update the date at the top of this page and tell you in the app or by email before it takes effect. We record which version of this policy you accepted.

Questions, requests, or complaints: contact@organicmanage.com.