Privacy Policy

1. Information We Collect

1.1 Personal Information

When you use Organizely, we may collect the following personal information:

• Name and contact information (email address, phone number)
• Account credentials and authentication information
• Company or organization information
• Billing and payment information (processed securely through Stripe)
• Profile information and preferences

1.2 Business Data

As a warehouse management system, we collect and process business data you provide:

• Inventory data (products, variants, stock levels)
• Warehouse configuration and layout information
• Order and transaction data
• Supplier and vendor information
• Integration data from connected platforms (Shopify, etc.)
• Accounting data from a connected accounting system (QuickBooks Online), described in Section 1.5

1.3 Technical Information

We automatically collect certain technical information:

• IP addresses and device information
• Browser type and version
• Usage patterns and analytics data
• Log files and system performance data

1.4 Shopify Customer Data (Protected Customer Data)

When a Shopify merchant installs Organizely on their store, the app receives data about that store's shoppers (the merchant's customers) through the Shopify Admin API and webhooks. Shopify classifies this as protected customer data. We collect only the minimum fields required for the app to function as described to the merchant, and we use that data exclusively to operate the merchant's inventory and order workflows inside Organizely.

Specific Shopify customer fields we collect, why, and from where:

• Customer name (first / last) — collected from orders/create, orders/updated, orders/cancelled webhooks and the Admin API. Used to display the buyer on the merchant's order detail and packing slip views in Organizely.
• Customer email address — collected from order webhooks. Used to display contact info on the merchant's order detail view and to deduplicate repeat buyers in analytics. We do not email shoppers directly from Organizely.
• Shipping address — collected from order webhooks. Used to render the address on the merchant's packing slip and pick list, and to attribute orders to fulfillment locations.
• Billing address — collected from order webhooks. Used to display on the merchant's order detail view for tax and dispute reference.
• Customer phone number — collected from order webhooks. Used by the merchant to contact buyers about fulfillment exceptions through their own channels.

What we do NOT collect: shopper browsing behavior, cart events, marketing consent state, password hashes, payment card numbers, social profile data, or any data not directly tied to a placed order. We do not request access to the read_customers scope.

Data minimization commitment: we periodically review the protected customer data fields we receive and remove any field that is no longer required for the merchant-facing functionality described above.

No sale or sharing: we do not sell, rent, monetize, or share Shopify customer data with advertising networks, data brokers, AI training providers, or any third party other than the sub-processors listed in Section 3.1. Shopify customer data is never used to train machine learning models.

1.5 Accounting System Data (QuickBooks Online)

If you connect Organizely to QuickBooks Online, you authorize Organizely, through Intuit's consent screen, to read from and write to the QuickBooks Online company you choose. We use that access for one purpose: to record the inventory, purchasing, manufacturing, and sales activity that happens in Organizely as accounting entries in your books, exactly as configured on your Accounting settings pages, and to show you the status of those entries. Nothing is posted until you press “Start posting,” and every kind of entry can be switched off individually.

What we read from your QuickBooks Online company:

• Company information and preferences (company name, country, home currency, and the settings that affect how entries must be formed, such as inventory tracking, multi-currency, and class and location tracking)
• Your chart of accounts, classes, and locations, so you can map each kind of entry to the account of your choice
• Items, vendors, and customers, so entries can reference the records you already have instead of creating duplicates
• The balance of your inventory asset account, only when you run the optional month-end comparison
• Change notifications for the entries Organizely created, so we can tell you if one of them was deleted or voided in QuickBooks

What we write to your QuickBooks Online company:

• Bills, vendor credits, journal entries, invoices, and credit memos that record activity from Organizely, each carrying an Organizely reference so you can trace it back
• Non-inventory items, vendors, and customers, only when an entry needs one and no matching record exists

We never delete or edit entries in your books. A correction is always a new entry that reverses an earlier one, and you can see every entry Organizely has ever created on the Accounting Activity page.

What we store on our side:

• The identity of the connected company (Intuit's company identifier, the company name, country, and currency)
• The credentials Intuit issues for the connection, encrypted at rest with AES-256 and never shown in our interface or written to our logs
• A cached copy of your chart of accounts, classes, and locations, refreshed when you ask or when we detect a change
• The links between your Organizely products, suppliers, and customers and the corresponding QuickBooks records
• A record of every entry we created, including the amounts and lines as sent and the QuickBooks identifier and number that came back, so the entry can be explained, reversed, and reconciled later
• A count of the requests we make to Intuit on your behalf, which we use to stay within Intuit's usage limits

No other use or sharing: data from your QuickBooks Online company is used only to operate the accounting integration for your organization. We do not sell it, and we do not share it with any third party other than the sub-processors in Section 3.1 that store and process it on our behalf. We do not use it for any other customer, do not use it for advertising or analytics, and do not use it to train machine learning models. Our application logs record identifiers and Intuit's request identifiers, never the contents of your accounting data or your credentials.

Our relationship to Intuit: Organizely is an independent service. We process this data on your behalf, under the access you grant, and not on behalf of Intuit. Your use of QuickBooks Online itself is governed by Intuit's own terms and privacy policy.

Disconnecting: you can disconnect at any time from the Accounting pages in Organizely or from the Apps section of QuickBooks Online. When you disconnect, we revoke the connection with Intuit and delete the credentials and the cached chart of accounts immediately. The record of entries we created stays with your Organizely account as part of your accounting history (see Section 5.4) so your books remain explainable after the connection ends.

Intuit and QuickBooks are registered trademarks of Intuit Inc. Used with permission.

2. How We Use Your Information

We use the collected information for the following purposes:

• Providing and maintaining the Organizely service
• Processing transactions and managing billing
• Improving our service and developing new features
• Providing customer support and technical assistance
• Sending important service updates and notifications
• Ensuring security and preventing fraud
• Complying with legal obligations

2.1 Aggregated and Anonymized Data

We may generate aggregated and anonymized data from account activity and from how the service is used, and may use it to operate, secure, analyze, and improve Organizely, to develop new and existing features, and to build and improve the automated and AI-assisted tooling we provide. Data used in this way is stripped of identifiers for you, your organization, your customers, and any individual, and we do not attempt to re-identify it or permit others to do so. We do not sell aggregated or anonymized data, and we do not disclose it in any form that identifies you or your customers.

This does not apply to Shopify protected customer data. That data is governed by the stricter commitments in Section 1.4: it is never used to train machine learning models and is never shared with AI training providers, in aggregated form or otherwise.

3. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share information in the following circumstances:

3.1 Sub-Processors

We work with the following trusted sub-processors. Each has a written data-protection agreement with Organizely. The “Customer PII” column indicates whether the sub-processor receives Shopify protected customer data (Section 1.4) or other end-user PII as part of operating Organizely.

• Google Cloud (Google LLC) (United States) — cloud hosting. Organizely and its primary database run on Google Cloud in the United States. This is where the merchant's inventory, order, purchasing, manufacturing, and accounting-integration data is stored, including the Shopify customer data covered by Section 1.4. Customer PII: yes.
• Supabase, Inc. (United States) — authentication, Organizely account and organization records, and file storage for documents the merchant uploads or receives (attachments, supplier documents, generated files). Does not store Shopify customer data. Customer PII: no.
• OpenAI (United States) — AI-assisted features. What you ask Organizely's AI-assisted features may be processed by OpenAI, along with the parts of the merchant's own business data needed to answer (for example the products, orders, or purchase orders being discussed). Under our agreement this data is never used to train models. Customer PII: yes, when the merchant includes it.
• Datadog, Inc. (United States) — logging and monitoring. Receives application logs and metrics, which carry record identifiers and never the contents of Shopify customer data or accounting data. Customer PII: no by design.
• Stripe, Inc. (United States) — payment processing for Organizely subscriptions. Receives the merchant's billing contact and payment instrument; does not receive Shopify customer data. Customer PII: no.
• Mailgun Technologies, Inc. (United States) — transactional email delivery to Organizely account holders (password resets, invoices, system notices). Does notreceive Shopify customer data. Customer PII: no.
• hCaptcha, Inc. (United States) — bot mitigation on sign-in and forgot-password forms. Receives the visitor's IP and user-agent only; does not receive Shopify customer data. Customer PII: no.
• Cloudinary Ltd. (United States / Israel) — image storage and delivery for product photography uploaded by the merchant. Does not receive Shopify customer data. Customer PII: no.
• Intercom, Inc. (United States) — customer support messaging and website chat. Receives the merchant user's name, email, organization name, plan tier and role for signed-in sessions; the visitor's IP address, user-agent and message content for website chat; sets first-party cookies for up to 270 days. Does not receive Shopify customer data by design, though merchant-written messages may contain it. Customer PII: no by design.
• Calendly, LLC (United States) — demo scheduling. Receives the name, email and booking details a visitor enters when booking a demo, plus the campaign parameters of the page the booking was made from; sets its own cookies inside the scheduling frame. Does not receive Shopify customer data. Customer PII: no.
• Mixpanel, Inc. (United States): product analytics and session recording, described in Section 7. Receives the name and email address of the signed-in user, the account and organization identifiers, the organization name and plan, and a record of pages opened, controls clicked and actions taken in Organizely, together with a playback of signed-in sessions. Does not receive Shopify customer data. Customer PII: no.
• Other service providers. We also use providers for in-app search, background job processing, webhook delivery, additional AI models (for example reading a document or an image you upload), notification email, and shipping labels. Where one of them handles Shopify customer data, it does so only to do that job. Search indexes the customer names and contact fields the merchant can search. Background jobs and webhook delivery hold a record only while it is being processed or retried. An AI model provider receives only what is needed to answer a request, and under our agreements does not use it to train models. The shipping provider receives the recipient name and address of the orders a merchant ships. Notification email receives only the Organizely user's name and email. You can ask for the current list of these providers at [email protected].

We update this list when we onboard, remove, or replace a sub-processor. The “Last updated” date at the top of this page reflects the most recent change.

3.2 Legal Requirements

We may disclose information when required by law or to protect our rights, property, or safety.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

3.4 Mobile Information and Text Messaging

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

4. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption in transit: all traffic between clients, Organizely, Shopify, and our sub-processors is protected with TLS 1.2 or higher. Webhook payloads from Shopify are additionally verified with HMAC-SHA256 signatures.
• Encryption at rest: our primary database, our account database and file storage, and our search index all encrypt stored data at rest with AES-256. Shopify customer fields covered by Section 1.4 are stored in the primary database and the search index only. Credentials for connected systems (Shopify, QuickBooks Online, Gmail) are additionally encrypted by Organizely before they are written, with keys held outside the database.
• Access controls: production database access is restricted to a small set of authorized employees, requires multi-factor authentication, and is audit-logged. Application access is gated by authenticated sessions with row-level scoping by organization.
• Network isolation: our backend services accept traffic only from approved origins; admin endpoints are not publicly addressable.
• Regular security assessments and updates
• Employee training on data protection

5. Data Retention

5.1 Account Data

We retain your Organizely account data for as long as your account is active. When you delete your account, we delete or anonymize your personal information within 30 days, except where we are required to retain it for legal or regulatory purposes (e.g. tax records).

5.2 Shopify Customer Data — Standard Retention

Shopify customer data covered by Section 1.4 is retained for as long as the merchant has Organizely installed on their Shopify store, plus a 30-day grace period after uninstall. After the grace period, we automatically purge all Shopify customer fields associated with that store from our database. The grace period exists so a merchant who reinstalls within 30 days can resume their workflows without re-importing.

5.3 Shopify Mandatory GDPR Webhooks

We honor the privacy webhooks Shopify requires of all apps:

• customers/data_request — on receipt, we compile all data we hold about the identified customer and deliver it to the merchant within 30 days.
• customers/redact — on receipt, we permanently erase all stored data about the identified customer within 48 hours, unless retention is required by law.
• shop/redact — on receipt (typically 48 hours after a merchant uninstalls), we permanently erase all data associated with the shop, including all Shopify customer data, within 48 hours.

All three webhook endpoints verify the request signature against our app's secret before any deletion or export work is performed.

5.4 Accounting Integration Data

When you disconnect QuickBooks Online, the connection credentials and the cached chart of accounts are deleted immediately and the connection is revoked with Intuit. The links between your records and QuickBooks records, and the record of every entry Organizely created in your books, are retained with your Organizely account as accounting history, because they are the only record of what was sent and are needed to explain and reverse entries later. They are deleted with your account under Section 5.1.

6. Your Rights

6.1 Rights for All Users

Depending on your location, you may have the following rights:

• Access to your personal information
• Correction of inaccurate information
• Deletion of your personal information
• Data portability
• Restriction of processing
• Objection to processing

To exercise these rights, please contact us at [email protected]. We respond to verifiable rights requests within 30 days.

6.2 Shoppers of Shopify Stores Using Organizely

If you are a customer of a Shopify store that uses Organizely and you wish to access or delete your data held by Organizely, the fastest path is to contact the merchant directly — their dashboard provides one-click handling that triggers the Shopify customers/data_request or customers/redact webhook. We respond to those webhooks within the timeframes described in Section 5.3 (30 days and 48 hours respectively). You can also email us directly at [email protected]with your name, email, and the storefront domain so we can locate your data.

6.3 California Residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate information, and the right to opt-out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law. Submit requests to [email protected].

7. Cookies and Tracking

We use cookies and similar technologies to enhance your experience and collect analytics data. You can control cookie preferences through your browser settings.

7.1 Product Analytics

We use Mixpanel to understand how Organizely is used, so we can improve it and support you. When you are signed in, Mixpanel receives your name and email address, your role, your organization name and plan, and a record of what you do in the app: the pages you open, the controls you click and their labels, the words you type into search and filter boxes, the tables you sort, and the actions you take together with the values they carry, such as quantities, statuses and amounts. We use this to see how accounts like yours use the product, to fix what gets in the way, and to help you when you contact us.

Some things are deliberately kept out. We never send passwords, security or verification codes, API keys, access tokens, or payment card and bank details. Those values are dropped, and nothing is sent in their place. We also keep the personal details of your customers and suppliers out of analytics events: their names, email addresses, phone numbers and addresses, and the contents of emails and call transcripts handled by the AI assistant. We do not send the text those parts of a page show, a click inside an area marked as sensitive is not sent at all, and when an action you take carries one of those details, we send only a count or a length. If what you type into a search or filter box is itself an email address or a phone number, it is replaced by its length in the same way. Everything else you type there is sent as you typed it.

7.2 Session Recording

On the signed-in app and onboarding pages we record a playback of your session so we can see where the interface gets in the way. The recording shows the pages as you saw them, including the text you typed, because that is what makes a recording useful for support and for fixing problems.

A recording can include the personal details of your customers and suppliers where a page shows them, such as a name or an address on an order. What you type into a password field is never recorded, an API key or credential shown once on screen is left out of the recording in your browser before it is sent, and so is the payment form on the billing page. The recording includes the images shown on the page. We do not record sign-in pages, the billing page, or our internal staff console. We record neither the browser console nor network traffic. Recordings are deleted after 30 days.

7.3 Analytics Storage in Your Browser

Product analytics keeps a small amount of data in your browser so that the pages and clicks of one visit belong together:

• Local storage: entries whose names begin with mp_ or __mpq_, holding the analytics identifier for this browser and a short queue of events waiting to be sent. Local storage also holds the name, email address and organization of the person signed in, so that events from one visit belong to the right account. It stays until a different person signs in on this browser.
• Session storage: a tab identifier, so activity in one tab is not mixed with another. It is cleared when you close the tab.
• Browser database (IndexedDB): a temporary buffer named mixpanelBrowserDb that holds a session recording until it has been uploaded, and is then deleted.

8. International Transfers

Your information may be processed and stored in countries other than your own. We ensure appropriate safeguards are in place for international transfers.

9. Children's Privacy

Organizely is a B2B service intended for use by businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16 years of age(the GDPR threshold), or under 13 years of age(the COPPA threshold) where GDPR does not apply. If we become aware that we have collected such information, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date.

11. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Email: [email protected]
• Address: New Jersey, United States