Privacy Policy

Summary

• We collect your account identity, workspace metadata, Activity History, and billing references. We do not store your Salesforce records or card numbers, and Salesforce refresh tokens are never written to our database.
• Your Salesforce record content persists in your org. Org Loom processes it transiently to serve your requests and does not keep a persistent record or canvas body in its application database. Actively shared canvases use bounded temporary process memory for synchronization.
• We use five subprocessors: Render (hosting), Stripe (billing), Resend (email), Anthropic (AI features), and PostHog (product analytics). None of your data is sold, used for advertising, or used to train AI models.
• You can export, correct, or delete your data. Email privacy@orgloom.com for anything the product UI does not cover.

What we collect

• Account identity. Your email and display name, sourced from the identity provider you signed up with (Google OAuth, Microsoft OAuth, or email).
• Workspace metadata. Workspace name, plan, member list, roles, invite codes, and feature flag settings.
• Salesforce connection metadata. The org id, instance URL, Salesforce username, and the short-lived access token your browser session uses. We do not store Salesforce passwords; you authenticate on Salesforce's own login page. Org Loom receives a Salesforce refresh token. We hold it in server memory only, never write it to our database or disk, and discard it at sign-out, disconnect, or server restart.
• Trial eligibility metadata. We retain one-way hashes derived from the Salesforce organization and user IDs, plus the trial claim time, to prevent repeated trial redemption. The eligibility ledger does not contain the raw Salesforce IDs or an account or workspace identifier.
• Activity history. A record of actions in each workspace: sign-ins, org connects and disconnects, uploads, capability checks, and subscription events. Each entry has a timestamp, actor, action, and minimized operational metadata. Salesforce data-operation copies are delivered best-effort and do not contain record field values.
• Transient collaboration data. While a saved canvas is actively shared, the service holds a bounded live canvas snapshot, revisions, cursor and focus positions, visibility mappings, and short field-lock leases in process memory. This state is not written to the application database. Submitted requested fields or records are encrypted before being stored privately in your Salesforce org for the owner to merge.
• Hashed credentials. Email sign-in link tokens and MCP tokens are stored as SHA-256 hashes. The plaintext is shown once at issue time and never persisted.
• Billing references. Stripe customer and subscription IDs, used to map customers to workspaces. Card numbers, billing addresses, and payment credentials are held by Stripe, not by us.
• Request metadata. The IP address and user-agent of email sign-in requests, used to show you where a sign-in request came from and to rate-limit the sign-in endpoint.
• Product analytics. Page views and explicit count/status funnel events via PostHog, tied to a hashed account id (your email and raw internal id are omitted). Session replay runs on public pages with inputs masked. Replay and DOM autocapture are disabled on every signed-in page. We honor Do Not Track.
• Error reports. When our code throws an unhandled error we capture the stack trace, the URL path (no query string), HTTP method and status, the deployed commit SHA, and an opaque hash of your account id. Free-form error messages and context are removed before transmission. We do not capture request bodies, query strings, cookies, auth headers, or Salesforce record values. Reports go to a GlitchTip instance we self-host on Render, so they never leave the subprocessor list below.

What we do not collect

• Salesforce records, persistently. Records you load onto the canvas live in your browser session and may be processed in temporary server memory for authorized collaboration and requests. They are written back to Salesforce through your own connection, and are not persisted in Org Loom’s application database. Audit payloads may reference record IDs and counts, never field values.
• Salesforce refresh tokens, persistently. The refresh token Salesforce issues is held in server memory only as is not accessible post sign-out or server restart, after which you re-authenticate.
• Card Information. Stripe holds these. We never see them.
• Advertising data. No ad pixels and no cross-site tracking. We do not sell user data or share it for ads. Our only analytics is the PostHog product analytics described above.
• AI training material. Your Salesforce data and canvas state are not used to train models.

How we use what we collect

• Provide the service: authentication, canvas, uploads.
• Maintain Activity History for security and troubleshooting; it is not represented as a compliance-grade audit control.
• Bill your workspace and manage subscription state via Stripe.
• Enforce one-time trial eligibility and limit repeated trial redemption.
• Send transactional email: sign-in links, invites, support replies.
• Debug and improve the product through operational logs and product analytics.

Subprocessors

Org Loom uses the providers below to run the product. Each processes a defined slice of data on our behalf.

Render (Render Services, Inc.)

Purpose: Application hosting and managed Postgres.

Data processed: Everything stored on Org Loom servers: account email and display name, hashed tokens, workspace metadata, Activity History, billing references, and sign-in request metadata.

Location: United States (Oregon by default).

DPA: render.com/legal/dpa

Stripe (Stripe, Inc.)

Purpose: Billing, subscriptions, and payment processing.

Data processed: Account email, Stripe customer ID, workspace and plan metadata. Payment-method details are held by Stripe directly and never reach Org Loom servers.

Location: United States and European Union.

DPA: stripe.com/legal/dpa

Resend (Resend, Inc.)

Purpose: Transactional email delivery.

Data processed: Recipient email address, the message body containing the sign-in or share link, and the requesting IP and user-agent (rendered into the email footer so you can spot suspicious activity).

Location: United States.

DPA: resend.com/legal/dpa

Anthropic (Anthropic PBC)

Purpose: In-product AI record generation and planning.

Data processed: Your prompt text plus the selected Salesforce object/field schema. Existing canvas records are not automatically sent, but any record data you type into the prompt is included. MCP uses the AI client you configure and is not routed through Org Loom's Anthropic account. The API tier Org Loom uses does not use submitted data to train models.

Location: United States.

DPA: anthropic.com/legal/commercial-terms

PostHog (PostHog, Inc.)

Purpose: Product analytics: page views, click events, and product-funnel measurement.

Data processed: A hashed account id (never your email or raw internal account id), page paths without query strings, explicit count/status funnel events, IP address and device information, and masked-input session replays on public pages. Full current/referrer URLs are removed; replay and DOM autocapture are disabled on every signed-in page.

Location: United States.

DPA: posthog.com/dpa

Not subprocessors

Salesforce

You connect your own Salesforce org and remain the controller of the records inside it. Org Loom reads and writes through your OAuth session for the duration of a request and does not persist a copy of your Salesforce data on our servers.

Google · Microsoft

User-chosen identity providers, invoked only when you click the corresponding sign-in button. They see a standard SSO sign-in event and nothing about your Salesforce activity inside Org Loom.

YouTube (Google)

Demo videos on our public pages. The thumbnail images for these videos load from YouTube when the pages render, so Google receives standard request metadata (IP address, user-agent) for those images. The player itself loads only after you click play, in YouTube's privacy-enhanced (no-cookie) mode. No YouTube content loads inside the signed-in app.

Sentry CDN (Functional Software, Inc.)

Our browser error-reporting script is served from browser.sentry-cdn.com, so Sentry's CDN receives standard request metadata (IP address, user-agent) for that script download. The error reports themselves are sent only to the GlitchTip instance we self-host, never to Sentry.

Changes to this list

We will list a new subprocessor here at least 30 days before sending data to them, except when one is needed to remediate an active security incident (in which case we publish the addition as soon as the incident allows). To be notified directly, email privacy@orgloom.com and ask to join the subprocessor-changes list.

Retention

• Browser sessions: until you sign out or after 30 days of inactivity.
• Managed database backups: provider recovery copies age out on the configured recovery schedule. A restore is isolated and validated before cutover; restored sessions are invalidated, and deletion/redaction events after the recovery point are reapplied before normal service resumes.
• Salesforce access tokens: held in the session store; expire on Salesforce's schedule (typically 2 hours), at sign-out, or on disconnect, whichever comes first. Refresh tokens are held in server memory only and are dropped at sign-out, disconnect, or server restart.
• Live collaboration state: cleared on server restart. After the last participant leaves, an unsaved handoff snapshot may remain in process memory for up to 10 minutes.
• AI client proposals and clarifications: pending items are held in process memory for no more than 24 hours and are also cleared on server restart.
• Saved canvas bodies: stored encrypted in your Salesforce org. Org Loom keeps the latest three encrypted saved bodies for recovery; interrupted cleanup may temporarily leave older encrypted bodies in the org.
• Submitted canvas contributions: stored encrypted in your Salesforce org with the canvas. They remain customer-controlled and are marked submitted, merged, or superseded as the request is processed.
• Workspace Activity History: 365 days on Pro and Team; 30 days on Inactive workspaces. Minimized data-operation support rows expire within 7 days.
• Email sign-in links: single-use; expire 15 minutes after issue.
• Error reports: 90 days in our self-hosted GlitchTip instance, then pruned.
• Account deletion: your email and display name are erased; the current session is cleared and other sessions are denied because the account is marked deleted; connections, tokens, and eligible personal workspaces are deleted. Residual session rows expire on their normal TTL. Audit entries remain for their retention window with identity content scrubbed where applicable. One-way Salesforce trial eligibility hashes remain so account deletion cannot reset one-time trial eligibility.

Security

• Session cookies are HttpOnly, Secure in production, and SameSite=Lax.
• Salesforce access tokens live in the server-side session store (not the browser cookie) and are cleared on sign-out. The application does not field-encrypt the serialized session row; refresh tokens are never persisted and live in server memory only.
• Activity rows are not cryptographically chained. Data-touching rows are short-lived, minimized buffers and are queued best-effort to the Salesforce activity object.
• Shared-canvas content is filtered for each recipient using that recipient’s Salesforce access. Contributor submissions are checked against the current request, share role, and object and field permissions before acceptance.
• Email sign-in link tokens and MCP tokens are stored as SHA-256 hashes, not plaintext.
• All production traffic is over HTTPS.
• Cross-account access is blocked at the application layer: every connection, audit entry, and workspace lookup is scoped to the requesting account, with explicit defenses against confused-deputy attacks.

See the Trust & Security page for the full architecture, including customer-held encryption keys.

Your rights

• Access and export. Workspace admins can export workspace Activity History as CSV or JSON from /workspace#activity. For an account-level export, email us and we will send everything we hold about your account.
• Correction. Update your display name on /workspace#account. Email us for anything the UI cannot change.
• Deletion. Delete your account from the Account tab, or email us if it is stuck.
• GDPR / CCPA. EU and California residents have the rights those laws describe (access, rectification, erasure, portability, restriction, objection). Email us to exercise any of them.

Cookies

Two kinds: the Org Loom session cookie (signing you in), and PostHog analytics cookies (distinguishing your browser across visits; see the PostHog subprocessor entry above). No advertising cookies. PostHog honors your browser's Do Not Track setting.

Children's privacy

Org Loom is a B2B tool not directed at children. We do not knowingly collect data from anyone under 16.

International transfers

Our servers and subprocessors may be located in countries other than yours. If you are subject to a regime (GDPR, UK GDPR, or similar) that requires specific transfer safeguards, contact us to arrange them.

Changes to this policy

We will email registered users before any material change takes effect and update the effective date above. Non-material changes (typo fixes, clarifications) are updated in place.

Contact

Privacy questions, export requests, or anything else covered by this policy: privacy@orgloom.com.

See also: Terms of Service · Trust & Security.