Privacy Policy

Summary

• We collect your account identity, workspace metadata, Activity History, and billing references. We do not store your Salesforce records or card numbers, and Salesforce refresh tokens are never written to our database.
• Your Salesforce record content persists in your org. Org Loom processes it transiently to serve your requests and does not keep a persistent record or canvas body in its application database. Actively shared canvases use bounded temporary process memory for synchronization.
• We use Render (hosting), Stripe (billing), Resend (email), Anthropic (AI features), and PostHog (product analytics). We also use Reddit to measure visits to marketing pages and completed signups from our advertising. Salesforce record content is not sent to Reddit or used to train AI models.
• You can export, correct, or delete your data. Email privacy@orgloom.com for anything the product UI does not cover.

What we collect

• Account identity. Your email and display name, sourced from the identity provider you signed up with (Google OAuth, Microsoft OAuth, or email).
• Email preferences. Whether you opted in to product news, tips, and offers, the email address covered by that choice, and when, where, and under what wording you gave or withdrew consent. These records are removed when you delete your account.
• Workspace metadata. Workspace name, plan, member list, roles, invite codes, and feature flag settings.
• Salesforce connection metadata. The org id, instance URL, Salesforce username, and the short-lived access token stored with your active server-side session in the application database’s session table. We do not store Salesforce passwords; you authenticate on Salesforce's own login page. Org Loom receives a Salesforce refresh token. We hold it in server memory only, never write it to our database or disk, and discard it at sign-out, Salesforce disconnect or connection removal, account deletion, or server restart.
• Trial eligibility metadata. We retain one-way hashes derived from the Salesforce organization and user IDs, plus the trial claim time, to prevent repeated trial redemption. The eligibility ledger does not contain the raw Salesforce IDs or an account or workspace identifier.
• Activity history. A record of actions in each workspace: sign-ins, org connects and disconnects, uploads, capability checks, and subscription events. Each entry has a timestamp, actor, action, and minimized operational metadata. Org Loom does not retain Salesforce business-record IDs or record field values in these entries. Selected aggregate Salesforce-operation summaries are delivered best-effort to Audit_Event__c in the customer’s Salesforce org.
• Transient collaboration data. While a saved canvas is actively shared, the service holds a bounded live canvas snapshot, revisions, cursor and focus positions, visibility mappings, and short field-lock leases in process memory. This state is not written to the application database. Submitted requested canvas updates are encrypted before being stored privately in your Salesforce org. Valid submissions synchronize during live collaboration or merge when the owner next loads or saves the canvas.
• Hashed credentials. Email sign-in link tokens and MCP tokens are stored as SHA-256 hashes. The plaintext is shown once at issue time and never persisted.
• Billing references. Stripe customer and subscription IDs, used to map customers to workspaces. Card numbers, billing addresses, and payment credentials are held by Stripe, not by us.
• Request metadata. The IP address and user-agent of email sign-in requests, used to show you where a sign-in request came from and to rate-limit the sign-in endpoint.
• Product analytics. Page views and explicit count/status funnel events via PostHog, tied to a hashed account id (your email and raw internal id are omitted). Session replay runs on public pages with inputs masked. Replay and DOM autocapture are disabled on every signed-in page. We honor Do Not Track.
• Error reports. We use a self-hosted instance of GlitchTip, an error-monitoring tool, to diagnose bugs and service failures. It receives reports of unhandled errors and selected caught errors or operational failures. Reports contain error types, stack locations (code filenames, function names, and line numbers), generalized URL paths with dynamic segments removed, HTTP methods and status codes when available, the application environment and deployed commit SHA, fixed operational labels, and a pseudonymous account hash. We exclude free-form error messages, request bodies, query strings, URL fragments, request headers, cookies, breadcrumb contents, local variable values, and arbitrary extra context. Salesforce record values are not included. Performance tracing, SDK log collection, and session replay through GlitchTip are disabled. Error reports are retained for 90 days. Error reporting is separate from product analytics and marketing emails.

What we do not collect

• Salesforce records, persistently. Records you load onto the canvas live in your browser session and may be processed in temporary server memory for authorized collaboration and requests. They are written back to Salesforce through your own connection, and are not persisted in Org Loom’s application database. Activity History in the application database uses fixed operational fields and does not retain Salesforce business-record IDs, object or field API names, record field values, or free-form payloads.
• Salesforce refresh tokens, persistently. The refresh token Salesforce issues is held in the running web process’s memory only and is never written to the database or filesystem. It is discarded at sign-out, Salesforce disconnect or connection removal, account deletion, or process restart.
• Card Information. Stripe holds these. We never see them.
• Salesforce data for advertising. We do not send Salesforce record values, canvas contents, or Salesforce credentials to advertising services. The Reddit Pixel runs only on selected marketing/signup pages and a separate signup-completion page.
• AI training material. Your Salesforce data and canvas state are not used to train models.

How we use what we collect

• Provide the service: authentication, canvas, uploads.
• Maintain Activity History for security and troubleshooting; it is not represented as a compliance-grade audit control.
• Bill your workspace and manage subscription state via Stripe.
• Enforce one-time trial eligibility and limit repeated trial redemption.
• Send transactional email: sign-in links, invites, support replies.
• With your opt-in, send product news, tips, and offers, including promotional trial reminders. You can withdraw consent in Account settings or through the unsubscribe link in those emails. Essential account and service emails continue regardless of this preference.
• Debug and improve the product through operational logs and product analytics.
• Measure our Reddit advertising through marketing-page visits and completed account registrations.

Subprocessors

Org Loom uses the providers below to run the product. Each processes a defined slice of data on our behalf.

Render (Render Services, Inc.)

Purpose: Application hosting and managed Postgres.

Data processed: Everything stored on Org Loom servers: account email and display name, hashed tokens, workspace metadata, Activity History, billing references, and sign-in request metadata.

Location: United States (Oregon by default).

DPA: render.com/legal/dpa

Stripe (Stripe, Inc.)

Purpose: Billing, subscriptions, and payment processing.

Data processed: Account email, Stripe customer ID, workspace and plan metadata. Payment-method details are held by Stripe directly and never reach Org Loom servers.

Location: United States and European Union.

DPA: stripe.com/legal/dpa

Resend (Resend, Inc.)

Purpose: Account and service email delivery, and promotional emails for users who opt in.

Data processed: Recipient email address, the message body containing the sign-in or share link, and the requesting IP and user-agent (rendered into the email footer so you can spot suspicious activity).

Location: United States.

DPA: resend.com/legal/dpa

Anthropic (Anthropic PBC)

Purpose: In-product AI record generation and planning.

Data processed: Your prompt text plus the selected Salesforce object/field schema. Existing canvas records are not automatically sent, but any record data you type into the prompt is included. MCP uses the AI client you configure and is not routed through Org Loom's Anthropic account. The API tier Org Loom uses does not use submitted data to train models.

Location: United States.

DPA: anthropic.com/legal/commercial-terms

PostHog (PostHog, Inc.)

Purpose: Product analytics: page views, click events, and product-funnel measurement.

Data processed: A hashed account id (never your email or raw internal account id), page paths without query strings, explicit count/status funnel events, IP address and device information, and masked-input session replays on public pages. Full current/referrer URLs are removed; replay and DOM autocapture are disabled on every signed-in page.

Location: United States.

DPA: posthog.com/dpa

Advertising measurement

We use the Reddit Pixel on our production home, pricing, and signup pages, and send a SignUp event after a new account is created. Reddit can receive page URLs, advertising/cookie identifiers, IP address, and browser/device information to attribute visits and signups to ads. Signup events include a random conversion identifier; we do not supply account email, name, phone number, or account ID as matching fields. The pixel is not loaded on canvas or workspace pages. We suppress it when your browser signals Do Not Track or Global Privacy Control. See Reddit's privacy policy.

Not subprocessors

Salesforce

You connect your own Salesforce org and remain the controller of the records inside it. Org Loom reads and writes through your OAuth session for the duration of a request and does not persist a copy of your Salesforce data on our servers.

Google · Microsoft

User-chosen identity providers, invoked only when you click the corresponding sign-in button. They see a standard SSO sign-in event and nothing about your Salesforce activity inside Org Loom.

YouTube (Google)

Demo videos on our public pages. The thumbnail images for these videos load from YouTube when the pages render, so Google receives standard request metadata (IP address, user-agent) for those images. The player itself loads only after you click play, in YouTube's privacy-enhanced (no-cookie) mode. No YouTube content loads inside the signed-in app.

Sentry CDN (Functional Software, Inc.)

Our browser error-reporting script is served from browser.sentry-cdn.com, so Sentry's CDN receives standard request metadata (IP address, user-agent) for that script download. The error reports themselves are sent only to the GlitchTip instance we self-host, never to Sentry.

Changes to this list

We will list a new subprocessor here at least 30 days before sending data to them, except when one is needed to remediate an active security incident (in which case we publish the addition as soon as the incident allows). To be notified directly, email privacy@orgloom.com and ask to join the subprocessor-changes list.

Retention

• Browser sessions: until you sign out or after 30 days of inactivity.
• Managed database backups: provider recovery copies age out on the configured recovery schedule. A restore is isolated and validated before cutover; restored sessions are invalidated, and deletion/redaction events after the recovery point are reapplied before normal service resumes.
• Salesforce access tokens: stored with the active server-side session in the application database’s session table. They expire on Salesforce’s configured schedule and are removed at sign-out, Salesforce disconnect or connection removal, account deletion, or session expiry or invalidation. Refresh tokens are held only in process memory and are discarded at sign-out, Salesforce disconnect or connection removal, account deletion, or process restart.
• Live collaboration state: cleared on server restart. After the last browser disconnects from a shared canvas, an unsaved working copy may remain in process memory for up to 10 minutes to support reconnection.
• AI client proposals and clarifications: pending items are held in process memory for no more than 24 hours and are also cleared on server restart.
• Saved canvas bodies: stored encrypted in your Salesforce org. Org Loom keeps the latest three encrypted saved bodies for recovery; interrupted cleanup may temporarily leave older encrypted bodies in the org.
• Submitted canvas contributions: stored encrypted in your Salesforce org with the canvas. They remain customer-controlled and are marked submitted, merged, or superseded as the request is processed.
• Workspace Activity History: 365 days on Pro and Team; 30 days on Inactive workspaces. Minimized data-operation support rows expire within 7 days.
• Email sign-in links: single-use; expire 15 minutes after issue.
• Error reports: 90 days in our self-hosted GlitchTip instance, then pruned.
• Account deletion: your email and display name are erased; the current session is cleared and other sessions are denied because the account is marked deleted; connections, tokens, and eligible personal workspaces are deleted. Residual session rows expire on their normal TTL. Audit entries remain for their retention window with identity content scrubbed where applicable. One-way Salesforce trial eligibility hashes remain so account deletion cannot reset one-time trial eligibility.

Security

• Session cookies are HttpOnly, Secure in production, and SameSite=Lax.
• Salesforce access tokens live in the server-side session record in the application database’s session table, not in the browser cookie or browser storage. Refresh tokens are never persisted and live only in process memory.
• Org Loom Activity History retains minimized account, workspace, and operation metadata under the workspace retention policy. Selected aggregate Salesforce-operation summaries are queued best-effort to Audit_Event__c; the local delivery-status records expire within seven days.
• Shared-canvas content is filtered for each recipient using that recipient’s Salesforce access. Contributor submissions are checked against the current request, share role, and object and field permissions before synchronization or merge.
• Email sign-in link tokens and MCP tokens are stored as SHA-256 hashes, not plaintext.
• All production traffic is over HTTPS.
• Cross-account access is blocked at the application layer: every connection, audit entry, and workspace lookup is scoped to the requesting account, with explicit defenses against confused-deputy attacks.

See the Trust & Security page for the full architecture, including customer-held encryption keys.

Your rights

• Access and export. Workspace admins can export workspace Activity History as CSV or JSON from /workspace#activity. For an account-level export, email us and we will send everything we hold about your account.
• Correction. Update your display name on /workspace#account. Email us for anything the UI cannot change.
• Deletion. Delete your account from the Account tab, or email us if it is stuck.
• GDPR / CCPA. EU and California residents have the rights those laws describe (access, rectification, erasure, portability, restriction, objection). Email us to exercise any of them.

Cookies

We use the Org Loom session cookie to sign you in and PostHog analytics cookies to distinguish your browser across visits. The Reddit Pixel can use advertising cookies on the marketing and signup pages described above. PostHog honors Do Not Track; our Reddit integration honors both Do Not Track and Global Privacy Control.

Children's privacy

Org Loom is a B2B tool not directed at children. We do not knowingly collect data from anyone under 16.

International transfers

Our servers and subprocessors may be located in countries other than yours. If you are subject to a regime (GDPR, UK GDPR, or similar) that requires specific transfer safeguards, contact us to arrange them.

Changes to this policy

We will email registered users before any material change takes effect and update the effective date above. Non-material changes (typo fixes, clarifications) are updated in place.

Contact

Privacy questions, export requests, or anything else covered by this policy: privacy@orgloom.com.

See also: Terms of Service · Trust & Security.