Privacy Policy

1. Who this policy covers

This Privacy Policy applies to ogum.org and the OGUM application (the "Service"), operated by OGUM ("we", "us"). It covers visitors to the marketing site and registered users of the app. It does not cover the websites of the third-party providers linked from the Service, which have their own policies.

2. What we collect

Account data. When you sign up we receive your name, email address and, if you use Google sign-in, your Google profile picture, through our authentication provider. We assign you an account identifier and keep your plan and credit balance.

Profiles you create. The company profiles you fill in — company name, industry, size, audience, description, website, tone of voice, the name of the person signing documents and any brand kit (name, colour, logo) — so the agents can tailor deliverables.

Briefs and uploads. The answers you type into a task brief and the revision notes you send. When you attach supporting files, your browser sends us the file name and, for text-based files, an extract of their text so the agent can read it; the file itself is not uploaded. Brand-kit logos are the exception: they are uploaded and stored so they can be placed on your deliverables.

Deliverables. The documents generated for you, together with metadata such as the task, the model used, token counts and generation time, and the star rating you give them.

Billing data. Your credit ledger (grants, purchases, task charges, refunds), subscription status and Stripe customer identifier. Card numbers are entered on Stripe's checkout and never reach our servers.

Usage and technical data. Server logs (IP address, browser type, requested pages, timestamps), the pages you open in the app, onboarding progress, referral codes you share or arrive with, and error reports.

Communications. Emails you send to support and the notification preferences you set.

Cookies. The Service sets one strictly necessary session cookie (ogum_session) to keep you signed in for up to 30 days, and uses your browser's local storage to remember drafts, preferences and the campaign or referral link that first brought you here. We do not use advertising or cross-site tracking cookies.

Product analytics. We measure how the Service is used in two ways. On the public site and in the app we use Plausible Analytics, a cookieless, privacy-focused tool that records page views and interactions (such as opening a task page or starting a brief) without identifying you; it honours your browser's "Do Not Track" setting. Inside your account we record product events tied to your user id — sign-up, tasks started and delivered, checkouts, plan changes — so we can understand where users get stuck and improve the Service. Neither layer receives your brief contents, uploads or deliverables.

3. How we use it

To run the Service: authenticate you, generate and store your deliverables, keep your library across devices, and apply your plan's features.
To generate deliverables: your brief, profile and uploaded text are sent to our AI model provider, together with the task template, to produce the document you asked for.
To bill you: deduct and refund credits, process subscriptions and top-ups, and detect duplicate or fraudulent charges.
To talk to you: send transactional emails — welcome, task delivered, task failed, a follow-up asking how the deliverable was, referral rewards, subscription reminders — and a weekly activity digest you can turn off in Settings or via the unsubscribe link in any email.
To support you: answer your requests and investigate problems with a task.
To keep the Service safe: detect abuse and duplicate submissions, quarantine uploaded text that looks like a prompt-injection attempt, and audit administrative actions.
To improve OGUM: aggregate ratings, task usage and generation costs to tune templates and pricing. We do not use your briefs, uploads or deliverables to train AI models.

We do not sell personal data and we do not use it for third-party advertising.

4. AI processing

Deliverables are produced by large language models operated by Anthropic under its commercial API terms. What we send is limited to what the task needs: your brief, the profile you selected, extracted text from your uploads (truncated, and with suspected injected instructions removed) and the task template. The model's output is returned to us and stored as your deliverable. Content sent through the API is not used by the provider to train its models under the terms we use.

We share data only with providers who process it on our behalf to run the Service:

Auth0 (Okta) — sign-in, password storage and Google sign-in.
Anthropic — AI generation of deliverables.
Stripe — payments, subscriptions and invoices.
Resend — transactional email delivery.
Railway and an S3-compatible object-storage provider — application hosting, the database, uploaded files and stored deliverables, hosted in the United States.
Google Fonts — typefaces on the marketing pages (your browser requests them from Google).
Plausible Analytics — cookieless, aggregated usage statistics for the public site and the app, hosted in the European Union.

We may also disclose data when the law requires it, to protect the rights and safety of OGUM or its users, or as part of a merger, acquisition or sale of assets (in which case this policy continues to apply).

6. How long we keep it

Account, profiles and deliverables: for as long as your account exists. You can delete individual deliverables from your library at any time; deletion removes the stored document and its index entry.
Extracted upload text and brand logos: kept with the task or brand kit they belong to and removed with it.
Billing records: credit ledger entries and Stripe records are kept for as long as tax and accounting law requires, typically several years, even after account deletion.
Server logs and audit trails: kept for a limited period for security and debugging, then deleted or anonymised.
Backups: the database and storage are backed up on a schedule; deleted data can persist in backups for a short period before those backups expire.

When you delete your account — yourself in Settings, or by asking us — we remove your account data, profiles, deliverables, uploads, brand kit, credit ledger and product-event history. Records of completed payments are retained for accounting and tax, with the link to your account replaced by an unidentifiable marker. Copies inside backups expire on the backup schedule.

7. Your rights and choices

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to a data-protection authority. In OGUM you can:

view and edit your profiles and settings in the app;
download any deliverable as PDF, DOCX or HTML, and delete deliverables from your library;
turn email notifications off in Settings, or use the unsubscribe link in any email;
export everything we hold about you — profile, credit ledger, runs and usage — as a ZIP, from Settings → Your data;
delete your account yourself, from Settings → Danger zone. This removes your profile, deliverables, uploads, brand kit, credit ledger and product-event history immediately and cannot be undone. Records of completed payments are kept for accounting, with the link to your account removed so they can no longer identify you;
or email support@ogum.org from the address on the account if you would rather we did it. We answer within 30 days and may ask you to confirm your identity first.

8. Security

All traffic to the Service is encrypted in transit (HTTPS). Passwords are handled by our authentication provider and never stored by us. Access to production systems is limited to the people who operate OGUM, administrative actions are logged, and our providers encrypt stored data at rest. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

9. Children

The Service is for adults and businesses. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, contact us and we will delete it.

10. Where your data lives

OGUM is hosted in the United States, and the providers listed above may process data in the United States and other countries. By using the Service you understand that your data may be transferred to, stored and processed outside your country of residence. Where the law requires it, we rely on our providers' standard contractual safeguards for those transfers.

11. Changes to this policy

We will update this page as the Service and our providers change. The "Last updated" date at the top shows the current version; for material changes we will notify registered users by email or in the app.

12. Contact for privacy inquiries

Email support@ogum.org with "Privacy" in the subject line for any question or request about your data. A person replies.