1. Who we are
The data controller for the Oryjin service at app.oryjin.com is [Company legal name], [Registered address], registered under [SIREN — RCS city]. You can reach us at contact@oryjin.com. Data-protection contact: [DPO or privacy contact].
This policy explains what personal data we process when you use Oryjin, why, and what rights you have. Company registration details are on the Legal Notice page.
2. Data we collect
- Account data — your name and email address, and, if you sign in with Google, the basic profile Google shares with us (name, email, avatar).
- Authentication and security events — sign-ins, magic-link requests, invitations, and technical logs (IP address, timestamps) needed to secure accounts.
- Business documents — the contracts, invoices and PSP reports your organisation uploads for reconciliation. These are business records, but they may incidentally contain personal data (names on invoices, for example); your organisation is responsible for what it uploads.
- Usage analytics — how the product is used (pages viewed, features used), collected as described in section 8.
- Requests for access and the free tools — when you ask for access, check an invoice or request a fee estimate without an account, the name, email address, company and figures you type, and your consent to our keeping them. An invoice you upload to the invoice check is stored, with what we read from it and the figures you confirm, so that we can answer your request and, if you join, start your workspace with it. Exploring the sample company without an account creates a temporary visitor record and a session cookie, and nothing else about you.
- Correspondence — emails you send to our contact or support addresses.
3. Why we process it
- To provide the Service (performance of a contract): operating your account and organisation, processing the documents you upload, producing reconciliation analyses, sending transactional emails such as magic links and invitations.
- To secure and improve the Service (legitimate interest): authentication logs, error monitoring, and product analytics configured to minimise personal data (section 8).
- To meet legal obligations: retaining records where the law requires it, and responding to lawful requests.
We do not sell personal data or use it for advertising.
4. Who processes it for us
We use a small set of processors, bound by data-processing agreements:
| Provider | Role | Location |
|---|---|---|
| Scaleway | Hosting, database and file storage | France (fr-par region) |
| Resend | Transactional email (magic links, invitations) | United States [verify transfer safeguards / SCCs] |
| PostHog | Product analytics and session replay (see section 8) | European Union (EU Cloud) |
| Sentry | Error monitoring | [EU or US — verify region and safeguards] |
| Single sign-on, if you choose to sign in with Google | Per Google's own terms | |
| Anthropic | Automated document analysis — not currently active, listed prospectively [confirm before enabling] | United States / European Union |
5. Where your data lives
Your account data and business documents are hosted in the European Union, in Scaleway's Paris region. Where a processor above operates outside the EU, transfers are limited to what that processor needs for its role and are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Account data: for the life of the account, then [duration] after deletion.
- Business documents: for as long as your organisation keeps them in the Service, then [duration] after deletion or account termination.
- Security and technical logs: [duration].
- The free tools: an invoice sent to the invoice check and what was read from it, for as long as we have a commercial relationship with you or until you ask us to delete them; a visitor record, one day after its last session ends; a request for access, until it is answered and then [duration].
7. Your rights
Under the GDPR you can ask to access, rectify or erase your personal data, restrict or object to its processing, and receive it in a portable format (articles 15 to 22). Write to contact@oryjin.com; we may ask you to confirm your identity. If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr), the French supervisory authority.
8. Cookies and analytics
Oryjin uses a strictly necessary session cookie to keep you signed in. It is exempt from consent because the Service cannot work without it.
In production we use PostHog, on its EU Cloud, to understand how the product is used. It is configured to minimise personal data: session replay masks all text and all inputs, so the content of your documents and forms is never recorded. We use no advertising or cross-site trackers.
9. Security
Data is encrypted in transit, hosted with an EU provider, and access within Oryjin is restricted to what operating the Service requires. Organisation data is segregated by tenant, and sensitive credentials are stored encrypted. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the GDPR requires.
10. Changes to this policy
If we change this policy in a material way, we will notify you by email or in the Service before the change takes effect. The date at the top of this page reflects the latest revision.
11. Contact
For anything related to your personal data: contact@oryjin.com ([DPO or privacy contact]).