Privacy Policy

Controller

Poem, Inc. (global controller). Contact: privacy@originary.xyz

What we collect

• Account & billing: email, name, organization, billing details.
• Operational logs: verification/receipt events necessary to operate the service.
• Analytics (optional): anonymized GA4 only after you consent; otherwise we don't load analytics.
• Support messages you send to us.

What we don't collect

No sensitive categories. We do not sell personal data.

Why we process

• Contract: provide and support the services.
• Legitimate interests: security, abuse prevention, product improvement.
• Consent: analytics (opt-in; withdraw any time via Privacy choices in the footer).

Cookies & consent

We use essential cookies only by default. Analytics runs only after opt-in. We respect Do-Not-Track and store your decision locally in your browser. We also honor Global Privacy Control (GPC) signals as an opt-out for analytics.

Sharing

We use processors for hosting, payments, and support under contractual safeguards.

International transfers

Data may be processed outside your country with appropriate safeguards. Certain support operations may be performed by an India affiliate as a processor under Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs).

Retention

We retain data as needed for the above purposes and legal obligations, then delete or anonymize.

Your rights

Subject to law where you live, you may request access, correction, deletion, or portability, and object to or restrict certain processing. Email privacy@originary.xyz; we will respond within a reasonable period.

Security

We protect data in transit and at rest and publish our coordinated disclosure policy at /security.

Children

Not for use by children under 16.

Updates

We'll update this Policy as needed and change the “Last updated” date.