Privacy Policy

OrgWise is an enterprise SaaS platform for management consulting and business transformation. This policy applies to the OrgWise website, web application and any API surfaces we operate under the orgwise.cc domain. Data controller: OrgWise FZ-LLC, UAE.

When you sign in to a workspace we process the information your organisation has provided about you (name, email, workspace role, manager relationship, avatar) together with activity generated while you use the product — the assessments you author, the workflows you advance, and the queries you send to the built-in AI assistant.

We also collect technical telemetry required to keep the service running: IP address at authentication, browser user-agent, session identifiers, feature flags evaluated for your account, and audit events (who did what, when).

• Contract performance — providing the workspace, running assessments, generating reports, honouring workflow approvals.
• Legitimate interest — securing accounts, detecting abuse, debugging incidents, computing aggregate usage metrics for your workspace administrator.
• Legal obligation — retaining tamper-evident audit logs, responding to lawful requests from UAE authorities.
• Consent — sending optional product-update emails and, where applicable, using your prompts to improve model performance.

All tenant data is stored inside the United Arab Emirates on Microsoft Azure UAE North (primary) with Azure UAE Central (Abu Dhabi) as the disaster-recovery region. Encrypted at rest with AES-256; in transit over TLS 1.3. AI prompts routed to a residency-flexible model provider only run with your workspace administrator’s explicit opt-in; the default AI stack (Core42 Compass) stays inside the UAE.

OrgWise does not sell personal data. We share it only with the sub-processors that keep the platform running — cloud hosting, email delivery, and the AI model provider your workspace uses. The current sub-processor register is visible to any workspace administrator inside System & Compliance → Data protection & subject rights.

Your account and its content live for the tenant lifetime; when your workspace administrator removes you, we retain a hash of your identity in the audit log so the log stays verifiable, and purge the rest. AI query logs age out after 90 days. Backups roll off after 35 days. Audit logs stay 1 year online and 7 years in Glacier archive per UAE PDPL retention guidance.

You have the right to request access to the data we hold about you, its rectification, its erasure, a portable export and to object to processing based on legitimate interest. To exercise any of these, email management@orgwise.cc or submit a request through your workspace administrator. We respond within 30 calendar days.

Every request runs behind Azure Front Door WAF; authentication is OIDC with MFA available and enforced by workspace policy. Passwords are hashed with bcrypt/argon2. Sensitive data is encrypted with per-row envelope keys backed by Azure Key Vault (HSM-managed). Access to production data is limited to a documented on-call rotation and fully audited.

OrgWise uses only strictly-necessary cookies to keep you signed in and to protect the session (CSRF, HttpOnly, SameSite=Strict). We do not run advertising trackers.

Material changes are announced in-app 30 days before they take effect. Historical versions are available on request. This document supersedes all prior versions.

For any privacy question, email management@orgwise.cc.