Privacy Policy

This Privacy Policy explains how OnPurpose Studio, LLC ("OnPurpose," "we," "our," or "us") collects, uses, shares, and protects information when you use onpurpose.studio, hub.onpurpose.studio, and other OnPurpose products that link to this policy (collectively, the "Services"). Custom integrations and other client work may be governed by a separate agreement instead.

1. Information We Collect

Information you provide

Depending on how you use the Services, we may collect:

• Your name, work email address, company name, and account authentication information.
• Billing and transaction information. Payments are processed by Stripe.
• Support messages, requests, feedback, and other communications.
• Project identifiers, configuration settings, and other information needed to provide the Services.
• API tokens and other credentials required to connect services you authorize.
• Source content, translations, prompts, AI responses, and related records when needed to operate or audit the Services.

Information collected automatically

We may collect service usage events, timestamps, IP addresses, browser and device information, and application or security logs. Our marketing site uses Plausible Analytics; Hub does not.

2. How We Use Information

We use information to:

• Provide, operate, secure, and maintain the Services.
• Authenticate users and connect customer-authorized services.
• Process payments and administer customer accounts.
• Audit activity, troubleshoot problems, and provide support.
• Monitor performance and improve the reliability of the Services.
• Communicate about the Services, including operational, billing, and security notices.
• Comply with law and enforce our agreements.

We do not use customer data to train models or for unrelated product development.

3. Credentials and Data Security

API tokens and other credentials are encrypted in our database. When a credential is needed, the application decrypts it temporarily in memory and sends it only to the customer-authorized service. We do not write plaintext credentials to the database or application logs, and credentials may not be submitted through Slack or email.

Authorized personnel are bound by confidentiality obligations. Access is logged, and access is removed promptly when a person's work with OnPurpose ends. We use reasonable administrative, technical, and organizational safeguards, but no system can guarantee absolute security.

4. How We Share Information

We may share information only as needed with:

• DigitalOcean for hosting and infrastructure. See DigitalOcean's Privacy Policy.
• Stripe for payment processing. See Stripe's Privacy Policy.
• Plausible Analytics for analytics on the marketing site only. See Plausible's Privacy Policy.
• Cal.com for meeting scheduling on the marketing site. See Cal.com's Privacy Policy.
• Services and integrations that a customer directs us to connect.
• Professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights or safety, or complete a business transaction.

Third-party services process information under their own terms and privacy policies. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or perform behavioral profiling.

5. Cookies and Analytics

OnPurpose does not intentionally set non-essential cookies. The marketing site uses Plausible Analytics, while Hub does not use Plausible. Third-party services you choose to use may collect information under their own privacy policies.

6. Data Retention and Deletion

API credentials are deleted immediately when an account is terminated. Other records, including customer content, audit records, logs, account information, billing records, support messages, and backups, are retained for up to one year after they are no longer needed or the account is terminated. We may delete information sooner when it is no longer needed.

7. International Processing

Information is primarily processed in the United States. If you use the Services from another country, your information may be transferred to and processed in the United States, where privacy laws may differ from those in your location.

8. Your Privacy Rights

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal information, or to object to or restrict certain processing. You may also have the right to appeal our response and to exercise your rights without discrimination.

Submit a request or appeal by emailing [email protected]. We may verify your identity and authority before fulfilling a request. Because we do not sell personal information or use it for targeted advertising or profiling, browser-based opt-out signals do not change how we process information.

9. Security Incidents

If a security incident affects your information, we will investigate and provide notice as required by applicable law.

10. Children's Privacy

The Services are offered only to businesses and are not intended for children. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this policy as our Services or legal obligations change. We will post the revised policy with a new effective date and, when reasonably practicable, provide notice of material changes.

12. Contact Us

OnPurpose Studio, LLC
Oregon City, Oregon
[email protected]