Privacy notice

Origentra is provided by Techvora, a business established in Ireland (“Techvora”, “we”, “us”). This notice explains how we handle personal data in connection with the Origentra service and this website.

You can contact us about anything in this notice at support@techvora.net. Our registered address is available on request from the same address.

Controller for account data. We decide how and why account data is used to operate Origentra, so we are the controller of that data.

Processor for organisational knowledge. Customers use Origentra to record knowledge about their own organisation — entities, relationships, sources, evidence files, reviews and history. That content may include personal data, such as the names of owners and stewards or contact details in a supplier record. The customer organisation is the controller of that content, and we process it on the customer’s behalf and under its instructions, in accordance with our agreement with that customer.

If your personal data appears in a customer’s organisational knowledge and you wish to exercise your rights, please contact that organisation first. We will assist our customers in responding to such requests.

As controller, we collect and use the following account data:

• Identity and contact details: your name and email address.
• Credentials: a password hash. We never store your password in readable form.
• Sign-in and security metadata: such as the times of sign-in and sign-out, failed sign-in attempts, and session records, including the browser description (user agent) a session was started from. To limit repeated sign-in attempts we convert your network address into a keyed pseudonym held for no more than a day; the address itself is not stored.
• Membership details: the organisations you belong to and your role in each.
• Preferences: notification preferences and your time zone.
• Correspondence: the content of emails you send to us, for example when requesting access or support.

We do not use Origentra to collect special category data, and we ask customers not to record it in organisational knowledge unless they have a lawful basis for doing so.

• To provide the service — creating and managing your account, signing you in, applying your role and preferences, and sending transactional emails such as invitations and password resets. Lawful basis: performance of a contract with you or with the organisation you use Origentra on behalf of, and our legitimate interest in providing the service our customers have requested.
• To keep Origentra secure — rate limiting, detecting and preventing unauthorised access, and maintaining audit and security logs. Lawful basis: our legitimate interests in protecting our service, our customers and their data.
• To respond to you — answering access, support, privacy and security enquiries. Lawful basis: our legitimate interest in responding to enquiries, or steps taken at your request before entering into a contract.
• To meet legal obligations — for example, keeping records we are required to keep or responding to lawful requests. Lawful basis: compliance with a legal obligation.

We do not sell personal data, use it for advertising or profiling, or send it or any organisational knowledge to AI providers. Origentra does not use automated decision-making that produces legal or similarly significant effects.

Origentra uses only cookies that are strictly necessary for the service to work:

• origentra_session — keeps you signed in. It is HttpOnly, Secure and SameSite=Lax, and expires when your session ends or times out.
• origentra_org — remembers which of your organisations you last selected.

We do not use advertising, analytics or third-party tracking cookies, so we do not ask for cookie consent. You can block cookies in your browser, but you will not be able to sign in without the session cookie.

We use the following service providers to operate Origentra. They process data only on our instructions.

• Vercel — application hosting. Server functions run in Dublin, Ireland.
• Supabase — database hosting, in the AWS eu-west-1 region (Ireland).
• Postmark — delivery of transactional emails such as invitations and password resets, only where email delivery is enabled.

We may also disclose personal data where required by law, to protect the rights, property or safety of Techvora, our customers or others, or as part of a reorganisation or sale of our business, subject to appropriate confidentiality protections. We will update this notice when our sub-processors change.

Our primary hosting is in Ireland. Some of our service providers may process limited data outside the European Economic Area, for example for support or operational purposes. Where that happens, we rely on appropriate safeguards recognised under data protection law, such as an adequacy decision or the European Commission’s Standard Contractual Clauses. You can ask us for more information at support@techvora.net.

• Account data is kept for as long as your account exists. When an account is closed, we delete or anonymise it within a reasonable period, except where we need to keep limited information to meet legal obligations or resolve disputes.
• Organisational knowledge is kept for the life of the customer’s organisation in Origentra. Customers can export it at any time, and we delete it on the customer’s request or after the customer’s agreement ends, in line with our terms.
• Security logs are kept only for as long as they are needed to protect the service and investigate incidents.
• Correspondence is kept for as long as needed to deal with your enquiry and any follow-up.

We protect personal data with technical and organisational measures appropriate to the risk, including database-enforced tenant isolation, role-based access control, hashed passwords, encrypted connections and audit logging. Read more on our security page.

Under the General Data Protection Regulation you have the right, subject to certain conditions, to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• object to processing based on our legitimate interests;
• receive your data in a portable format; and
• withdraw consent, where we rely on it, at any time.

To exercise any of these rights, email support@techvora.net. We may need to verify your identity before acting on a request, and we will respond within the time required by law, normally one month.

If you have a concern about how we handle your personal data, please contact us first at support@techvora.net so we can try to resolve it. You also have the right to lodge a complaint with the Data Protection Commission in Ireland, or with the supervisory authority where you live or work.

We may update this notice from time to time. The date at the top shows when it was last changed. Where a change is significant, we will take reasonable steps to let account holders know, for example by email or a notice in the application.