How we operationally handle personal data, including the standard terms that apply when Organicely processes data on behalf of a customer.
Last updated: 1 November 2026 · Effective: 1 November 2026
Two scenarios. When a parent or guardian uses Organicely for their own family, we are the data controller for that data and our Privacy Policy applies. When a school, clinic, or other organisation uses Organicely on behalf of their students or clients, that organisation is the controller and Organicely acts as a data processor. This document describes the processor terms (a Data Processing Agreement, "DPA") that apply in the second case, and the operational practices that apply in both.
The terms "controller", "processor", "personal data", "processing", "data subject", "supervisory authority", and "personal data breach" have the meanings given in the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). "Customer" means the natural or legal person that has signed up for Organicely. "Organicely", "we", "us" means Unbreached AB (org.nr 559411-9624). "Sub-processor" means any third party engaged by Organicely to process personal data.
The subject matter of the processing is the provision of the Organicely service. The duration is the duration of the Customer's subscription plus the retention periods set out in our Privacy Policy. The nature and purpose of the processing is to enable the Customer to use the routine, reward, screen-time, and family-coordination features of the service.
| Category of data subject | Categories of personal data |
|---|---|
| Account holders (parents, guardians, school staff) | Email address, display name, family or organisational role, WebAuthn passkey credentials, IP address, user-agent, audit-log entries |
| Children whose data is entered into the service | Display name, date of birth (encrypted at rest), avatar image, routine and task data, points balance and streaks, mood entries, photos uploaded for task verification |
| Devices linked to a household | Hardware-bound machine ID, device name, app-usage telemetry, heartbeat status, security-event logs |
| Billing contacts (where applicable) | Billing email, country (received from Paddle); full payment data is held by Paddle, not by Organicely |
Where Organicely acts as a processor for the Customer, Organicely will process personal data only on documented instructions from the Customer, including with regard to transfers of personal data, unless required to do so by Union or Member State law. The Customer's documented instructions consist of (a) the Terms of Service, (b) this Data Processing Policy, (c) the Customer's use of the service through its features, and (d) any further written instructions agreed in writing.
Organicely will inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.
Organicely ensures that personnel authorised to process the personal data are bound by confidentiality, either contractually or by statute. Access to production data is granted on a least-privilege basis and logged.
Organicely implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
The platform is designed and maintained under the oversight of David Jacoby, a cybersecurity researcher with 35 years of experience.
Organicely engages the following sub-processors. Each is bound by a written data-processing agreement consistent with GDPR Article 28.
| Sub-processor | Purpose | Location |
|---|---|---|
| Paddle.com Market Limited | Merchant of record, processes subscription payments and issues invoices | United Kingdom; routes payment data through global card networks |
| Amazon Web Services EMEA SARL | Object storage (S3) for avatar images and task-verification photos | EU (eu-north-1, Stockholm) |
| Google LLC, Google Workspace (Gmail SMTP) | Transactional email delivery (sign-in codes, approval notifications, account-related messages) | United States, with EU data zones for storage at rest |
| Google LLC, Firebase Cloud Messaging | Push-notification delivery to Android phones and web browsers. Push tokens registered by user devices are transmitted to Google in order to route notifications. | United States |
| EU hosting provider | Hosting of application servers, PostgreSQL database, and Redis cache | European Union |
| Slack Technologies, LLC | Internal notifications to the Organicely support team: support-ticket subject and message with the customer's name, email address and family name, and beta sign-ups (name and email address) | United States (Standard Contractual Clauses) |
| Functional Software, Inc. (Sentry) | Error and performance monitoring for the web app. Receives error details, page routes and browser information; email addresses, IP addresses, request bodies and URL query values are removed before sending. | EU data region (Germany) |
Organicely will inform Customers of any planned addition or replacement of a sub-processor at least 30 days before the change takes effect, giving the Customer the opportunity to object on reasonable grounds. If the Customer objects, the parties will work in good faith to find a resolution; if no resolution is found, the Customer may terminate the affected services.
All Organicely production application servers, databases, and object storage are hosted within the European Union. Personal data does not leave EU borders during normal operation. Three narrow exceptions involve United States providers:
For these, Organicely relies on the relevant transfer mechanisms permitted by Chapter V of the GDPR (Standard Contractual Clauses for the Google and Sentry flows; Paddle handles its own SCCs and DPF certification for payment data).
Organicely provides Customers with the technical means to fulfil requests from data subjects (access, rectification, erasure, restriction, portability, objection) directly through the service interface (Settings → Data & privacy). Where a data subject contacts Organicely directly with a request relating to data processed on behalf of a Customer, Organicely will, without undue delay, inform the Customer and assist the Customer in fulfilling the request.
Organicely will notify the Customer of a personal data breach affecting the Customer's data without undue delay, and in any event within 48 hours of becoming aware of the breach. The notification will include, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach, and the contact point for further information.
Organicely makes available to the Customer, on reasonable request, the information necessary to demonstrate compliance with these terms and GDPR Article 28. Organicely will allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, on reasonable notice and subject to confidentiality, scope, and frequency limits. Where a third-party SOC report or equivalent is available, the Customer agrees that this report can satisfy the audit obligation.
On termination of the Customer's subscription, Organicely will, at the choice of the Customer, return or delete all personal data processed on behalf of the Customer, except to the extent retention is required by Union or Member State law (e.g. accounting records under Swedish Bokföringslagen, 7 years). Default behaviour: on account closure the account is soft-deleted and held for 30 days so an accidental closure can be reversed; on a confirmed erasure request to privacy@organicely.se, full erasure follows.
Organicely may update this policy to reflect changes in operational practice, sub-processors, or applicable law. Material changes will be notified by email to active Customers at least 30 days before the change takes effect.
Unbreached AB
Privacy and DPO contact: privacy@organicely.se
General support: support@organicely.se
Sweden · org.nr 559411-9624
This policy is governed by the laws of Sweden. Any dispute arising out of or related to it will be resolved before the courts of Sweden, with Stockholm District Court (Stockholms tingsrätt) as the court of first instance, without prejudice to mandatory consumer rights or the supervisory authority's jurisdiction.
← Back to organicely.se