OG Manager holds some of the most important data a business has: its customers, patients, finances and campaigns. This policy explains what we collect, why, who we share it with and the choices you have.
1. Who is responsible
This policy explains how OG Manager (“we”) handles personal data in two roles. For account, billing and website data, we decide how the data is used and are responsible for it. For data your business stores in its workspace, such as leads, patients, employees and conversations (“Customer Data”), your business decides how it is used and we process it on your instructions.
If you are a customer of a business that uses OG Manager, for example a patient of a clinic, please contact that business first about your data. We will help them respond.
2. What we collect
- Account data: name, email, password hash, Google sign-in identifier if you use it, two-factor settings, language and the organizations you belong to.
- Billing data: business name, billing contact, invoices, plan and payment status. Card and wallet details are collected by SSLCommerz, Stripe or Paddle; we receive only a reference, the method type and the result.
- Usage and security data: IP address, device, session times, request IDs and audit events such as sign-ins, role changes and approvals.
- Website and sales data: what you send through our contact or demo form, and basic analytics about page visits.
- Customer Data: whatever your business enters or syncs from platforms it connects, such as Meta, Google Ads, WhatsApp or Shopify.
3. How we use it
- to provide, secure and support the Service and your workspace;
- to bill you, prevent fraud and keep tax and VAT records for BDT sales;
- to send service emails such as invoices, security alerts, token expiry warnings and incident notices;
- to reply to sales and support requests;
- to improve the product using aggregated, de-identified usage information.
We do not sell personal data. We do not use Customer Data to train AI models, and the AI providers we use process it under terms that exclude training on it.
4. AI processing
When someone in your workspace uses an AI feature, the relevant records and documents are retrieved for that task and sent to the AI provider your organization has chosen (OpenAI, Anthropic or Google). Personal data can be redacted before sending, and each AI decision is logged in your workspace with its sources.
Sensitive records, including payroll, HR records, patient notes and call recordings, are excluded from AI retrieval unless your organization explicitly allows it.
5. Health data
In the Clinic module, patient medical history, treatment notes, prescriptions and clinical photos are limited to doctor and clinic roles, follow separate retention rules, and are recorded with consent where photos and treatments require it. Screens showing patient data block screenshots in our mobile app. The clinic remains responsible for obtaining patient consent and meeting medical record-keeping duties.
6. Marketing messages sent through OG Manager
Workspaces that send WhatsApp, SMS, email or Messenger campaigns must have consent. OG Manager checks the consent registry, suppression list and quiet hours before every send and supports one-click opt-out. Our own marketing emails to you include an unsubscribe link.
8. How we protect it
Every workspace is isolated by forced row-level security in the database. Data is encrypted in transit with TLS 1.2+ and at rest; OAuth tokens, two-factor secrets and sensitive fields are additionally encrypted with a key unique to your organization. Support staff can only open your workspace in an audited, time-limited, read-only session that notifies your owners. More detail is on our Security page.
9. How long we keep it
- Customer Data: for as long as the workspace exists, within your plan’s data-history limits.
- Audit logs: for your plan’s audit retention period, from 7 days on Free to unlimited on Enterprise.
- Deleted workspaces: purged 30 days after the deletion request; backups age out within 35 days.
- Invoices and payment records: as long as tax law requires.
- Sales enquiries: up to 24 months after our last contact.
10. Your choices and rights
You can view and correct your profile in the app, export workspace data, and ask us for a copy of your personal data, its correction or its deletion. Email privacy@ogmanager.com and we will respond within 30 days. We may need to verify your identity, and we may keep data where the law requires it.
11. Where data is stored
The Service runs on infrastructure we operate and on managed cloud providers, and some service providers may process data outside Bangladesh. Enterprise customers can contract for a specific region, such as AWS ap-south-1 or Google Cloud asia-south1.
13. Changes and contact
We will post any update here and email account owners about material changes. Contact: privacy@ogmanager.com, OG Manager, Dhaka, Bangladesh.