Privacy Policy

When you create an account, we collect:

• Name and email address
• Profile information (optional, such as profile picture)
• Organization name and role
• Authentication credentials (managed securely via OAuth providers)

Exordia authenticates users through supported identity providers, including Google OAuth and Microsoft Entra ID. We access identity-provider profile information (such as name, email address, and profile image) solely for account creation and authentication purposes.

When you use the Service, you may submit:

• Workshop notes and session content
• Discovery templates and questions
• Requirements and user stories
• Project and client information
• Stakeholder details and contact information

Note: This content may contain personal data of third parties (e.g., your clients' stakeholders). You are responsible for ensuring you have appropriate consent or legal basis to share such information.

When business customers submit Customer Data through the Service, Exordia generally processes that Customer Data as a processor or service provider on behalf of the customer organization (the controller or business). If you are a data subject included in a customer's data, privacy requests relating to that data may need to be directed to the relevant customer organization first.

We automatically collect:

• Log data (IP addresses, browser type, device information, pages visited)
• Usage patterns and feature interactions
• Performance metrics and error reports
• Session duration and navigation paths

When you use AI features, we process:

• Input content you submit for AI processing
• AI-generated outputs
• Usage metrics (tokens consumed, operations performed)

When you subscribe to a paid plan, payment is processed by our third-party payment processor, Stripe. We collect:

• Stripe customer and subscription identifiers
• Subscription status, plan type, and billing period
• Seat allocation and AI credit usage

We do not store credit card numbers, bank account details, or other sensitive payment credentials. All payment data is handled directly by Stripe in accordance with Stripe's Privacy Policy.

We collect information when you:

• Contact our support team
• Submit feedback through the Service
• Respond to surveys or communications

• Create and manage your account
• Deliver the features and functionality you request
• Process your workshop content through AI features
• Provide customer support and respond to inquiries
• Maintain and improve the Service's performance and security
• Develop new features and services

• Send service-related notifications (e.g., security alerts, updates)
• Respond to your requests, comments, and questions
• Send administrative information about your account

• Analyze usage patterns to improve user experience
• Generate aggregated, anonymized insights
• Conduct research to enhance our products

• Detect, prevent, and address technical issues
• Protect against fraud, abuse, and security threats
• Enforce our Terms of Service and policies
• Comply with legal obligations

Our AI features include:

• Note Mapping: Automatically linking workshop notes to template questions
• Requirements Generation: Creating user stories from workshop content
• Template Enhancement: Suggesting improvements to discovery templates
• Gap Analysis: Identifying missing coverage areas

We use the following AI service providers:

AI processing is currently performed in United States regions. EU data residency for AI processing is not currently available.

Under applicable privacy laws, you have the right to:

• Request information about the logic involved in automated decisions
• Object to automated processing in certain circumstances
• Request human review of automated decisions
• Opt out of AI features entirely

We engage third-party service providers to perform functions on our behalf. These providers have access to personal information only to perform their functions and are obligated to maintain confidentiality.

If you use the Service as part of an Organization, other members of your Organization (particularly administrators) may access certain information about your account and activities.

We may disclose your information if required to do so by law or in response to:

• Valid legal process (e.g., subpoenas, court orders)
• Government requests that meet applicable legal requirements
• Protection of our rights, privacy, safety, or property
• Emergency situations involving potential threats to persons

If Exordia is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal information.

By using the Service, you acknowledge that your information will be stored and processed in the United States. Some authentication-related processing by third-party identity providers may occur globally, subject to those providers' own infrastructure and policies.

For GDPR-related inquiries, you may contact our data protection point of contact:

In addition to the rights listed in Section 10, EEA/UK residents have the right to:

You have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement.

Your personal data may be transferred to and processed in the United States. For transfers of personal data from the EEA/UK to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the data processing terms of our infrastructure and AI service providers.

Enterprise customers requiring dedicated data processing terms may review and request execution of our Data Processing Addendum (DPA), which includes Standard Contractual Clauses and UK transfer terms.

In accordance with GDPR Article 22, we inform you that the Service uses AI-assisted processing to generate requirements and map workshop notes. These outputs are recommendations only and are not used to make decisions that produce legal effects or similarly significantly affect you. All AI outputs require human review before use. You may opt out of AI features at any time.

To exercise any of these rights, please:

• Email us at [email protected]
• Use the account settings within the Service (for data export and deletion).

We will respond to your request within 45 days. We may need to verify your identity before processing your request.

You may designate an authorized agent to submit privacy requests on your behalf. Authorized agent requests should be sent to [email protected] with the subject line "Authorized Agent Request."

If we decline to take action on a privacy request, you may appeal that decision by emailing [email protected] with the subject line "Privacy Appeal." We will respond to appeals within 60 days.

If we determine that an unauthorized breach of security has resulted in unauthorized access to your personal data, we will notify you without unreasonable delay and within 72 hours of determination where feasible. We will also notify relevant supervisory authorities as required by applicable law.