Privacy & customer data

In this notice

1. Information in the service
2. Use and business access
3. Service providers and storage
4. Retention and your requests
5. Sign-in cookies and preferences
6. Public-page analytics

Information in the service

• Account details: name, email address, business name, login identity, membership permissions, and trial or account status. Authentication is handled by Amazon Cognito.
• Workspace records: information your business enters about employees, software licenses, contracts, business contacts, costs, renewal dates, training, credentials, company documents, subscriptions, usage-based services, and manually recorded business payments and refunds.
• Files and activity: uploaded attachments and signed copies, file names and metadata, assignments, completion status, record revisions, and activity history.
• Technical and support information: connection and security information needed to serve requests, application diagnostics, and the information you choose to include in a support email.

Your business decides what to enter and whom to give access. Use the pilot for the business records it is designed to track. Do not use employee IDs or free-text notes to store passwords, payment-card details, Social Security numbers, or unrelated sensitive information.

Use and business access

OriginLith processes account and workspace information to provide the application, authenticate users, manage access and trials, save records and documents, show assignments and due dates, provide reports, investigate issues, and respond to support requests. A new business trial also creates an internal notice with business/contact details and trial dates for OriginLith’s support team.

Administrators and power users can access their business’s records. Standard employee accounts receive their own assigned information. They do not receive coworkers’ records, business spending, or manager-only training notes. Administrators manage account permissions; an employee’s descriptive team or role labels do not themselves grant login access.

OriginLith operates the service and may need access to relevant account information or records to investigate a problem or fulfill a support request. Customer records are not public pages and are not sent to Google Analytics by the application.

Online paid checkout is not enabled during the current pilot. A purchase inquiry opens an email draft; it does not charge a card or start a paid subscription.

Service providers and storage

Amazon Web Services (AWS) supplies hosting, authentication, databases, private document storage, and operational notification infrastructure. The active regional application, authentication, identity, and document services are in US West (Oregon). Earlier recovery copies remain in US East (Ohio). Public content is delivered through AWS’s global delivery network.

Google Analytics is used only on the public product homepage as described below. It is not loaded in the application, authentication pages, or this notice.

Apple iCloud provides OriginLith’s support email service. If you email us, your message is processed to handle your inquiry. Clicking an email link or preparing a website request opens a draft in your email application; it does not send the message automatically. Links to an external training provider or another site take you to that provider, whose own privacy arrangements apply.

Read Security & Trust for the current access, encryption, backup, and file-handling protections and their limits.

Retention, exports, and deletion requests

Trial expiry preserves the business’s records and files. Access to business pages, records, exports, and downloads pauses until a paid plan reopens the same workspace. Business administrators can still manage the account and request a purchase. Archiving an employee, record, or company document preserves its history. It is not permanent deletion.

The pilot does not yet have an automatic whole-business erasure feature or a finalized general retention/deletion schedule. Records, audit history, file versions, and migration or recovery copies may remain until a reviewed deletion or retention action is carried out. The active business and identity tables have a 35-day point-in-time recovery window; that is a recovery setting, not a promise that all copies of a deleted item disappear after 35 days. Application log groups currently retain logs for 30 days.

Authorized business users can export supported record lists, yearly business expenses, and company-document assignment status to CSV, and download authorized attachments. These are separate exports and downloads, not a complete one-click workspace backup.

For access, correction, an export you cannot obtain in the app, or deletion, email support@originlith.com. Include your business name, account email, and the request. An employee can also contact their business administrator. We need to verify identity and authority before disclosing or changing business data; a request does not itself erase records. The scope, retained copies, and any constraints will need to be reviewed with the authorized business contact.

Discuss any required retention period, deletion deadline, or data-processing agreement with OriginLith before relying on the pilot for that requirement.

Sign-in cookies and preferences

The application and hosted authentication pages use cookies to keep sign-in and account verification working. Application session cookies are secure and HTTP-only; the application session lasts up to eight hours. These authentication cookies are separate from analytics.

The site also uses browser storage for preferences and locally saved drafts where applicable. A Help desk draft you choose to save is held in that browser tab’s session storage. On a shared computer, sign out and avoid leaving private information in a saved draft.

Google Analytics without analytics cookies

The public product page uses Google Analytics for basic visit measurement without an analytics cookie popup. Analytics and advertising storage remain disabled. Google receives cookieless measurements and technical connection information, including your IP address and browser/device details. Cookieless measurement is not the same as anonymous browsing.

We send the product page address without query strings or fragments and do not send a referring URL or form contents. Advertising personalization and Google Signals are disabled. Without analytics cookies, reporting about repeat visits and journeys is limited.

A previous “No thanks” choice remains in effect. We also skip Google Analytics when your browser sends Global Privacy Control or Do Not Track. The privacy page itself does not load Google Analytics. Analytics is not loaded on sign-in pages or inside the application. Any older analytics cookies created by this product page are removed when you visit either page.

Learn more about how Google uses information from sites that use its services.

Questions and updates

Contact OriginLith at support@originlith.com with privacy questions. Please do not email passwords, verification codes, or unnecessary private documents. This page’s update date identifies the notice currently published for the pilot.