← Back to Sign In

Privacy Policy

Last updated: March 11, 2026

1. Introduction

The Thing ("we", "our", or "the Service") is an organizational design platform operated by Vm78 Inc. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using The Thing, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect the following categories of information:

Account Information: When you create an account, we collect your name, email address, organization name, and a hashed version of your password. We never store passwords in plaintext.
Organizational Data: Data you upload or create within the Service, including employee records, department structures, org chart configurations, attributes, and version histories.
Usage Data: We automatically collect information about how you interact with the Service, including pages visited, features used, browser type, IP address, and device information.
Billing Information: Payment processing is handled by Stripe. We do not store credit card numbers. We retain your Stripe customer ID and subscription status.

3. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Service
  • Process transactions and manage your subscription
  • Send transactional emails (password resets, welcome emails, notifications)
  • Monitor and analyze usage patterns to improve user experience
  • Detect, prevent, and address technical issues and security threats
  • Comply with legal obligations

4. Third-Party Services

We use the following third-party services that may process your data:

5. Data Retention

We retain your account and organizational data for as long as your account is active or as needed to provide you with the Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes.

Audit logs are retained for 12 months for compliance and security purposes. Database backups are retained for 30 days and then automatically deleted.

6. Data Security

We implement industry-standard security measures to protect your data, including:

  • Encryption in transit (TLS/HTTPS) and at rest
  • Password hashing using bcrypt
  • Role-based access control with tenant isolation
  • Rate limiting and CSRF protection
  • Regular security monitoring via Sentry
  • Daily encrypted database backups

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access — Request a copy of the personal data we hold about you
  • Rectification — Request correction of inaccurate data
  • Deletion — Request deletion of your personal data
  • Data Portability — Request your data in a machine-readable format
  • Objection — Object to processing of your personal data
  • Restriction — Request restriction of processing

To exercise any of these rights, contact us at privacy@thingcorp.co. We will respond within 30 days.

8. Cookies

We use essential cookies required for authentication and session management. We do not use advertising or tracking cookies. Session cookies are automatically deleted when you close your browser or when your session expires.

9. International Data Transfers

Our servers are located in the United States. If you access the Service from outside the United States, your data may be transferred to and processed in the United States. By using the Service, you consent to such transfers.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, contact us at:

Vm78 Inc.
Email: privacy@thingcorp.co

See also our Terms of Service.