Privacy Policy

Last updated: 27 June 2026

⚠️ Template — fill the [bracketed] items and have it reviewed before publishing: legal entity, contact email, jurisdiction.

Workspace Org Chart ("the App", "we") is operated by [LEGAL ENTITY]. This policy explains exactly what the App does and does not do with your data. The short version: your organisation's directory data never leaves your browser, and we never see it.

We run no backend for your data. The App is a client-side web application. Your Google Workspace directory is read directly into your browser, rendered into a chart there, and is never transmitted to, stored on, or processed by any server we operate.

What data the App accesses

With your authorisation, the App requests a single, read-only Google scope: admin.directory.user.readonly. It uses this only to read your Workspace users and their manager relationships in order to draw your org chart. It requests no write access and no other scopes.

How that data is handled

In your browser only. Directory data is fetched from Google's Admin SDK directly by your browser and held in memory to render the chart. It is not sent to us.
No server storage. We do not store, log, cache, or transmit your directory data anywhere.
Local device storage. Your OAuth Client ID and any open-role/reporting changes you create are saved in your browser's localStorage, on your device only. Clearing your browser data removes them.

Google API Services — Limited Use

The App's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Directory data is used solely to provide the org-chart feature visible to you, is processed only in your browser, and is never transferred to others, used for advertising, or used to train AI/ML models.

Third-party resources

To run in your browser, the App loads: Google Identity Services (sign-in), the Google Admin SDK (your directory), Google Fonts, and the D3 visualisation library (via the jsDelivr CDN). These are loaded directly by your browser from those providers; we do not route your data through them.

What we don't do

No selling or sharing of your data. No advertising. No AI/ML training on your data. No tracking of your people.

Contact

Questions about this policy: [CONTACT EMAIL].