Privacy Policy

1.1 Purpose and Scope

• This Privacy Policy explains how Forge Blue Inc., a Corporation doing business as OJAI (collectively, "Forge Blue", "OJAI", "we", "us", or "our"), collects, uses, discloses, and safeguards information when you access or use the OJAI platform, websites, applications, and related services (collectively, the "Services").
• This Privacy Policy aligns with OJAI's Terms of Service and applies to all users globally, including organizational customers and individual users.

1.2 Contact Information

• For questions or requests regarding this Privacy Policy, contact: info@ojai.global.
• For copyright notices under the Digital Millennium Copyright Act (DMCA), see the Terms of Service; for privacy-specific requests (e.g., access or deletion), use the mechanisms described in Section nine (9) (Your Rights and Choices) of this Privacy Policy.

1.3 Relationship to Terms of Service

• Capitalized terms not defined herein have the meanings given to them in the Terms of Service.
• By accessing or using the Services, you agree to the terms of this Privacy Policy and the accompanying Terms of Service.

2.1 Data You Provide Directly

• Account and Profile Data: name, email address, organization, role, password (hashed), and settings.
• Billing Data: payment method tokens, billing address, and tax information processed via our third-party payment processor (Stripe). We do not store full payment card numbers.
• Content and User-Generated Content (UGC): text, photos, videos, audio files, datasets, maps, event listings, resource files, comments, and other user-generated content you upload.
• Communications: support requests, feedback, surveys, and correspondence.

2.2 Data Collected Automatically

• Usage Data: activity logs, feature interactions, referring URLs, timestamps, and session information.
• Device/Technical Data: IP address, browser type, device identifiers, operating system, language, and approximate location derived from IP address.
• Cookies and Similar Technologies: cookies, web beacons, pixels, local storage, and software development kits (SDKs) used for core functionality, analytics, and fraud prevention (see Section six (6) of this Privacy Policy).

2.3 Data from Third Parties

• Single Sign-On (SSO): when you use Google SSO, we receive basic profile information (e.g., name, email address) as permitted by your settings with the SSO provider.
• Payment Processors: confirmation of payment status, limited billing details, and tax status from Stripe.
• Integrations and Partners: data from optional integrations (e.g., analytics, mapping, or reporting tools) when you authorize such connections.

3.1 Purposes of Use

• Provide and Operate the Services: create and manage accounts, authenticate users, and deliver features (e.g., community hubs, maps, analytics).
• Moderate and Secure the Platform: detect abuse, enforce policies, and maintain platform integrity, including the use of automated systems and artificial intelligence (AI).
• Billing and Account Management: process payments, manage subscriptions, and handle credits or refunds.
• Improve and Develop the Services: analyze usage, test features, and enhance functionality and performance.
• Communicate with You: send administrative messages, service updates, and responses to inquiries.
• Marketing and Promotion: send promotional communications (you may opt out at any time), and showcase success stories or public content consistent with your settings and applicable law.
• Compliance and Legal: comply with applicable laws, respond to lawful requests, and protect rights, safety, and property.

3.2 Legal Bases (EU/UK)

• Performance of a Contract: to provide and operate the Services you request.
• Legitimate Interests: to secure, improve, and promote the Services; prevent fraud; and support our mission, balanced against your rights and expectations.
• Consent: for certain cookies/trackers, marketing communications, and specific data uses where required. You may withdraw consent at any time.
• Legal Obligations: to fulfill tax, accounting, and regulatory requirements.
• Vital Interests or Public Interest: where necessary to protect individuals or comply with relevant public interest obligations.

4.1 Service Providers and Processors

We share data with vendors that perform services on our behalf, including hosting, security, analytics, customer support, and payment processing (e.g., Stripe), under contractual obligations to protect data and use it only pursuant to our instructions.

4.2 Organizational Administrators

If you join an organizational account, administrators may access certain information about your use of the Services (e.g., activity within that organization's workspace) and content you submit within their organization's environment.

4.3 Other Users and Public Areas

Your UGC may be visible to other users or the public based on your settings and the functionality of the Services. Please consider carefully what you share and with whom.

4.4 Legal, Safety, and Rights

We may disclose information if required by law or in a good faith belief that such action is necessary to:

• comply with a legal obligation;
• protect and defend the rights or property of OJAI;
• act in urgent circumstances to protect the personal safety of users or the public; or
• protect against legal liability.

4.5 Business Transfers

We may disclose or transfer data in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to continued protections consistent with this Privacy Policy.

5.1 Retention Periods

• We retain personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, including providing the Services, complying with legal obligations, and resolving disputes.
• Consistent with the Terms of Service, following termination we provide a reasonable opportunity to export data and then delete or de-identify data within a commercially reasonable period, typically within Thirty (30) days unless a longer period is required by law or needed to protect our rights.

5.2 Deletion Requests

You may request deletion of your personal data as described in Section nine (9) (Your Rights and Choices) of this Privacy Policy. We will honor valid requests subject to necessary recordkeeping, legal obligations, and the rights of others.

6.1 Categories of Cookies

• Strictly Necessary Cookies: required for core features such as authentication, security, and account management.
• Functional Cookies: remember preferences and enhance the user experience.
• Analytics Cookies: measure and analyze usage to improve the Services.
• Advertising/Marketing Cookies: used sparingly and only with consent where required; we do not sell personal data.

6.2 Controls

• Cookie Banners and Settings: where required (e.g., EU/UK), we provide consent banners and cookie settings to manage preferences.
• Browser Settings: you can configure your browser to block or delete cookies; some features may not function properly if cookies are disabled.
• Opt-Out Mechanisms: for certain third-party analytics or marketing tools, we provide links or settings to opt out where available.

7.1 Transfer Mechanisms

• We operate globally and may transfer your personal data to countries outside your country of residence, including to the United States.
• For EU/UK users, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and, where applicable, the EU-U.S. Data Privacy Framework or UK Extension.

7.2 Additional Measures

We implement technical and organizational measures to protect data during transfer and at rest, including encryption in transit, access controls, and internal policies.

8.1 Security Measures

We maintain administrative, technical, and organizational safeguards designed to protect personal data, including role-based access controls, Two (2)-Factor Authentication for Admins and Editors, encryption in transit, logging, and monitoring.

8.2 Your Responsibilities

You are responsible for securing your credentials, enabling Two (2)-Factor Authentication where required, maintaining updated devices/browsers, and promptly notifying us of any suspected unauthorized use.

9.1 Access, Correction, Deletion, and Portability

You may request access to, correction of, or deletion of your personal data, and, where applicable, data portability.

9.2 Objection and Restriction

Where we process data based on legitimate interests, you may object to processing on grounds relating to your particular situation. You may request restriction of processing in certain cases.

9.3 Consent and Marketing Preferences

Where we rely on consent, you may withdraw consent at any time. You may opt out of marketing emails by using unsubscribe links or contacting support.

9.4 How to Exercise Rights

Submit privacy requests to: privacy@ojai.global or info@ojai.global. Provide sufficient information to verify your identity and locate your records.

9.5 Region-Specific Rights

• EU/UK (GDPR): You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. Our lead contact can be provided upon request.
• California (CCPA/CPRA): California residents have rights to know, access, correct, delete, and opt out of certain sharing or sales of personal information. We do not sell personal information as defined by California law. To exercise rights, use the channels in Section 9.4. You may designate an authorized agent with appropriate proof.

10.1 Data Used to Track You

• Identifiers: advertising identifiers or device identifiers where marketing cookies are enabled by consent.
• Approximate Location: derived from IP address for analytics and fraud prevention.

10.2 Data Linked to You

• Contact Information: name, email, organization, and role for account and communications.
• Financial/Billing Information: limited billing details and tax status (processed via Stripe; we do not store full payment card numbers).
• Content: UGC (text, photos, videos, audio, datasets, maps, comments) linked to your account.
• Identifiers: IP address, device ID, SSO identifiers.
• Usage Data: activity logs and engagement metrics tied to your account for security and service improvement.

10.3 Data Not Linked to You

• Aggregated or De-identified Analytics: usage metrics aggregated for performance and feature planning.
• Diagnostics and Performance Data: error logs and telemetry that do not identify individuals.

10.4 Your Rights (Quick Reference)

• Access, correct, or delete your data.
• Opt out of marketing communications.
• Manage cookies and tracking preferences.
• Exercise regional rights (e.g., GDPR, CCPA) via the methods in Section nine (9).

11.1 Overview of AI/ML Use

We use AI and machine learning systems to assist with content moderation, knowledge discovery, and analytics supporting impact reporting, coalition building, and community engagement.

11.2 Data Used with AI/ML

• Inputs to Run Models: we may process Usage Data, technical data, and UGC to run moderation and recommendation features.
• Training and Fine-Tuning: by default, we do not use your personal data or private UGC to train or fine-tune proprietary or third-party foundation models unless: (i) the data has been de-identified or aggregated; or (ii) you (or your organization) provide explicit, informed consent via in-product settings or a written agreement.
• Third-Party AI Vendors: when we use third-party AI services, we impose contractual restrictions prohibiting those vendors from using your data to train their models, unless you have given explicit, informed consent.

11.3 Automated Decision-Making and Profiling

• We use automated systems to flag potential policy violations, prioritize content for review, recommend resources, and surface insights. These systems may affect content visibility but do not make irreversible decisions without the possibility of human review.
• Opt-Out and Controls: where required by law, you may opt out of certain profiling or automated decision-making that produces legal or similarly significant effects. Request this via the methods in Section 9.4. We provide human review upon request for contested moderation outcomes where legally required.

11.4 Avoiding Deceptive Claims and Safety Measures

We do not make deceptive claims about AI capabilities. We disclose material limitations and ensure appropriate safeguards, including:

• data minimization and access controls;
• audit logging;
• data segregation for enterprise workspaces; and
• regular assessments of vendors and models for privacy and security risks.

12.1 No Users Under Thirteen (13)

The Services are not directed to children under thirteen (13), or under sixteen (16) where applicable. We do not knowingly collect personal data from such children. If we learn that such data has been collected, we will delete it promptly.

13.1 Role Clarification

• For users who access OJAI through an organization, Forge Blue Inc. generally acts as a processor for content and personal data controlled by that organization; the organization acts as the controller. For direct-to-consumer accounts, Forge Blue Inc. acts as the controller.
• We process personal data pursuant to our contracts and customers' instructions. If you submit a request and your organization controls your data, we may redirect your request to the organization's administrator.

14.1 EU/UK

• Controller Identity: Forge Blue Inc., [insert business address for notices], email: info@ojai.global.
• Data Protection Officer (if appointed) or Representative: [Insert details if/when appointed].
• Legal Bases: see Section 3.2. Data subject rights: see Section nine (9). International transfers: see Section 7.

14.2 California

• Categories Collected: identifiers; commercial information (subscription details); internet or other electronic network activity; geolocation (approximate); professional or employment-related information (if provided by organizational accounts).
• Sources: you, your devices, your organization, service providers.
• Business/Commercial Purposes: as outlined in Section three (3).
• Disclosures for Business Purposes: to service providers and processors, organizational administrators, and as described in Section four (4).
• Sales/Sharing: we do not sell personal information as defined by California law. We do not share personal information for cross-context behavioral advertising without consent where required. California residents may exercise rights via Section 9.4. You may designate an authorized agent with appropriate proof.

14.3 Other Jurisdictions

We will honor mandatory rights and disclosures required by local law and will provide additional notices as needed.

15.1 Export Tools

During an active subscription and for a reasonable period following termination, typically Thirty (30) days, we provide self-service export tools where available. Additional assistance may be available for a fee as outlined in the Terms of Service.

15.2 Post-Termination Handling

After the export window, we will delete or de-identify personal data, except where retention is required for legal, regulatory, fraud prevention, or dispute resolution purposes.

16.1 Updates

We may update this Policy from time to time to reflect changes to our practices or legal requirements. Material changes will be announced via email, in-product notice, or posting on our website.

16.2 Effective Date

Changes take effect on the date indicated. Your continued use of the Services after the effective date signifies acceptance. If you do not agree, you should discontinue use and, if applicable, adjust your settings or cancel your subscription.

17.1 Methods of Contact

• Email: info@ojai.global
• For privacy rights requests: privacy@ojai.global or info@ojai.global
• Mailing address for legal notices: [Insert mailing address for Forge Blue Inc.; consider adding a privacy contact or DPO if appointed]