Privacy Policy

Last updated: 7 October 2026 · Applies to the Origami web application at origamidb.com (including staging.origamidb.com)

Origami Design + Build ("Origami", "we", "us") is a design-build firm. Origami is our private web application for running our projects: leads and clients, project tasks and schedules, files, crew and timesheets, and project finances. It is used by our staff and by the clients, consultants and subcontractors working on our projects. This policy explains what information the application collects, how we use it, how it is stored and shared, how long we keep it, and how you can have it removed — including the data we receive from Google when you connect a Google account.

Origami is not a consumer service and has no public sign-up: an administrator at Origami Design + Build creates each account.

Contents

Information we collect
Data we receive from Google
Limited use of Google user data
How we use information
Who we share it with
Storage and security
How long we keep it, and deletion
Your choices and rights
Cookies and local storage
Children
Changes to this policy
Contact

1. Information we collect

Account information

Your name, email address, the role and access level an administrator gives you, when the account was created and when you last signed in.
If you set a password, only a one-way scrypt hash of it is stored — never the password itself.
If you sign in with Google: your Google profile name, email address and profile picture (see section 2).
Your own preferences, such as which notification emails you want and your display theme.

Information you and your team enter

Leads and contacts: names, phone numbers, email and postal addresses of prospective clients, clients, consultants, subcontractors, vendors and authorities, and notes about the enquiry or project.
Project records: projects, phases, tasks, comments, checklists, meetings and minutes, RFIs, change orders, observations, schedules, daily logs and the files attached to them (drawings, photos, documents).
Employee and crew records (for our own staff and crews): contact details, job and trade, deployment to projects, timesheets, leave, and payroll and identity information that our office enters for employment purposes.
Financial records: contract amounts, invoices, payments, retention, reimbursable expenses and job costs for each project.

Information created as you use Origami

An activity history on records (who created or changed what, and when), kept so the team can see the history of their work.
Standard server logs of requests (time, address requested, IP address and browser type), used to keep the service running and secure.

2. Data we receive from Google

Origami uses Google OAuth. You choose whether to connect a Google account; Google shows you exactly what is being requested before you agree. Each permission is used only for the purpose listed below.

Permission (scope)	What Origami does with it	What is stored
`openid`, `email`, `profile` Sign in with Google	Matches your Google email address to the Origami account an administrator created for you, and shows your name and picture inside Origami. Sign-in only works for addresses that already have an account.	Your name, email address and profile picture URL on your account.
`gmail.send` Send email on your behalf	Sends emails that Origami or your team create: account invitations, password links, task assignments and reminders, meeting and site-visit invitations, proposals and project letters. This permission can only send; Origami cannot read, search or delete anything in your mailbox.	Nothing from your mailbox. Origami keeps its own record of what it sent (for example, the task the email was about).
`drive` Google Drive	Used with the company's own Google Workspace account (connected by an administrator) to store and open project files: files attached to tasks, leads, RFIs and finance records are uploaded to folders Origami creates, opened when someone views them, and moved to the Drive trash when deleted in Origami. The "All Files" and Plan & File Room screens let permitted staff browse the company's project folders.	The Drive file and folder IDs and names linked to each record. File contents stay in Google Drive.
`calendar.events` Your Google Calendar	When you connect "My Calendar": shows your own upcoming events on your Origami dashboard and calendar, and adds meetings and site visits you schedule in Origami to your calendar (with invitations to the attendees you choose).	The ID of events Origami created, so it can update them. Your other events are read when you view them and are not stored.
`calendar.freebusy` Availability	When booking a meeting or site visit, checks when the office calendars an administrator has listed are free or busy, so a time can be offered that works.	Nothing — only free/busy times are read, at the moment of booking. Event details are not visible to this permission.

Google gives Origami a refresh token for each connected account so these features keep working without asking you again. Tokens are stored in Origami's database, are never shown in the app or sent to your browser, and are deleted as soon as the account is disconnected (see section 8). Short-lived access tokens are kept in server memory only.

3. Limited use of Google user data

Origami's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data received from Google APIs:

is used only to provide and improve the user-facing features described in section 2;
is not transferred to anyone else, except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with your notice;
is never used to serve advertisements, and is never sold;
is not read by people, unless you ask us to (for example, for support), it is needed for security purposes such as investigating abuse, or the law requires it;
is never used to develop, improve or train generalized artificial intelligence or machine learning models.

4. How we use information

To run Origami: show each person the projects, tasks, files and records their role allows, and keep that work up to date.
To send the emails and text messages the application is built to send — invitations, password links, task assignments, reminders and notices you have chosen to receive, and daily-log copies to our office.
To produce the documents our business needs: proposals, letters, change orders, invoices, daily-log reports, timesheets and payroll.
To keep the service secure and working: authentication, preventing misuse, fixing problems.

We do not sell personal information, use it for advertising, or build profiles of you for marketing.

Within Origami: people on a project see that project's information according to their role. Clients, consultants and subcontractors see only what is shared with them.
Service providers that run parts of Origami for us: Microsoft Azure (hosting and database), Google (Gmail, Calendar and Drive, as described above), and Twilio (text messages: notices for people who have opted in to them, and messages our staff send from Origami to a project contact). They process data on our behalf and under their own security and privacy commitments.
When required by law, or to protect the rights, safety and property of our team, clients or others.

We do not share Google user data with any other third party.

6. Storage and security

Origami runs on Microsoft Azure. All traffic to it is encrypted with HTTPS.
Passwords are stored only as scrypt hashes. Sessions use signed tokens and a secure, HTTP-only cookie, and expire automatically.
Access inside the application is limited by role; administrators control who can see each area.
Google refresh tokens and other secrets are kept on the server only and are never sent to browsers.

No system is perfectly secure, but we take reasonable measures to protect the information we hold and review them as the application changes.

7. How long we keep it, and deletion

Accounts: kept while you work with us. When an administrator removes your account, your account details are deleted; records you created for a project (such as tasks or comments) stay with that project as part of our business records.
Project, employee and financial records: kept for as long as our business needs them and as required by law (for example, tax, payroll and contract record-keeping rules).
Google tokens: kept only while the Google account is connected, and deleted immediately when it is disconnected.
Server logs: kept for a limited period for security and troubleshooting, then deleted.

To ask for your information to be deleted, email Systems@origamidb.com. We will confirm and complete the request within 30 days, except for records we are legally required to keep.

8. Your choices and rights

Disconnect Google: disconnect "My Calendar" in Origami under Settings → My account, or (for administrators) the company Google account under Settings → Integrations. You can also remove Origami's access at any time from your Google Account at myaccount.google.com/permissions.
Notifications: choose which emails and text messages you receive under Settings → My account.
Access, correction and deletion: you can ask to see the personal information we hold about you, to correct it, or to delete it, by emailing us. Depending on where you live, you may have further rights under local law; we will honour them.

9. Cookies and local storage

Origami uses one secure, HTTP-only cookie to keep you signed in, and your browser's local storage for your session and small preferences (such as the display theme or the last project you opened). There are no advertising or third-party tracking cookies.

10. Children

Origami is a business application for adults working with Origami Design + Build. It is not directed to children, and we do not knowingly collect information from anyone under 16.

11. Changes to this policy

If what Origami collects or how it uses Google data changes, we will update this page and its date before the change takes effect, and tell account holders of any significant change by email or in the application.

12. Contact

Origami Design + Build
Email: Systems@origamidb.com
Website: origamidb.com