Privacy notice
Updated 22 October 2026
This notice explains what personal data OriginWarden LLC handles, why, where it’s kept and what you can ask of us. Write to hello@originwarden.com with any question.
Who is responsible
OriginWarden LLC, 7001 S Texas 6 #240, Houston, TX 77083, United States, hello@originwarden.com, +1 832 646 9757, is the controller for the personal data described under “What we collect and why”.
When we act for our clients
Our clients are importers. For them we handle data about their suppliers and the farms their goods come from: the names of producers, plot locations and sizes, documents, and the names and contact details of the people at cooperatives and exporters who upload them. We handle that data only on the client’s instructions and under a data processing agreement; the client is the controller. If you’re a supplier or a producer, you can contact the client or us, and we’ll help the client answer you.
What we collect and why
Visiting this website
The site sets no cookies and runs no analytics. To deliver the pages and protect them from abuse, our hosting provider processes your IP address, browser details and the pages requested. Legal basis: our legitimate interest in running a secure website (GDPR Article 6(1)(f)).
Writing to us
We use your name, email address or phone number, your message and any attachments to answer you and, if you ask, to prepare an offer (Article 6(1)(b) and (f)). If you write to us on WhatsApp, WhatsApp carries the messages under its own terms. Plot files you send us by email or WhatsApp are moved into our EU storage and deleted from the mailbox or chat within one business day. If you don’t become a client, we delete the plot file and our check of it within 30 days.
Businesses we contact
We look for companies that may need our services, and for the people in them who are responsible for purchasing, quality or compliance. We collect their name, job title and business contact details from the company’s own website, press articles and public registers, and use them to offer our services to the company (Article 6(1)(f)). Our first message says where we found your details. You can object at any time: we then stop contacting you and keep only a note so that we don’t contact you again. We delete these details 24 months after our last contact unless you become a client.
Clients
We keep the names and contact details of the people we work with at our clients, our agreements and our invoices, to deliver the work and to meet accounting and tax rules (Article 6(1)(b) and (c)).
Where the data is kept, and who helps us
- Supabase: our database and file storage, in Frankfurt, Germany.
- Cloudflare: backups, in the EU.
- Render: runs our application in Frankfurt, and hosts this website on its content delivery network.
- Google: email, through Google Workspace.
- WhatsApp (Meta): messages you choose to send us there.
- World Resources Institute (Global Forest Watch), United States: receives the outline of a plot, or a circle around its GPS point, to measure tree-cover loss. It receives no names or references, so it can’t tell whose plot it is.
- Food and Agriculture Organization of the United Nations (FAO), through its Whisp service, which runs on Google Earth Engine: receives the outline of a plot, or its GPS point and a circle around it, to compare them with forest and land-use maps. With them goes a random number that means nothing outside OriginWarden, and no names, so it can’t tell whose plot it is either.
Each of them handles the data only to provide its service to us.
Data leaving the EU
OriginWarden LLC is in the United States, and some of our providers are US companies. When personal data is accessed from outside the EU or sent outside it, including by us, we rely on the European Commission’s standard contractual clauses, or on the recipient’s certification under the EU–US Data Privacy Framework. For client data, the clauses are part of our data processing agreement.
How long we keep it
- Evidence prepared for a client’s due diligence statement (plots, checks, documents and the record of who did what): five years after the statement, the period the regulation requires; then deleted, or handed to the client.
- Free checks: 30 days, unless you become a client.
- Business contacts: 24 months after the last contact.
- Agreements and invoices: as long as tax law requires.
Your rights
You can ask us for access to your data, a copy of it, its correction or deletion, and for us to restrict or stop using it. You can object to our use of your data at any time; if you object to marketing, we always stop. Write to hello@originwarden.com. If you think we’ve handled your data wrongly, you can complain to the data protection authority in the EU country where you live or work.
Decisions about you
We don’t make automated decisions about people. The tree-cover check flags plots automatically, but a person reviews every flag.
Security
Data is encrypted in transit and at rest by our providers, access is limited to the people doing the work, and every change to client data is recorded with who made it and when.
Changes
When our handling changes, we update this notice and the date at the top.