Privacy

What this website stores.

Last updated 27 August 2026. This page is about osprysuite.com, the website you are reading. For the product itself, and what happens to your account and your clients' data, see the app privacy policy.

Who we are

Northora Digital, Countesthorpe, Leicester, is the data controller. Ospry Suite is our product. gregcosby@northoradigital.uk.

Cookies, and only if you say yes

When you first visit we ask whether we can see how the site gets used. Nothing is stored on your device before you answer, and saying no changes nothing about how the site works. Change your mind whenever you like using the cookie link at the bottom of every page.

If you say yes, we keep a random identifier in your browser, along with which pages you looked at, roughly how long for, and whether you started filling in a form. If you type something to us we keep that and any contact details you choose to give, so we can reply and so we know where we got to if you come back.

We use it to work out which parts of this site are useful and which are being skipped, which is the same thing this product does for other people's websites. It seemed only fair to run it on our own first.

What we deliberately do not do

We do not try to work out who you are. We do not look your identity up from your IP address, and we do not buy it from anybody who has. We do not build a picture of what we think you earn or what sort of person you are.

We keep what you did and what you told us. Never what we have guessed about you. That is a deliberate line and it is the same one the product holds for our customers' visitors.

There are no advertising trackers on this site, nothing from a social network, and no fonts or scripts loaded from anybody else's server.

How long

Twelve months from your last visit, then deleted. That is a job that runs and is checked, not a sentence on a page. Ask and it goes sooner.

Connecting your own accounts

Ospry can connect to accounts you already own — Google Business Profile, Search Console, Analytics, YouTube, Facebook and Instagram, TikTok and LinkedIn — so it can read how you are doing and, where you ask it to, post on your behalf. Nothing connects on its own. Every one is a button you press, and you are shown what is being asked for before you press it.

We never see or store the password to any of them. Connecting happens on that company's own sign-in screen and hands us a token, which we keep encrypted and use only for the thing you connected it for. You can take any of it away at any time, from Connections inside Ospry or from the platform itself.

What we do with what those accounts tell us

Ospry's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use it to show you your own results and to do the things you asked for, we do not sell it, we do not use it for advertising, and no human at Ospry reads it except where you have asked us to fix something or the law requires it.

You can see and remove Ospry's access to your Google account at any time at myaccount.google.com/permissions. When you do, we delete the data that access gave us.

Where Ospry works with YouTube it uses YouTube API Services. Using those parts of Ospry means you are also agreeing to the YouTube Terms of Service, and Google's Privacy Policy covers what Google does with your data on their side.

How we protect the data your accounts share

Everything your connected accounts share with Ospry travels over encrypted connections (TLS) and nothing sensitive is ever sent or stored in the clear.

The credentials that connect your accounts — OAuth access and refresh tokens — are encrypted at rest with AES-based encryption (Fernet) before they touch our database, and the key to decrypt them lives only on the server, outside the database. Nobody can read a token by reading the database.

Access to the systems holding this data is limited to the people who run Ospry, over key-based authentication only. The data your Google account shares is stored inside your own workspace and is never visible to any other customer.

Deletion is real and immediate: disconnecting an account from inside Ospry revokes our access at the provider and deletes the stored tokens; deleting your Ospry account deletes the data those connections gave us. If we ever became aware of a breach affecting your data we would tell you promptly and directly by email, alongside our obligations under UK data protection law.

How long we keep it, platform by platform

These are not our preferences, they are the limits each platform sets, and we hold to them because a report built on data we were not allowed to keep is worth nothing to you.

• Google Business Profile — content is held no more than 30 days, and never combined or aggregated with anything else.
• YouTube — 30 days, and we re-check every 30 days that you still want us connected. If you have revoked us, it goes.
• LinkedIn — 48 hours for activity, 24 hours for profile details, and none of it leaves Ospry.
• Facebook and Instagram — kept separately per account, never pooled across the businesses we work with.
• Sign-in tokens — kept encrypted for as long as the connection is live, and deleted within seven days of you disconnecting.

If you are an agency, and this is your client's account

One workspace never sees another's. When you connect a client, that connection belongs to that client's record and is used only for their work. We do not merge data across the businesses in your workspace to build averages or benchmarks, because their platforms do not allow it and because it is not what they agreed to.

Your client can ask us directly for what we hold on them, or to delete it, whether or not they go through you.

The chat on your website

If you use Cue, our chat, it only starts once a visitor accepts cookies on that site. It records the pages they looked at and anything they typed, so the business can answer them. It never records what somebody typed into another form on the page, and it never asks for card details. A visitor can clear everything Cue holds on them from the panel itself.

Your rights

You can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. Email and we will do it, inside a month and usually the same week. If we get it wrong you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first.