Privacy

What we store, and what we do with it.

Last updated 8 October 2026. This page covers osprysuite.com, the website you are reading, and the accounts you connect to Ospry Suite, including Google: what each permission is used for, how the data is protected, and where AI is involved. There is a longer policy for the product itself, covering your account and your clients' data.

Who we are

Ospry Suite Ltd, registered in the UK with company number 17455389, based in Leicester, LE8, United Kingdom, is the data controller for the records described here that we keep for ourselves. Registered with the Information Commissioner's Office, reference ZC246894. hello@osprysuite.com. Ospry Suite is provided for business and professional use.

Your choice about analytics

When you first visit we ask whether we can see how the site gets used. Saying no changes nothing about how the site works. Your answer itself is remembered in your browser's local storage so we do not ask again. Change your mind whenever you like using the choice link at the bottom of every page; saying no removes the identifier described below from your browser and deletes the activity records already made from it.

Before you answer, the chat script on this site makes one call to our server with the site's key and the address of the page you are on, so it knows how to show itself. Cue keeps nothing about you from that call. Your IP address is used only in memory, to limit abuse, and is not written down by Cue. Our web server does keep an access log, described further down.

If you say yes, Cue, the same tool this product offers other businesses, stores a small random identifier in your browser's local storage so it can recognise activity from the same browser, including return visits. It does not use cookies for this, and it does not use that identifier to record your IP address, your device type or an advertising profile. Our server keeps only a one-way hash of the identifier.

It records which pages you viewed (the page address without any query string, and the kind of page: a general, service, gallery, area, quote, pricing or booking page), and a few actions: starting to fill in a quote form (the form's name, never what you typed), tapping a phone number, clicking out to a booking page, and staying on a service page long enough (about 18 seconds) to count as reading it. It also marks a return visit. It does not store your exact time on a page, how long your visit lasted, where you came from or which page you left from.

If you type something to us in the chat, whether or not you said yes to analytics, we keep what you wrote, any name or contact details you choose to give, any photos you send, and the page you were on, so we can reply and so we know where we got to if you come back. Your messages are sent, as typed, to our AI provider to write the reply (see "Where AI is involved"). A chat identifier for that browser tab, and whether you closed the chat, are kept in your browser's session storage until the tab is closed. If you join the waitlist on this site, the email you entered is held in session storage the same way.

We use the analytics to work out which parts of this site are useful and which are being skipped, which is the same thing this product does for other people's websites. Lawful basis: your consent for analytics; our legitimate interest in answering a question you chose to ask us for the chat.

What we deliberately do not do

We do not try to work out who you are. We do not look your identity up from your IP address, and we do not buy it from anybody who has. We do not build a picture of what we think you earn or what sort of person you are.

There are no advertising trackers on this site, nothing from a social network, and no fonts or scripts loaded from anybody else's server.

How long

These are the standard periods for Cue on this site, applied by a job that runs every night. Ask and anything goes sooner.

• Activity records: 30 days.
• Conversations: 12 months from the last message.
• Photos sent in the chat: 90 days.
• Visitors: removed, with everything recorded against them, 12 months after they were last seen.

If you wrote to us in the chat, the email alert we sent ourselves about it is kept in our email log. That copy has no automatic time limit yet and is deleted if you ask.

Our web server's access log

Like most websites, the server for osprysuite.com keeps an access log of the requests it receives. An entry can include your IP address, your browser's description of itself, the page that sent you and the full address requested, including anything after a question mark (such as a partner's referral code). The same server also delivers the Cue chat scripts, so visitors to other websites that use Cue can appear in this log too. It is kept for a limited period and rotated, and is used only to run and secure the website. Lawful basis: our legitimate interest in keeping the site working and safe.

Connecting your own accounts

Ospry can connect to Google accounts you already own (Business Profile, Search Console, Analytics, YouTube and Google Calendar), so it can read how you are doing and, where you ask it to, act on your behalf. Connections to social networks such as Facebook, Instagram, TikTok and LinkedIn are not currently offered. Nothing connects on its own. Every connection is a button you press, and you are shown what is being asked for before you press it.

We never see or store the password to any of them. Connecting happens on that company's own sign-in screen and hands us a token, which we keep encrypted and use only for the thing you connected it for. You can take any of it away at any time, from Connections inside Ospry or from the platform itself.

What we do with what those accounts tell us

Ospry's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use it to show you your own results and to do the things you asked for, we do not sell it, we do not use it for advertising, and no human at Ospry reads it except where you have asked us to fix something or the law requires it.

Scope by scope, this is what each Google permission is used for and nothing else:

• Search Console (read only): the queries, clicks, impressions and positions of your own sites, shown on your Metrics screen and in your reports.
• Analytics (read only): sessions and traffic sources for your own properties, shown alongside the search data.
• Business Profile: listing your locations and showing your profile details and performance figures, so they can be checked against your website. Google grants this as a permission that would allow changes; Ospry only reads, and nothing is posted or changed on your profile.
• YouTube: listing your channel and video statistics, and uploading videos you choose to publish, when publishing or scheduling features are switched on and you choose to use them. YouTube is only available where it has been switched on for your account.
• Google Calendar (events): when a visitor books a callback through the Cue chat on your site, reading the times of the events on the calendar you chose so only free slots are offered, adding that booking to it, and updating that booking's title if the visitor gives their name afterwards. The booking holds what the visitor gave: their name, phone or email, the page they were on and what they asked.

You can see and remove Ospry's access to your Google account at any time at myaccount.google.com/permissions, or from Connections inside Ospry. Disconnecting inside Ospry deletes the stored access tokens straight away. Figures already pulled into your reports stay with that site until you delete the site or your workspace. The callback bookings Cue makes are kept with the conversation they came from.

Where Ospry works with YouTube it uses YouTube API Services. Using those parts of Ospry means you are also agreeing to the YouTube Terms of Service, and Google's Privacy Policy covers what Google does with your data on their side.

How we protect the data your accounts share

Connections to Ospry and to the accounts you connect use encrypted connections (TLS). The credentials that connect your accounts, OAuth access and refresh tokens, API keys and connected-service passwords, are encrypted with AES-based encryption (Fernet) before they are stored, and the key to decrypt them is held outside the database, so a copy of the database alone does not reveal them. Passwords to Ospry itself are stored as salted hashes. Some other data, such as sign-in sessions and our copies of the emails we send, is protected by restricting access to the server rather than by that encryption.

Access to the server holding this data is restricted to the people who run Ospry, over key-based authentication only. The data your Google account shares is stored inside your own workspace and is never visible to any other customer. Reading a workspace's data for support needs a key the customer generates and can revoke, and every use of it is logged where they can see it. The account that runs the service can also see account details and the emails we have sent.

We make nightly encrypted database backups, kept for 14 days on our server, and the company also holds copies of those encrypted files. Restoring from a backup has been tested. Deleting a site deletes its reports and the figures your connections gave us for it; deleting your Ospry workspace does the same for every site, though the workspace can remain in a backup until that backup is deleted. What deletion covers is set out in the product privacy policy and on our data deletion page. If we ever became aware of a breach affecting your data we would tell you promptly and directly by email, alongside our obligations under UK data protection law.

Where AI is involved

Some Ospry features use Anthropic's Claude models to generate text, including Cue's replies to website visitors, content drafts, Ask Ospry answers, keyword briefings, suggested page titles and descriptions, and wording for demo websites. Depending on the feature, the request may contain business details, public website content, notes you have entered, audit or keyword information, and messages a website visitor types into Cue, including any contact details they choose to type.

Data received from connected Google APIs is not included in prompts sent to Anthropic.

These features run on Ospry's own Anthropic account, or on your own Anthropic API key if you connect one in Connections; disconnecting it returns them to Ospry's account. Anthropic states that inputs and outputs from its commercial and API services are not used to train its models by default. Anthropic may process API requests using infrastructure in multiple regions. It states that API data storage is in the United States by default, and that standard API inputs and outputs are normally deleted from its backend within 30 days, subject to its contractual, safety and legal exceptions. We do not train any model on your data or your visitors' data.

If you are an agency, and this is your client's account

One workspace never sees another's. When you connect a client, that connection belongs to that client's record and is used only for their work.

Your client can ask us directly for what we hold on them, or to delete it, whether or not they go through you.

The chat on your website

If you use Cue, our chat, its activity tracking only starts once a visitor agrees to it on that site, and it works as described at the top of this page: an identifier in local storage, not a cookie, and the same short list of page and action records. A conversation holds what the visitor typed, any name or contact details they chose to give, callback details if they booked one, photos they sent, and the page they were on. It never records what somebody typed into another form on the page, and it never asks for card details. For your site, you are the controller and we process this for you.

The people authorised to look after that website can read and reply to its conversations: the agency for sites it manages, and the business itself where its agency allows. Nobody sees another business's conversations. A visitor can change their answer using that site's privacy choice link, which removes the identifier from their browser and deletes their activity records; to have a conversation deleted, they can ask the business or email us.

By default, activity records are kept for 30 days, conversations for 12 months from the last message, and chat photos for 90 days, and a visitor is removed, with everything recorded against them, 12 months after they were last seen. The business can set shorter or longer periods within the limits Ospry allows.

Where Cue is on and a visitor has agreed, Ospry shows the business aggregated activity such as visits, page views, returning visits, commonly viewed pages and those selected actions. It is not a full analytics tool: Cue's own records do not hold the visitor's IP address, device type, referrer, exact time on page or exit page. The Cue scripts are delivered from osprysuite.com, so a visitor's request for them can appear in that server's access log.

Forms and quizzes on your website

Some sites built with Ospry can ask visitors a few questions a step at a time. The business whose site it is decides what gets asked, and we hold the answers for them.

If somebody starts and does not finish, we keep which questions they reached, because that is how a business finds out where people are giving up. Unless the business has chosen to keep them, the personal details they had started typing, such as a name, number or email, are removed by a nightly job once they have been inactive for about half an hour.

Finished answers are kept for the business until the site is deleted or someone asks; there is no automatic time limit on them yet. You can ask for them at any time, and you can ask for them to go.

The public audit tool

Anyone can run a free website audit with our audit tool, or with a version of it an agency has put its own name on. To unlock the full report you give an email address. We keep that email, the website and its findings, and a hashed form of your IP address to limit misuse.

If the page showed an agency's name, the email and findings go to that agency: into its own customer records where it has connected them, and by an email alert; the agency decides what happens next and we act for it. If the page showed Ospry Suite, they go into our own customer records (see below) so we can follow up about that audit. Marketing is a separate, optional choice on the form; asking for a report is not agreeing to it. To object to any follow-up, reply to the email or write to hello@osprysuite.com. Lawful basis: legitimate interests in giving you the report and following up about it; your consent for marketing. These records have no automatic time limit yet and are deleted on request.

Our customer records and marketing email

When you sign up or join our waitlist, your name, email, country and whether you agreed to marketing go into our own customer records system, which runs on HighLevel, so we can support you and manage your account. This happens whether or not you agreed to marketing; the record notes your choice. Marketing email only goes to people who agreed to it, and it can be stopped at any time: reply to any marketing email or write to hello@osprysuite.com.

The partner programme

Partners in our partner (affiliate) programme are selected and approved by a person. For applicants and partners we keep the details given when applying (name, email, business, website, how and where they would promote Ospry), our review notes, the agreement and the version of the terms accepted, and records of support and changes. For referrals we record which workspace a partner referred, how the referral was recorded (for example a code in the partner's link), and the qualifying payments used to work out commission. We check for self-referral using the account, workspace and email; we do not fingerprint devices or match people by IP address.

Partner tracking, commission records and payouts are handled through our affiliate platform provider, HighLevel, which may collect payout and tax details from partners directly. Ospry does not store bank or tax numbers. A tracking cookie from that provider is only set on our partner pages after a visitor accepts it, and only when tracking is switched on. Partner details, agreements, referral and commission records are kept as legal and financial records, including after a referred workspace is deleted. Lawful basis: contract with partners; legitimate interests in paying the right partner and preventing fraud; consent for the tracking cookie.

Inviting businesses to become partners. We invite a small number of businesses to join the partner programme. For limited companies and other corporate bodies we may send one message, and at most one follow-up, to a named person at the business, using their work email address or public business profile, to tell them about the programme. We get these details from the business's own website, its public business profile or a trade directory. We keep the person's name, job role, business, contact details, where we found them, the date we contacted them and the outcome, for up to 12 months from the last contact. We do not send unsolicited marketing about the programme to sole traders or other individuals unless they have agreed to it, they have asked us, or we already have a relationship with them. Every message says who we are and how to opt out. If you tell us you do not want to be contacted, we keep only a minimum record (for example a coded form of your email address) so that we do not contact you again. Lawful basis: our legitimate interests in finding partners for the programme, which we have assessed in writing, and our legal duty to respect your objection. You can object at any time, or ask what we hold about you, by emailing hello@osprysuite.com.

Security records

When a sign-in fails we record a hashed form of the network address it came from and the email address that was used, to slow down people trying to break into accounts. These records are removed after a successful sign-in, and in any case within 90 days. Lawful basis: our legitimate interest in keeping accounts and the service secure.

Where it is held

Ospry's application and primary database run on a cloud server operated by IONOS in the United Kingdom. Some features use other providers, some in other countries: Anthropic for the AI text above, Stripe for payments, HighLevel for the CRM connection, our own customer records and the partner programme, Google for the accounts you connect and for some search and page-speed checks, OpenStreetMap for place lookups and maps, browser push services for alerts you switch on, Brevo for sending email (it carries the whole message, including any visitor details in an alert), Google Calendar for calls you book with us (the booking page collects your name and email), and Cloudflare for the DNS of our own domains (customer data is not stored there as part of that). The full list, with what each one receives, is on the sub-processors page.

Your rights

You can ask us for a copy of what we hold, ask us to correct it or delete it, ask us to restrict or stop using it, object to how we use it, and withdraw any consent you gave. Email hello@osprysuite.com and we will reply within a month. If you are unhappy with how we handled your data, please tell us first; you can also complain to the Information Commissioner's Office at ico.org.uk.