Privacy policy

This policy applies to personal data we process about:

1. Visitors to osyra.ai and our other public properties.
2. Authorised users of the Service (the “Users”), including those configured by an administrator on a Customer's account.
3. Prospects, contacts, partners, and applicants we engage with directly.

Controller / processor allocation. Osyra acts as a controller for account, billing, and marketing data. Osyra acts as a processor for Customer Content (prompts, completions, embeddings, file uploads, and routing metadata) processed on the instruction of a Customer; the Customer is the controller of that data.

We collect only what we need to operate the Service, secure it, bill for it, and support you.

We use personal data to:

1. provide, maintain, and secure the Service;
2. authenticate Users and prevent fraud or abuse;
3. invoice for the Service and collect payment;
4. respond to support requests and other inquiries;
5. send service-related notices (security alerts, billing receipts, important product changes);
6. with consent or where otherwise permitted, send product news, event invitations, and other marketing;
7. comply with legal obligations and respond to lawful requests from public authorities.

Lawful basis (GDPR / UK GDPR). Our lawful basis is one of: (a) the performance of a contract with you, (b) compliance with a legal obligation, (c) our legitimate interests in operating, securing, and improving the Service (where not overridden by your interests), or (d) your consent (which you may withdraw at any time).

No model training on Customer Content. We do not use Customer Content to train Osyra models, and we do not authorize sub-processors to use Customer Content for their model training. Telemetry derived from Customer Content is aggregated and de-identified before any internal product analytics use.

We share personal data only as follows:

1. Subprocessors. The launch plan includes Amazon Web Services, Stripe, Resend. The complete planned register is on our Subprocessors page.
2. Within your workspace.Other Users in your Customer's workspace, subject to the access controls your administrator configures.
3. Legal compliance. Authorities, courts, or regulators when we are legally required to disclose. Where lawful, we will notify the affected Customer.
4. Corporate transactions. Counterparties to a merger, acquisition, financing, or sale of substantially all assets — subject to the same protections as in this policy.
5. With your consent. Anything else, with your prior consent.

We do not sell personal data.We do not sell or share personal data for cross-context behavioural advertising as those terms are defined under CPRA. California residents have no “Do Not Sell or Share” signal to send because we do not sell or share.

Pre-release provider status. Osyra has not launched a production service or placed production Customer Content with these providers. This register documents the engineering launch data-flow plan; every provider remains subject to security, privacy, and contract review before activation.

Before a production route transfers personal data out of its country of origin, the applicable customer agreement must establish a lawful transfer mechanism and required supplementary measures. The pre-release DPA package provides for the European Commission's Standard Contractual Clauses and UK transfer terms where applicable.

We retain personal data for as long as needed to provide the Service and as required by law. The launch policy targets the following defaults, subject to the executed Order Form and workspace controls:

1. Account and billing records — 7 years from account closure (audit / tax).
2. Audit logs and security receipts — 7 years (compliance: SOC 2 retention, EU AI Act Art. 12 records).
3. Customer Content — for the duration of the subscription, then deleted from production within 30 days of termination (subject to backup-cycle delays).
4. Usage telemetry — aggregated indefinitely; per-request rows pruned after 90 days.
5. Support tickets — 3 years after last activity.
6. Marketing contact data — until you unsubscribe, then archived for 18 months for suppression-list purposes.

We aim to be cookieless on our public website. The launch plan uses Plausible only for aggregate public-site analytics, not the authenticated console or Customer Content.

In the authenticated dashboard we set a small number of strictly necessary cookies for session management, CSRF protection, and accessibility preferences (e.g. theme). We do not use advertising or cross-site-tracking cookies anywhere in the Service.

We maintain a documented security programme aligned with SOC 2, GDPR Article 32, and the EU AI Act. Detailed controls are described on our Security page. In the event of a personal-data breach affecting your data, we will notify you without undue delay and in accordance with applicable law.

Depending on your jurisdiction, you may have rights to:

1. access the personal data we hold about you;
2. correct inaccurate personal data;
3. request erasure (the “right to be forgotten”);
4. request a portable copy of your personal data;
5. object to or restrict certain processing;
6. withdraw consent where our basis is consent;
7. not be subject to solely automated decision-making with legal effect;
8. lodge a complaint with your supervisory authority (in the EEA / UK) or your state attorney-general (in the United States).

If you are an end-User configured by a Customer administrator, please direct your request to that administrator first; we will assist them in fulfilling it.

To exercise a right, email dpo@osyra.ai. We acknowledge and respond within 30 days (extendable to 90 days for complex requests), and fulfil verified requests through our data-subject-request handling while direct self-serve tooling is being delivered. We may ask you to verify your identity before responding.

The Service is not directed at, and we do not knowingly collect personal data from, individuals under 16. If you believe we have collected such data, please email dpo@osyra.ai and we will promptly investigate and take the action required by applicable law.

We may update this Privacy Policy. Material changes are posted on this page with a new “Last updated” date and, for Customers, notified to the primary account contact at least 30 days before they take effect. We will not retroactively degrade your privacy rights without your express consent.

Data-protection inquiries: dpo@osyra.ai. Other privacy questions: legal@osyra.ai.