Privacy Policy

01Who we are

OSIO is operated by OSIO Ltd, a company registered in England and Wales under company number 17463838. Our registered office is 9 Devon Road, Redhill, United Kingdom, RH1 3EU.

For the purposes of UK data protection law, OSIO Ltd is the controller of the personal information described in this policy.

You can contact us about privacy or data protection at support@osio.app.

02What this policy covers

This Privacy Policy explains how we collect and use personal information when you visit osio.app, use the guided landing-page demonstration, join the OSIO waitlist, contact us, or ask for information about OSIO.

It covers the public OSIO website, waitlist and related communications and, where access is offered, Owner Alpha, related account and service administration, Work and configured connected services. Additional product-specific or data-processing terms may apply to future services or where OSIO processes personal information on behalf of an organisation. We will provide those terms before the relevant processing begins.

03Information we collect

We may collect information you give us directly, including your email address, name, company or role where requested, your communication preferences, and the contents of messages or enquiries you send to us.

Our hosting and security providers may receive limited technical information when you visit the website, such as your IP address, browser and device type, operating system, referring page, timestamps, requested pages, and security or diagnostic logs.

We do not ask you to provide special category information through the website or waitlist.

For Owner Alpha, we may also process information needed to establish and administer authenticated access, associate the Owner with the correct organisation, maintain sessions, manage access status and provide support. This may include a name, business email address, organisation relationship, authentication and session identifiers, access records and support communications. OSIO does not receive or store your Google Account password.

OSIO persists Work and related operational records so that delegated responsibilities can continue across sessions and restarts. These records may include instructions, authority and approval status, Needs You decisions, Evidence, Results, timestamps and identifiers needed to associate records with the correct Owner and organisation. Depending on the Work, they may contain personal information provided by the Owner, their organisation or an authorised connected service.

Information from a connected service comes from the service that the Owner authorises OSIO to connect, such as Gmail, and from actions and bounded observations made while carrying out authorised Work.

04The guided demonstration

The landing-page chat answers product questions with curated responses and can run guided simulations using fictional examples. Questions are matched in your browser using fixed topics and synonyms; the chat is not connected to a live AI service, does not access accounts, and does not take external actions.

Text entered in the landing-page chat is processed only in your browser for the duration of the page session. It is not sent to OSIO or our providers, added to the waitlist, stored or logged by us. Please do not enter confidential, personal or commercially sensitive information.

05How and why we use personal information

We use personal information to operate and secure the website; administer the waitlist; send information you have requested; respond to enquiries; prevent misuse and security incidents; establish or defend legal rights; and comply with legal obligations.

Our lawful bases depend on the activity. We rely on your consent where you ask to join the waitlist or receive optional marketing. We rely on legitimate interests to respond to enquiries, operate and improve the website, and protect our systems and business. We may rely on steps requested before entering a contract where your enquiry concerns a potential service, and on legal obligation where the law requires processing.

Where we rely on legitimate interests, we consider whether those interests are necessary and balanced against your rights and reasonable expectations.

For Owner Alpha, we use personal information to provide, administer, secure and support the supervised service; carry out authorised Work; maintain reliable operational records; present Needs You decisions, Evidence and Results; and investigate or resolve security, support and legal issues.

Depending on the circumstances, we rely on steps requested before entering an Alpha arrangement or performance of that arrangement, our legitimate interests in operating and securing Owner Alpha, and legal obligations. Where OSIO processes personal information solely on behalf of an Owner’s organisation and under its instructions, OSIO may act as a processor rather than a controller. The applicable Alpha arrangement will describe those roles.

06Waitlist and email communications

If you join the OSIO waitlist, we record your signup and use your email address to administer the waitlist and send launch and early-access updates by email.

Where consent is required for broader promotional email, we will ask for it separately. You can withdraw consent or leave the waitlist at any time by using the unsubscribe method in an email or contacting support@osio.app.

Withdrawing consent does not affect processing that took place before withdrawal, or messages necessary to respond to something you specifically requested.

07Website analytics

OSIO does not currently use website analytics or record interaction events.

08Who we share information with

We may share personal information with trusted service providers that help us operate OSIO, including website hosting and infrastructure providers, database and waitlist providers, email delivery providers, security and technical service providers, and professional advisers.

These providers may process information only for authorised purposes and under appropriate contractual obligations. We may also disclose information where required by law or reasonably necessary to protect legal rights, our systems, our users or others.

We do not sell personal information.

When an Owner authorises OSIO to use a connected service, we exchange only the information needed to perform and verify the authorised function with that service. For Gmail, this means communicating with Google through the Gmail API. The connected service remains governed by its own terms and privacy practices.

09Gmail and Google API data

Owner Alpha currently requests only these Gmail permissions:

• Send email (gmail.send): permission to send authorised emails on the Owner’s behalf.
• View email metadata (gmail.metadata): permission to access metadata such as message identifiers, labels and headers where needed for bounded provider observation and readback. This permission does not grant OSIO access to Gmail message bodies.

OSIO uses these permissions only to provide the connected functionality authorised by the Owner: carrying out a governed email action and making bounded metadata-level observations needed to determine what actually happened. OSIO does not use gmail.metadata to scan the mailbox generally or to perform automatic commitment extraction.

OAuth access and refresh tokens are handled server-side. They are not Google passwords and are used only to make permitted requests through the governed Gmail connection.

OSIO does not sell Google-derived user data, use it for advertising or creditworthiness decisions, or use it to train or improve general-purpose AI or machine-learning models.

OSIO personnel will not access Google-derived user data unless the Owner has affirmatively agreed to access specific data for support, access is necessary for security or legal compliance, or the data has been aggregated and anonymised for lawful internal operations.

OSIO’s use of information received from Google Workspace scopes will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting Gmail

The Owner can stop using OSIO and can ask OSIO to revoke or rotate the server-side Gmail grant by contacting support@osio.app. A Google Account user can also remove OSIO’s access through their Google Account’s connected-app permissions.

Once revocation is effective, OSIO cannot make future Gmail API requests using that grant. Revocation does not recall or delete emails already sent, and it does not automatically delete historical Work, Evidence or Results already created through lawful prior activity. Deletion of OSIO-held personal information can be requested separately through support@osio.app.

10International transfers

Some service providers may process personal information outside the United Kingdom. Where this is a restricted international transfer, we will use an appropriate safeguard recognised by UK data protection law, such as UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum, together with any additional assessment or safeguard required.

You may contact us for more information about safeguards relevant to your information.

11How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected. In deciding the period, we consider the nature of the information, the ongoing purpose, security needs, legal and regulatory requirements, limitation periods and whether the information can be deleted or anonymised.

Waitlist information is normally kept while the waitlist is active and for a reasonable period afterwards so we can manage access and honour communication preferences. Enquiry records and limited security logs may be retained where needed to respond, maintain security, resolve disputes or establish legal claims.

Owner Alpha Work and related operational records are designed to persist so that delegated responsibilities survive sessions and restarts. We keep them only while needed to provide and secure Owner Alpha, maintain accountable records of authority, Evidence and Results, resolve disputes, establish or defend legal rights, or meet legal obligations. We review whether they remain necessary and delete or anonymise personal information when it is no longer needed.

Disconnecting Gmail or revoking its access does not by itself delete historical OSIO records. An Owner can request deletion through support@osio.app. We will act where required by law, although limited information may be retained where it remains necessary and lawful for security, operational accountability, legal obligations or legal claims.

If you leave the waitlist or ask us to delete information, we will act where required by law. We may retain a limited suppression record so we can respect an opt-out, or information required for legal obligations and claims.

12Security

We use appropriate technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. No internet-based service can guarantee absolute security.

13Your data protection rights

Depending on the circumstances, you may have rights to access your personal information; correct inaccurate or incomplete information; request deletion; restrict processing; object to processing; receive certain information in a portable format; and withdraw consent where we rely on consent.

Some rights apply only in particular circumstances and may be subject to legal exceptions. To exercise a right, email support@osio.app. We may need to verify your identity before responding.

Your right to object: you may object to processing based on legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing.

14Automated decision-making

We do not currently use personal information collected through the public website or waitlist to make solely automated decisions that produce legal or similarly significant effects.

15Complaints

If you have a concern about how we use personal information, please contact support@osio.app so we can investigate.

You also have the right to complain to the UK Information Commissioner’s Office. Information about making a complaint is available at ico.org.uk/make-a-complaint/.

16Children and third-party websites

OSIO is a business service and the website is not directed at children. We do not knowingly seek to collect children’s personal information through the waitlist.

The website may link to services operated by other organisations. Their handling of personal information is governed by their own privacy notices, and we are not responsible for services we do not control.

17Changes and contact

We may update this policy as OSIO develops or legal and operational requirements change. We will update the date shown above and provide additional notice where appropriate.

Questions about this policy or your personal information can be sent to: