Last updated 8 October 2026 · Ospry Suite Ltd, registered in the UK, company number 17455389
Ospry Suite Ltd, registered in the UK with company number 17455389, registered office 7 Walnut Way, Leicester, LE8 5TJ, runs the service. It is the data controller for its own records described here, and acts for its customers when it holds their clients' and website visitors' data. Registered with the Information Commissioner's Office, reference ZC246894. Contact: hello@osprysuite.com. Ospry is provided for business and professional use.
Agency users can access information for the locations and sites they are authorised to manage. Restricted client users can access only the sites and information assigned to their account: their own monthly updates, reports the agency has chosen to share, their requests, and, where the agency allows, their own website's chats. One client never sees another's, and one workspace never sees another's.
Ospry can connect to accounts you already own so it can read how you are doing and, where you ask it to, act on your behalf. Nothing connects on its own: every connection is a button you press, and the provider's own sign-in screen shows you exactly what is being asked for before you agree. We never see or store your password for any of them.
Ospry's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google APIs will adhere to that policy: it is used only to show you your own results and to do the things you asked for, it is never sold, never used for advertising, never used to train or improve any machine-learning or AI model, and no person at Ospry reads it except to fix something you asked us to look at or where the law requires it.
Permission by permission, each Google permission is used for this and nothing else:
You can see and remove Ospry's access to your Google account at any time at myaccount.google.com/permissions, or from Connections inside Ospry, which deletes the stored tokens straight away. Figures already pulled into your reports stay with that site until you delete the site or your workspace. Where Ospry works with YouTube it uses YouTube API Services, so the YouTube Terms of Service and Google's Privacy Policy also apply to those parts.
If your agency installs Ospry from the HighLevel marketplace, HighLevel gives Ospry an agency connection and one for each sub-account the app is installed on. Ospry only reaches those sub-accounts, and only within the permissions granted at install: reading account details so each client can be set up and linked to its website, reading and writing contacts, opportunities and notes, reading custom fields, and sending messages from the CRM (for example the text confirming a callback booked through Cue). Opening Ospry from inside the CRM passes us your name, email, role and the account you are in, so we can sign you in to the right place. Uninstalling the app clears those connections' tokens.
Before a visitor makes any choice, the Cue script makes one call to our server with the site key and the page address so it knows how to show itself; nothing about the visitor is stored from that call, and their IP address is used only in memory to limit abuse. The Cue scripts are delivered from osprysuite.com, whose web server keeps an access log of requests (which can include the IP address, browser description, referring page and full address requested); that log is kept for a limited period and rotated, and is used only to run and secure the service.
Cue's activity tracking only runs for visitors who have agreed to it on your site. After they agree, Cue stores a small identifier in the visitor's browser local storage (not a cookie) so it can recognise activity from the same browser, including return visits. It does not use that identifier to record the visitor's IP address, device type or an advertising profile.
It records page views by the kind of page (general, service, gallery, area, quote, pricing or booking), starting a quote form (the form's name, never what was typed), tapping a phone number, clicking out to a booking page, staying on a service page long enough (about 18 seconds) to count as reading it, and a return visit. It does not store exact time on a page, visit length, where the visitor came from or which page they left from. We record when the Cue tracking record was created, which is after the visitor agreed.
From that, Ospry shows the business aggregated activity: visits, page views, pages per visit, returning visits, commonly viewed pages, the pages visits started on, and those actions. It is not equivalent to a full analytics tool.
A conversation holds what the visitor typed, any name or contact details they chose to give, callback details if they booked one, photos they sent, and the page they were on. The people authorised for that site can read it and reply: the agency, and the business itself where the agency allows. A chat is separate from activity tracking: by default a visitor can chat whether or not they agreed to tracking, and what they write and any contact details they give are kept so the business can reply. A site can instead ask first, and then nothing the visitor types, sends or books is kept until they agree to the chat being kept. Messages are sent, as typed, to our AI provider to write the reply.
By default, activity records are kept for 30 days, conversations for 12 months from the last message, and chat photos for 90 days, and a visitor is removed, with everything recorded against them, 12 months after they were last seen. The business can set shorter or longer periods within the limits Ospry allows. Everything goes straight away if the site or workspace is deleted. Copies of chat alerts we emailed are kept in our email log with no automatic time limit yet; those sent to a workspace's own logins go when the workspace is deleted, and any others are deleted on request. A visitor can withdraw their agreement using the site's privacy choice, which removes the identifier from their browser and deletes their activity records; there is no button inside the chat that deletes a conversation, so they can ask the business or us.
Some Ospry features use Anthropic's Claude models to generate text, including Cue's replies to website visitors, content drafts, Ask Ospry answers, keyword briefings, suggested page titles and descriptions, and wording for demo websites. Depending on the feature, the request may contain business details, public website content, notes you have entered, audit or keyword information, and messages a website visitor types into Cue, including any contact details they choose to type.
Data received from connected Google APIs is not included in prompts sent to Anthropic.
These features run on Ospry's own Anthropic account, or on your own Anthropic API key if you connect one in Connections; disconnecting it returns them to Ospry's account. Anthropic states that inputs and outputs from its commercial and API services are not used to train its models by default. Anthropic may process API requests using infrastructure in multiple regions. It states that API data storage is in the United States by default, and that standard API inputs and outputs are normally deleted from its backend within 30 days, subject to its contractual, safety and legal exceptions.
We send service emails, not marketing: sign-in and password messages, invitations, billing notices, alerts about chats and bookings on a site you look after, weekly summaries, and monthly updates an agency chooses to send its client. They go through our email provider (Brevo), which carries the whole message, including any visitor details in an alert. Our mail system records that a message was handed over for sending; it cannot confirm it reached the inbox. Clients can switch chat and booking emails off from their own page. Marketing email only goes to people who ticked the separate box at signup, and can be stopped at any time: reply to any marketing email or write to hello@osprysuite.com.
If you turn on alerts on a phone or computer, your browser gives us a push subscription (an address at your browser's push service and encryption keys), which we store against your login and use only to send you those alerts. Alerts can contain a site's name and the name or contact details a visitor gave. They are encrypted to your device, so the push service run by your browser's maker (for example Google, Apple, Mozilla or Microsoft) delivers them without being able to read them, though it can see that an alert was sent. Turn them off on the same page or in your browser settings.
Anyone can check a website with our audit tool without giving any personal details. To open the full report, you give an email address. We keep that email, the website, its findings, when you asked, whether you ticked the optional box for tips and updates, and a hashed form of your IP address used only to limit how often the tool can be used. The report opens on the page; we do not email it to you.
Partners in our partner (affiliate) programme are selected and approved by a person. For applicants and partners we keep the details given when applying (name, email, business, website, how and where they would promote Ospry), our review notes, the agreement and the version of the terms accepted, and records of support and changes. For referrals we record which workspace a partner referred, how the referral was recorded (for example a code in the partner's link), and the qualifying payments used to work out commission. We check for self-referral using the account, workspace and email; we do not fingerprint devices or match people by IP address.
Partner tracking, commission records and payouts are handled through our affiliate platform provider, HighLevel, which may collect payout and tax details from partners directly. Ospry does not store bank or tax numbers. Partner details, agreements, referral and commission records are kept as legal and financial records, including after a referred workspace is deleted. Legal basis: contract with partners; legitimate interest in paying the right partner and preventing fraud; consent for the tracking cookie.
Inviting businesses to become partners. We invite a small number of businesses to join the partner programme. For limited companies and other corporate bodies we may send one message, and at most one follow-up, to a named person at the business, using their work email address or public business profile, to tell them about the programme. We get these details from the business's own website, its public business profile or a trade directory. We keep the person's name, job role, business, contact details, where we found them, the date we contacted them and the outcome, for up to 12 months from the last contact. We do not send unsolicited marketing about the programme to sole traders or other individuals unless they have agreed to it, they have asked us, or we already have a relationship with them. Every message says who we are and how to opt out. If you tell us you do not want to be contacted, we keep only a minimum record (for example a coded form of your email address) so that we do not contact you again. Legal basis: our legitimate interests in finding partners for the programme, which we have assessed in writing, and our legal duty to respect your objection. You can object at any time, or ask what we hold about you, by emailing hello@osprysuite.com.
Ospry's application and primary database run on a cloud server operated by IONOS in the United Kingdom. Some features use third-party providers, some in other countries, such as Anthropic for AI text, Stripe for payments, HighLevel for the CRM connection, our own customer records and the partner programme, Google for the accounts you connect and for some search and page-speed checks, OpenStreetMap for place lookups and the area map (map tiles load from OpenStreetMap's servers in your browser, so they see your IP address), and Brevo for sending email. The full list, with what each receives, is on the sub-processors page. If you connect a third-party service (for example WordPress or a CRM), data flows to that service under its own privacy terms; you can revoke it in Connections at any time.
We keep your data while your account exists. Deleting a site removes what was recorded for it straight away: audits, keyword history, reports, uploaded photos, Cue visitors, activity, chats, bookings and chat photos, monthly updates, work notes, requests, content drafts and its stored credentials. If the CRM app is installed on that client's account it stays installed there, no longer linked to the site. Deleting your workspace from Settings does the same for every site and also removes your logins, connected credentials, CRM connection tokens, API tokens, devices set up for alerts, Ask Ospry conversations and the copies of email we sent to your logins. A deleted workspace can remain in an encrypted backup until that backup is deleted (14 days on our server). Some records are not tied to a workspace and are not removed by deleting it: failed sign-in records (deleted within 90 days), copies of emails sent to other addresses, invitations, waitlist entries, public audit tool requests, our own customer record of you, and payment and referral records kept as financial records. Anything you want gone, email hello@osprysuite.com and we will delete what the law does not require us to keep.
Under UK GDPR you can ask us for a copy of your data, ask us to correct or delete it, or complain to the ICO (ico.org.uk). The export button in Settings gives you your account, your team, sites, audits, keywords, reports, requests, monthly updates, work notes, content drafts, Cue visitors, activity, chats and bookings, and Ask Ospry conversations straight away. Connected services are listed by what is connected, never by the passwords or tokens behind them.