Privacy Notice

Scope

This notice applies to Ossory's website, sign-in flow, workspace, and related support and security communications. It does not apply to a third-party website or service that you choose to visit or use under that provider's own terms and privacy notice.

Information we handle

• Account information. Name, email address, profile image, account identifiers, authorization status, and account settings.
• Authentication and security information. Sign-in activity, session and device information, IP address, browser type, security events, and access logs.
• Workspace content. Research queries, notes, records, source links, uploaded context, review decisions, generated output, and other content submitted to or created within the workspace.
• Business and professional information. Names, roles, organizations, business contact details, facilities, capabilities, and related source information obtained from authorized users, public records, government registries, websites, and other lawful sources.
• Technical information. Request metadata, referring pages, diagnostic information, performance data, and error records used to operate and protect the service.
• Communications. Information included in privacy, legal, support, or security inquiries sent to Ossory.

Where information comes from

We receive information from authorized users, account and security providers, the devices and browsers used to access Ossory, public and government sources, and service providers acting on our behalf. We do not purchase consumer marketing profiles.

How we use information

• Authenticate users, enforce authorization, and protect accounts and systems.
• Provide requested research, recordkeeping, source-management, and review functions.
• Preserve source provenance, verification history, and auditability.
• Maintain, troubleshoot, secure, and improve the reliability of the service.
• Comply with law and establish, exercise, or defend legal claims.

How we disclose information

We may disclose information to providers that support identity and authentication; hosting, databases, storage, security, and infrastructure; research, search, and AI functions; and professional advice. These providers receive information for the services they perform for Ossory and are subject to their agreements and applicable law.

We do not sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

Cookies, browser storage, and online tracking

Ossory uses cookies and similar technologies needed for authentication, session continuity, security, and service preferences. The workspace also uses local browser storage to retain mode preferences, synthetic workspace state, and research conversation state on the device. Blocking or clearing these technologies may prevent sign-in, remove locally retained state, or cause restricted functions to stop working.

Ossory does not currently use advertising or cross-site behavioral tracking technologies. We do not track visitors across unrelated websites for advertising, and we do not use our providers for that purpose. Because Ossory does not currently sell or share personal information for behavioral advertising or engage in that form of cross-site tracking, browser Do Not Track and Global Privacy Control signals do not change our present practices.

Automated processing and human review

Some workspace functions use automated systems and service providers to locate, organize, summarize, or propose information. Research queries, relevant workspace context, and generated output may be processed to provide those functions. Ossory does not currently use workspace content to train a general-purpose AI model.

Ossory is designed for human review. Automated output is not used by Ossory to make solely automated decisions that produce legal or similarly significant effects about individuals.

Government and legal requests

We may preserve or disclose information when we reasonably believe disclosure is required by applicable law, valid legal process, or a binding government request, or is necessary to protect rights, safety, or service integrity. Where legally permitted and appropriate, we seek to limit a request to information relevant to its stated purpose.

Retention

We retain information for as long as reasonably necessary for the purpose for which it was collected, including providing authorized access, maintaining workspace records, protecting the service, meeting legal obligations, and resolving disputes. Retention depends on the information category, the status of the workspace, provider settings, security needs, and applicable law. Deletion from active systems may not immediately remove information from security records or backups, which expire or are overwritten on their applicable schedules.

Security

We use administrative, technical, and organizational measures designed for the nature of the service and the information handled, including restricted account access, server-side secret handling, encrypted transport in hosted environments, and authorization controls around stored records. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Your choices and rights

Depending on applicable law, you may request access to, correction of, or deletion of personal information associated with you, and may have rights to obtain a portable copy, restrict or object to certain processing, or appeal a denied request. To submit a request, email the address below and describe your relationship to Ossory and the request. We may verify your identity or authority and may retain information where permitted or required for security, legal, or recordkeeping purposes. We will not discriminate against you for exercising an applicable privacy right.

International processing

Ossory and its service providers may process information in the United States and other countries where they operate. International processing is subject to provider agreements and applicable legal requirements.

Children

Ossory is a restricted business system, is not directed to children, and does not permit public registration. We do not knowingly collect personal information through the service from children under 13. If we learn that we have done so, we will take appropriate steps to delete it.

Changes to this notice

We may update this notice as the service, our practices, or legal requirements change. We will post the revised notice and update its effective date. When a material change affects authorized users, we may also provide notice through the workspace or by email.

Contact

Privacy questions and requests may be sent to privacy@ossory.app.