Oshy Role Bots · Terms of Service · Privacy Notice · Data Processing Agreement · Subprocessors
Last updated 4 November 2026
OSHY LABS LTD (trading as Oshylabs) is a private limited company registered in England and Wales, company number 16883720, registered office 100 St Pier Court, 549 Green Street, London E13 9GU, United Kingdom. We provide Oshy Role Bots, a business-to-business web application. We are registered with the UK Information Commissioner's Office, reference C1892619.
This notice explains how we use personal data when we decide why and how it is used (as a controller): your account, how you use the service, security logs, and our website.
It does not cover content that our business customers put into their workspaces (for example job ads, documents and bot outputs). For that content, the customer is the controller and we process it on its behalf under our Data Processing Agreement. If your data is in a customer's workspace, please contact that customer first. We will pass on any request we receive.
Contact for privacy questions: support@oshylabs.eu
| Data | Examples | Purpose | Lawful basis (UK GDPR / EU GDPR Art. 6) |
|---|---|---|---|
| Account data | Name, work email, company and workspace name, role in the workspace, password hash (we never store your password itself) | Create and run your account, let you log in, manage roles, send password-reset and invite emails | Contract with the customer you work for; for users who are not the contracting party, our legitimate interest in providing the service the customer has bought |
| Security and authentication data | Session records (stored as hashes), login attempts, account lockouts, IP address used for rate limiting | Keep accounts and the service secure, prevent abuse | Legitimate interests (security of our service and our customers' data) |
| Audit log | Which user performed which action, when, with record ids (no content) | Accountability for actions such as approvals, key changes and role changes | Legitimate interests (accountability and security) |
| Usage records | Token counts and estimated cost per bot run, linked to the workspace | Spend limits and usage dashboard | Contract; legitimate interests |
| Operational logs | Request ids, errors and timings, with secrets and content redacted | Run, debug and secure the service | Legitimate interests |
| Business contact and support | Emails you send us, contract and billing contact details | Answer questions, manage the contract, billing | Contract; legal obligation (accounting records); legitimate interests |
| Website data | Standard server logs kept by our hosting provider (IP address, time, request path). The app uses no analytics or advertising tools | Security and operation of the website | Legitimate interests |
We do not use your personal data for automated decisions that have legal or similarly significant effects on you. We do not sell personal data. We do not use it to train AI models.
The app sets one strictly necessary cookie that keeps you signed in (httpOnly, secure). It is needed for the service to work, so no consent banner is used for it. We set no analytics or advertising cookies.
Your API key and bot requests are sent to Anthropic only under your organisation's own Anthropic account. Anthropic's handling of that data is governed by your organisation's agreement with Anthropic.
Our application runs and our database is stored in Stockholm, Sweden. Our hosting providers are US companies and may access or process some data, such as operational logs, outside the UK and EEA. Where that happens, the transfer is covered by the providers' data processing terms, which use the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or another mechanism recognised by UK and EU law.
| Data | Retention |
|---|---|
| Account data | While the account is active, then up to 30 days after the workspace is deleted or the user is removed |
| Audit log | For the life of the workspace; deleted with it |
| Security and session data | Sessions expire after 12 hours; other security records up to 12 months |
| Usage records | For the life of the workspace; deleted with it |
| Operational logs | As kept by our hosting provider, up to 30 days |
| Backups | Up to 30 days |
| Contract and billing records | 6 years |
| Platform alerts | Contain ids and counts only; kept until acknowledged and pruned |
When a workspace owner deletes a workspace, all workspace records are deleted immediately. Any copies in backups are removed when backup retention expires.
Depending on where you are and the basis we rely on, you have the right to: access your data; correct it; have it erased; restrict or object to our processing (including processing based on legitimate interests); data portability; and withdraw consent where we rely on consent.
To use these rights, contact support@oshylabs.eu. We will respond within one month, which may be extended where the law allows. We may need to confirm your identity.
You can complain to a data protection authority. In the UK: the Information Commissioner's Office (ico.org.uk). In Sweden: Integritetsskyddsmyndigheten (imy.se). In other EU countries: your local supervisory authority. We would appreciate the chance to resolve your concern first.
We use measures including encryption of stored API keys and tokens, database-level separation between customer workspaces, role-based access, hashed passwords and session tokens, and an append-only audit log. No system is fully secure.
If you are in the EU and have a question about this notice, contact support@oshylabs.eu. If we appoint a representative in the EU, we will name them here.
We will update this notice when our processing changes and change the "last updated" date. We will tell account holders about material changes.