How we handle data
Written for the person who has to sign it off, not the one who wants to skip it. If your compliance team needs this as a PDF or a signed DPA, ask and you’ll have it the same day.
The short version
Your records are yours. They live in an account in your name wherever that is possible, you can export everything at any time, and when you leave, they go with you. Nothing is designed to make leaving expensive.
Where things live
Systems we build for you are hosted under your own accounts where the platform allows it. Where we host on your behalf, data is kept in UK or EU regions unless you tell us otherwise in writing.
Who processes what
For this website and for the systems we run, these are the companies that touch data, and why. Each has its own data processing terms, which we can supply on request.
- Vercel
- Hosts this site and runs its serverless functions.
- Anthropic
- Powers the site assistant. Conversations are sent to answer your question and are not used to train models.
- Resend
- Delivers contact-form enquiries to our inbox.
- Google Workspace
- Our email and documents.
For client systems, the list is written into your scope before anything is built, and changes need your sign-off.
How long we keep it
Contact enquiries: twelve months, then deleted. Assistant conversations on this site: stored in your browser only, never on our servers. Client system data: for as long as your plan runs, then exported to you and deleted within thirty days of cancellation unless you ask us to hold it longer.
Your rights
Access, correction, deletion, portability and objection, as set out in UK GDPR. Email hello@ostfro.com and we respond within five working days. No forms, no portals.
What we won’t do
Sell data. Share it with anyone not listed in your scope. Train anything on it. Keep it after you’ve gone.