Terms of Service

Version: terms-2026-10-12-v1 Effective date: 12 October 2026 Status: published

1. Parties and acceptance

These terms are between Orsta Ltd, a company registered in England and Wales with company number 17403586 and registered office at Suite RA01, 195-197 Wood Street, London, United Kingdom, E17 3NU (“Orsta”), and the business named during owner onboarding (“Customer”). They govern Customer's use of the Orsta financial reporting service (“Service”).

The person accepting these terms confirms that they are at least 18, are acting for business purposes and have authority to bind Customer. The Service is not offered for personal or consumer use.

Acceptance also incorporates the Data Processing Agreement (“DPA”). The Privacy Notice is acknowledged separately and is not a request for data-protection consent. If there is a conflict, the DPA prevails for processing of Customer Personal Data, followed by these terms.

International use

The Service is available to business customers internationally, subject to applicable law and any restrictions notified by Orsta. Customer must provide an accurate country in which its business is established and notify Orsta if that information changes.

Customer must ensure that its use of the Service, including sending Customer Data to the processing locations described in the Privacy Notice and Subprocessor List, complies with laws and contractual obligations applicable to Customer.

Customer must not submit data that requires storage or processing arrangements which the Service does not provide, unless Orsta has agreed suitable arrangements in writing.

Orsta may request information reasonably needed to confirm Customer's eligibility and may refuse or restrict access where reasonably necessary to comply with applicable law, sanctions or binding provider restrictions.

These provisions do not limit Orsta's obligations under applicable law or the Data Processing Agreement.

2. Trial and subscription

A new Customer may receive a 14-day free trial for one company. No payment method is required to start the trial. The trial begins when the organisation is created and ends at the recorded expiry time.

The trial does not convert to paid access unless an organisation owner affirmatively accepts the paid subscription and its price. A paid subscription renews monthly until cancelled under section 10.

During an active trial or paid subscription, Orsta grants Customer a non-exclusive, non-transferable right for its authorised users to use the Service for Customer's internal business purposes. Customer may not transfer, resell or sublicense this right.

3. Charges, companies and invoices

Paid access costs £18 per organisation per month and includes one company. Each further company costs £9 per month. Prices are in pounds sterling. Orsta does not currently charge VAT. VAT or another tax may be added where legally required.

Orsta invoices monthly in arrears. The first paid billing period begins when Customer accepts paid access, unless the acceptance screen states another start date. Payment is due 14 days after the invoice date using the payment instructions on the invoice.

A company is charged for the full billing period if it is added or active at any time during that period. Charges are not prorated. Before creating a further company, an organisation owner must accept the displayed increase to the next invoice and ongoing monthly charge.

Archiving or removing a company does not remove a charge already accrued. The reduction applies from the next billing period. Reactivating the same company during a period for which it was already charged does not create a second charge.

Orsta may change prices by giving at least 30 days' notice. An increase applies no earlier than the next billing period after the notice period. Customer may cancel before the increase takes effect.

Customer must provide accurate billing information and pay undisputed invoices when due. Customer must raise a good-faith invoice dispute promptly and still pay any undisputed amount.

4. Accounts and authorised users

Customer must:

• provide accurate business, billing and user information;
• invite only people authorised to act for it;
• keep credentials confidential and use reasonable account security;
• promptly disable access that is no longer required;
• notify Orsta promptly of suspected unauthorised access; and
• remain responsible for its authorised users and their compliance.

Accounts may not be shared. Orsta may rely on instructions from the owner and administrators acting within their permissions.

5. Customer responsibilities and acceptable use

Customer is responsible for its source records, accounting judgements, mappings, formulas, commentary, reports, exports and decisions made using the Service. Customer must review outputs through a suitably qualified person before relying on or distributing them. The Service is software and does not provide accounting, tax, legal, investment or other professional advice.

Orsta-provided templates are starting points. Customer must check their suitability, mappings, formulas and outputs before use.

Customer must not, and must not permit anyone to:

• use the Service unlawfully or infringe another person's rights;
• upload data without authority or more personal data than is necessary;
• upload special-category, criminal-offence or children's data unless Orsta has expressly agreed an appropriate arrangement in writing;
• upload malware or harmful code, probe security, bypass access controls, or disrupt or place unreasonable load on the Service;
• access another customer's data or help another person do so;
• reverse engineer or copy the Service except where law cannot prohibit it;
• resell, sublicense or make the Service available as a standalone service; or
• use the Service to build or benchmark a competing product without written permission.

Customer must keep independent copies of source records and any exports it needs. Downloaded reports and exports are controlled by Customer.

Accounting integrations

Customer may authorise supported connections to Xero or QuickBooks Online. Customer must have authority over the selected accounting organisation and its data, and comply with the provider's terms. Provider permission is given on that provider's website. The current integrations read accounts and trial balances; they do not post accounting transactions. Only one accounting provider may be connected to each Orsta company at a time.

Customer must check the selected organisation, report dates, imported figures and mappings. Provider availability, permissions, token expiry, connection limits and API limits can affect imports. Reconnection may be required. Disconnecting stops further use of that connection once completed, but does not delete previous imports or change the source accounting records.

AI clients and MCP

Customer may authorise a supported AI client, such as ChatGPT, to use Orsta through MCP. This is separate from authorising an accounting connection. The client can access data and carry out supported actions within the connected user's current permissions. This can include imports, account mappings, report and component definitions, evaluated figures and report text. Authorisation can remain active independently of the user's browser session.

Not every action requires separate approval. Clean imports, new account assignments and supported report or component definition changes can be saved without another confirmation. Imports with warnings or replacement data and protected mapping changes require the review specified by the Service. Where approval is required, the user must approve the exact stored proposal through the supported review interface. A statement generated by an AI client is not a substitute for that approval.

Customer must review AI-generated instructions, mappings, commentary and outputs before reliance. Connecting a client authorises Orsta to disclose the data needed for its permitted requests to that client. Customer is responsible for selecting the AI service, checking its data-use and retention settings, and ensuring authority for that disclosure. The AI provider's own agreement applies. Removing the connection does not delete information already received by the AI provider; ordinary browser sign-out does not revoke it.

Customer must not use data obtained from Xero's APIs, including processed or derived data, to train, fine-tune, adapt or enhance AI or machine-learning models, or permit a connected AI service to do so. Customer must comply with any other applicable accounting-provider restrictions on disclosure and AI use.

6. Customer Data and data protection

“Customer Data” means data submitted to, stored in or generated from the Service for Customer, excluding Orsta's software, general service telemetry and data for which Orsta is independently controller.

Customer retains its rights in Customer Data and gives Orsta and its subprocessors a limited right to host, copy, transmit, transform and otherwise process it only to provide, secure, support and administer the Service, follow Customer's documented instructions and comply with law.

Customer is responsible for giving required notices, selecting a lawful basis, honouring individuals' rights and having authority to provide Customer Data. Orsta's processor obligations are in the DPA. Orsta remains controller for prospect, account, billing, security, support and administration data as described in the Privacy Notice.

Primary application data is hosted in the United Kingdom and European Union. This does not mean that all processing remains in those locations. Delivery, security, email, administration and support providers may process data in other countries as described in the Privacy Notice, DPA and Subprocessor List. Customer-authorised AI clients may also receive and process Customer Data in other countries under their own terms and settings. Unless agreed in writing, Orsta does not provide a customer-selected hosting region or country-specific data residency.

7. Confidentiality

Each party must protect the other party's non-public business, technical and financial information using at least reasonable care, use it only for this agreement, and disclose it only to people who need it and are bound by confidentiality.

This does not apply to information that the recipient can show was lawfully known without restriction, becomes public without breach, is received lawfully from a third party, or is independently developed. A legally required disclosure is permitted after advance notice where lawful and practicable.

On request or termination, each party will return or delete confidential information when reasonably practicable, subject to this agreement, backups and legal retention. Trade-secret obligations continue while the information remains a trade secret. Other confidentiality obligations continue for five years after termination.

8. Intellectual property and feedback

Orsta and its licensors own the Service, software, designs, documentation, branding and improvements. No rights are granted except the limited right in these terms.

Customer owns Customer Data and its own materials. If Customer provides feedback, it grants Orsta a perpetual, worldwide, non-exclusive, transferable, royalty-free right to use and incorporate that feedback without identifying Customer publicly. This does not permit Orsta to disclose Customer's confidential information.

Orsta may use aggregated or de-identified information that does not identify Customer or an individual to operate and improve the Service, subject to applicable source-provider restrictions. This does not permit use of Xero API data to train, fine-tune, adapt or enhance AI or machine-learning models.

9. Availability, changes and support

Orsta will provide the Service with reasonable care and skill. Orsta does not promise uninterrupted or error-free availability and does not provide a service-level agreement unless agreed separately in writing.

Orsta may change features, limits and integrations to maintain, secure or improve the Service. Orsta will give reasonable notice where a change would materially reduce the core paid Service, unless an urgent security, legal or operational reason prevents advance notice.

10. Cancellation, expiry and suspension

Customer may cancel at any time. Cancellation takes effect at the end of the current billing period. Charges already accrued remain payable. Orsta does not provide partial-period refunds or credits, except for a billing error, a legal requirement or a remedy that Orsta agrees for a service failure.

When a trial expires without paid acceptance, or a paid subscription ends, the organisation becomes read-only for 30 days. During that period, authorised users may view existing data and export reports, but may not import data, make changes, run new reports or create companies. Orsta then suspends access and deletes production Customer Data under section 11 unless Customer starts or restores paid access.

If an invoice remains unpaid after its due date, Orsta may make the organisation read-only. If it remains unpaid 30 days after the due date, Orsta may terminate the subscription. The 30-day export period then applies.

Orsta may suspend or terminate access immediately where reasonably necessary for security, law, suspected misuse or material breach. Where the problem can be corrected, Orsta will give Customer a reasonable opportunity to correct it when circumstances permit.

Either party may terminate immediately by notice if the other party commits a material breach and does not correct it within 14 days after receiving notice, or becomes insolvent or stops carrying on business. A correction period does not apply where the breach cannot be corrected.

11. Return, retention and deletion

During active and read-only access, Customer may use the available export functions. Customer may also request an organisation export during the 30-day period after termination. Orsta will then delete production Customer Data, except for narrow legal, security or dispute holds.

Daily database backups have a seven-day retention period. After production deletion, copies in those backups expire through that cycle. Backups are isolated from ordinary use. The operational target for removing any remaining backup copy is within 90 days after production deletion, subject to a required legal hold. If a backup is restored, Orsta will apply the deletion again.

Orsta may retain invoices, payment records, agreement evidence and other records required for tax, accounting, legal or dispute purposes. These records do not permit continued product use of deleted Customer Data.

12. Warranties and disclaimers

Each party confirms that it has authority to enter this agreement. Orsta warrants that it will provide the Service with reasonable care and skill.

Subject to that warranty and to the fullest extent permitted by law, the Service is provided as available. Orsta does not promise that the Service or its outputs will be complete, accurate, uninterrupted or suitable for Customer's regulatory or professional obligations. Nothing in these terms limits obligations that cannot lawfully be excluded.

13. Liability

Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, breach of a term implied by law that cannot be limited, or any other liability that cannot lawfully be excluded.

Subject to that:

• neither party is liable for indirect or consequential loss, or for loss of profit, revenue, anticipated savings, goodwill or business opportunity; and
• each party's total aggregate liability arising from the Service and these terms is limited to the greater of £1,000 and the fees paid or payable by Customer for the Service during the 12 months before the event giving rise to the claim.

Loss or corruption that Customer could reasonably have avoided by retaining source records or exports is excluded. The limitations apply to all causes of action to the extent permitted by law.

14. General

Neither party is liable for delay caused by events beyond its reasonable control, but affected obligations must resume as soon as reasonably possible.

Customer may not assign these terms without Orsta's written consent. Orsta may assign them as part of transferring the Service, provided Customer's protections are not materially reduced.

Notices may be sent to the owner or billing email, or to the Orsta addresses stated in these terms. A failure to enforce a term is not a waiver. If a term is unenforceable, it will be adjusted only as far as necessary and the remainder continues. These terms and the incorporated documents are the entire agreement about the Service. No person other than the parties has rights under the Contracts (Rights of Third Parties) Act 1999.

Orsta may update these terms by publishing a new version and giving appropriate notice. A material change to Customer's payment obligations or a material reduction in Customer's protections requires renewed agreement or another lawful contractual basis before it binds Customer.

These terms and non-contractual disputes are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Contact: support@orsta.app
Address: Suite RA01, 195-197 Wood Street, London, United Kingdom, E17 3NU