Privacy Notice

Version: privacy-2026-10-12-v1 Effective date: 12 October 2026 Status: published

1. Who we are

Orsta is a business software service operated by Orsta Ltd, a company registered in England and Wales with company number 17403586 (“Orsta”, “we”, “us” or “our”).

Registered office and contact address: Suite RA01, 195-197 Wood Street, London, United Kingdom, E17 3NU Privacy enquiries and requests: privacy@orsta.app

This notice explains how Orsta uses personal data as a controller. It applies to the Orsta website and service, signup, account and billing administration, support, security and business communications.

When a customer uploads financial, customer, supplier, staff or other content to the service, or imports it from a connected accounting provider, the customer normally decides why that content is used. The customer is then the controller and Orsta is its processor. That processing is governed by the Data Processing Agreement. People whose data appears only in customer content should normally contact the relevant customer first. We will assist that customer and will still deal separately with any data for which Orsta is controller.

2. Personal data we use

Depending on the relationship, we may use:

• name, work email, organisation, job title, role and contact details;
• signup, email-verification and invitation status and correspondence;
• authentication identifiers, account status, password-reset and confirmation status, session information and provider security records (Orsta does not receive the user's password);
• display name, organisation and company assignments, permissions, theme preference, last-seen time and account timestamps;
• organisation name, declared business country, billing email and address, billing country, trial, subscription, invoice, payment, company-entitlement and access status, billing acceptance, and administrative notes;
• support, complaint, rights-request and incident correspondence, including proportionate identity evidence where needed;
• IP address, user agent, requested URL and other request or security metadata;
• service activity, job identifiers, warnings, errors and audit context; and
• outreach source, professional interests, contact history, objections and suppression status.

We receive data from the person, their organisation or administrator, authentication and hosting providers, service use, correspondence, referrals, and public professional or company sources used for carefully targeted business outreach.

Customer content can include account codes and names, balances, ledger data, dimensions, dates, filenames, mappings, formulas, report commentary, company names and identifiers relating to staff, customers, suppliers or directors. Orsta uses that content only as processor except where law requires otherwise or where limited security evidence must be handled as controller.

Connected accounting services

If an authorised user connects Xero or QuickBooks Online, Orsta receives connection identifiers, the accounting organisation or company name, access and refresh tokens, token expiry and permission information. Orsta reads the chart of accounts and trial balances for the dates the user requests. Imported account names, codes, balances and dates become Customer Data. The current integrations read accounting data; they do not post transactions back to Xero or QuickBooks.

Authorisation takes place on the provider's own website. Orsta does not receive the user's Xero or QuickBooks password. Accounting tokens are encrypted in the application database and used by the backend to maintain authorised access.

AI clients and MCP

When a user connects an AI client, such as ChatGPT, through the Model Context Protocol (MCP), Orsta processes the authorised user and client identifiers, authorisation information, tool requests and results. Depending on the tools used, this can include company details, account mappings, imported balances, report definitions, evaluated figures, commentary, draft changes and approval records. Orsta can download an attachment selected by the user from an approved file host to prepare an import.

The connection operates within the user's current Orsta permissions. It can read data and make supported changes. Some changes require a separate review; not every write requires another confirmation. Orsta stores workflow and approval data, including proposed actions, decisions, timestamps and results, to execute and check those actions. It does not require the full chat history to operate the connection.

3. Why we use personal data

We do not use consent as the basis for providing the Service. If consent is ever used for an optional purpose, it may be withdrawn without affecting earlier lawful processing.

We do not use personal data for solely automated decisions that have legal or similarly significant effects.

4. Sharing and service providers

We disclose data only where needed to operate, secure and administer Orsta, to obtain professional advice, to comply with law, or in connection with a business reorganisation subject to appropriate protection.

The expected technology providers are described in the Subprocessor List. They include Supabase for authentication and database services, Railway for API and worker hosting, Cloudflare for website/application delivery, DNS, TLS and security, and Resend for authentication email. Google Workspace provides the monitored business mailbox used for privacy, support, sales and billing correspondence.

Organisation members may see other authorised users' names, work emails, roles and assignments where the product permits it. A customer controls disclosure of its own reports and exports after download.

Customer Data sent through the API passes through Cloudflare before reaching our application hosting provider.

Providers selected by the customer

Xero and Intuit (QuickBooks Online) supply the accounting data that the user authorises Orsta to read. Their own terms and privacy notices apply to the customer's accounts with them. Connecting an accounting provider does not automatically authorise a separate AI client to access Orsta.

When a user authorises an MCP client, Orsta sends requested tool results and related data to that client. Embedded review or report views can also display Customer Data in that client. This can disclose financial figures, company names, account details, report content and generated exports to the AI service. The AI provider handles the data under the customer's agreement, account settings and that provider's privacy notice. These customer-selected services are separate from Orsta's hosting subprocessors; Orsta does not appoint an AI provider merely because a customer connects its client.

Orsta does not use data obtained from Xero's APIs to train, fine-tune, adapt or enhance AI or machine-learning models. Customers must ensure that any AI service receiving that data also meets Xero's applicable restrictions. Orsta does not control an external AI service's retention or model-training settings.

5. International transfers

Supabase stores the primary production database and Auth service in London. Railway runs the API and worker in Amsterdam. Cloudflare operates a global network, Resend uses an EU sending region with subprocessors in other countries, and Google Workspace and provider support can involve processing in several countries.

Where UK data-protection law requires a transfer mechanism, the applicable provider terms use an adequacy regulation, the UK Extension to the EU-US Data Privacy Framework, the UK Addendum to the EU Standard Contractual Clauses, or other lawful safeguards. The current provider and safeguard position is described in the Subprocessor List, and information about an applicable safeguard is available on request.

Customer-selected accounting and AI providers may process data in other countries under their own terms and safeguards. The UK/EU location of Orsta's primary hosting does not determine where an external AI client processes the information a user authorises it to receive.

6. Retention

We keep data only as long as justified:

• unsuccessful access requests and prospect records: 12 months after the last substantive contact;
• expired or revoked invitations: 12 months after expiry or revocation;
• routine support correspondence: two years after closure;
• contractual acceptance, material contractual correspondence, material complaints, incidents and minimal deletion evidence: six years after termination or closure;
• invoices, payments and associated accounting records: six years after the end of the financial year to which they relate;
• minimal marketing suppression information: while relevant outreach continues, subject to periodic review;
• customer content: while the organisation is active, then available for viewing and export for 30 days after trial expiry or termination before production deletion;
• backup copies containing deleted customer content: removed through the seven-day backup cycle. The outer operational target for any remaining backup copy is 90 days after production deletion, subject to a required legal hold; this is not the routine backup retention period; and
• abandoned draft and unlinked rejected upload sessions: seven days after last activity.

Original uploaded file bytes and generated export bytes are not deliberately stored as application files. Some metadata and selected normalised data remain as customer content. Legal holds may require narrow information to be kept longer. Provider logs and authentication email data follow the periods stated in the Subprocessor List. Backups are isolated from ordinary use. If a backup is restored, we apply the deletion again.

A successful accounting disconnect removes the stored connection credentials that are no longer needed. Disconnecting does not delete data already imported into Orsta. Imported data and stored MCP proposals, reviews and results follow the Customer Data lifecycle above; an approval's expiry is not a deletion deadline. A user can remove an AI connection through the client or its authorisation settings. Disconnecting does not remove results or files already held by that client. Ordinary Orsta browser sign-out does not by itself revoke a separate MCP connection.

7. Security

We use access controls, managed authentication, encrypted connections, data minimisation and controlled export and deletion procedures. Access is limited to people and providers that need it. The DPA describes these measures in more detail.

No internet service is completely secure. Customers should protect their accounts, source records and downloaded exports.

8. Your rights and complaints

Depending on the circumstances, you may have rights to be informed, access your data, correct it, erase it, restrict its use, receive portable data, and object to processing. The right to object to direct marketing is absolute. Some rights are conditional and legal exemptions may apply.

Email privacy@orsta.app. We may request proportionate information to confirm identity or authority. We normally respond without undue delay and within one month. We will facilitate and acknowledge a data-protection complaint within 30 days and investigate it without undue delay.

You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/data-protection-complaints/. We would appreciate the opportunity to address the concern first, but this does not limit the right to contact the ICO.

9. Children and sensitive data

Orsta is for business customers and is not intended for children. The service is not intended for unnecessary personal data, special-category data or criminal-offence data. Customers must minimise uploads and must not use the service for such data unless they have first agreed a lawful and appropriate arrangement with Orsta.

10. Changes

We will publish a new version when this notice changes and will give appropriate notice of material changes.