Privacy policy
What Osmosis does with your data, and with your customers' data.
Last updated 7 September 2026.
Osmosis is round management software for window cleaning businesses. This policy covers www.osmosisapp.co.uk and the app at app.osmosisapp.co.uk.
Two kinds of data
Osmosis holds data about you, the cleaner who signs up, and data about your customers, which you enter or import. These are treated differently.
- For your own account data, Osmosis decides what is collected and why. In data protection terms Osmosis is the controller.
- For your customers' data, you decide what to hold and why, and Osmosis holds it on your behalf and follows your instructions. In data protection terms you are the controller and Osmosis is the processor. You are responsible for telling your customers what you hold about them and on what basis.
Your account
Osmosis holds, for as long as you have an account:
- your name, email address and password, which is stored hashed and never in plain text;
- your company name and the contact phone number and email address you choose to publish to your customers;
- the name and email address of anyone you invite to your company;
- when you last signed in, and the pages you visit in the app, to find and fix faults;
- your subscription: what you pay, when, and whether a payment failed. Card details are held by Stripe, not by Osmosis.
This is used to run your account, take your subscription payment, answer your support requests and tell you about changes to the service. The basis for it is the contract between you and Osmosis.
Your customers' data
What you put in is what is held: names, addresses, postcodes, phone numbers, email addresses, the jobs you have done, the prices you charge, what is owed and what has been paid. If you collect by Direct Debit, Osmosis also holds the reference GoCardless gives each mandate and payment, and whether each collection succeeded. Osmosis never holds your customers' bank details or card details; those are entered by the customer on GoCardless's own pages.
Osmosis does not contact your customers on its own account. Email and text messages go out only when you send them, such as a Direct Debit link you ask Osmosis to email.
Who else sees it
Osmosis does not sell data and does not share it for advertising. It is shared with the companies that run parts of the service:
| Company | What for | Where |
|---|---|---|
| DigitalOcean | Hosting and the database | London, UK |
| Cloudflare | Serving the site and protecting it from abuse | Global |
| Stripe | Taking your subscription payment | Ireland and the USA |
| GoCardless | Direct Debit collection, if you connect an account | UK |
| Zoho (ZeptoMail) | Sending email the app generates | EU |
| Sentry | Recording errors so they can be fixed | USA |
| Segment | Counting how the app is used | USA |
| Grafana Cloud | Application logs | EU |
Where a company is outside the UK, the transfer is covered by the UK International Data Transfer Agreement or the addendum to the EU standard contractual clauses. Data is also disclosed if the law requires it.
If you connect a GoCardless account, GoCardless is your own payment provider and holds your customers' mandates and payments under its own agreement with you. Its privacy notice is at gocardless.com/privacy.
Cookies
The app sets a cookie to keep you signed in. It is necessary for the app to work and is not used to track you across other websites. On the settings page, where you manage your subscription, Stripe loads its own script and sets two cookies it uses to detect card fraud. This site sets no cookies of its own.
How long it is kept
Your data and your customers' data are kept while your account is open. Delete your account from Settings, confirm it through the link emailed to you, and the account, your companies and everything in them are deleted at once. Database backups hold a copy for seven days and are then overwritten. What has to be kept for accounting is kept: records of what you paid Osmosis are kept for six years, as UK tax law requires. You can export everything you hold at any time, from Settings, as a spreadsheet.
Your rights
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, or object to how it is used. Email [email protected] and you will get an answer within 30 days. If you are unhappy with the answer you can complain to the Information Commissioner's Office at ico.org.uk.
If you are one of our customers' customers, the cleaner who does your windows holds your details and is the person to ask. Osmosis will pass a request on to them.
Security
Traffic is encrypted in transit. Passwords are hashed. The database is not reachable from the internet. Access to production data is limited to the people who run the service. If a breach puts anyone at risk, the Information Commissioner's Office is told within 72 hours and so are you.
Changes
This policy is updated when the service changes. The date at the top says when it last changed. A change that materially affects you will be emailed to you before it takes effect.