Privacy notice

About this notice

This notice explains how Oshy Labs Ltd ("Oshy Labs", "we", "us") collects and uses personal data in connection with Broker Lead Lab. It covers data about you as a user of our service, people who apply for a pilot, people we research for our own sales outreach, and our billing records. It does not cover the lead data our business customers upload into Broker Lead Lab: we process that only as a processor on our customers' instructions, and the terms for that are set out in our Data Processing Agreement, not this notice.

1. Who we are

Oshy Labs Ltd is a company registered in England and Wales, company number 16883720, registered office 100 St Pier Court, 549 Green Street, London E13 9GU. We pay the data protection fee to the Information Commission (formerly the Information Commissioner's Office), registration reference ZC107032. If you have any question about this notice, contact us at arnold.oshenye@oshylabs.eu.

2. Personal data about our users (your account)

When your organisation creates a Broker Lead Lab account, we collect the name, work email address and role of each user you add, plus login and activity records needed to run the service securely (such as sign-in times, basic usage logs, and an audit trail of imports, exports, deletions and role changes inside your organisation). If you sign in with Google, we receive your name and email address from Google to set up your account; we do not receive your Google password.

We use this data to provide you with access to the service, respond to support requests, send essential service communications (for example about downtime or security), and administer billing. Our lawful basis for this is performance of our contract with your organisation, and our legitimate interest in keeping the service secure, accountable and operating properly.

We keep account data for as long as your organisation has an account, and audit events for the life of the organisation. Deleting an organisation removes its users, records and files, leaving only a record that the deletion happened.

3. Pilot applications

If you apply for a pilot, we collect your company, name, work email, role, company size, lead sources and any message you send. We use it to reply to your application and, if you go ahead, to set up the pilot. Our lawful basis is our legitimate interest in responding to an enquiry you made. We keep applications for 12 months unless you become a customer.

4. Billing data

We use Stripe to process payments. Card details are held by Stripe, never by us. We keep records of invoices, payments and the billing contact details needed for tax and accounting purposes for 6 years after the end of the financial year to which they relate, in line with UK accounting and tax record-keeping requirements. Our lawful basis is legal obligation and our legitimate interest in maintaining accurate financial records.

5. Prospects: people we research for our own sales outreach

5.1 What we collect and where it comes from. Separately from Broker Lead Lab itself, Oshy Labs researches estate agencies' and brokerages' public websites to identify people to contact about our product. For each prospect, we collect their name, job role or title, and publicly listed work email address, taken directly from the agency's or brokerage's own public website, together with the pages we took it from.

5.2 Why we process this data. We use this data to send a small number of outreach emails introducing Broker Lead Lab. Every email is approved by a person before it is sent and includes a one-click way to opt out of further contact.

5.3 Our lawful basis. We rely on legitimate interests. We have a genuine business interest in reaching potential business customers, we only use information the person's own employer has made public in a professional context, we send a strictly limited number of messages a day, and we always provide a free and immediate opt-out. We have balanced this interest against the impact on the individual and consider it proportionate, particularly as for UK outreach we only contact limited companies, limited liability partnerships and PLCs, and we never contact individuals using personal (non-work) contact details.

5.4 Your right to object. If you are a prospect and receive an email from us, you can opt out instantly using the link in that email, or by replying to ask us to stop. You can also object at any time by emailing arnold.oshenye@oshylabs.eu, and we will stop.

5.5 How long we keep prospect data. We keep prospect data for up to 12 months from when we first collect it. If you engage with us during that time (you reply, book a call or become a customer), we keep the data for as long as needed for that relationship instead. If you opt out, we keep a minimal record of the opt-out itself so we do not contact you again.

6. Cookies and analytics

6.1 Essential cookies. Broker Lead Lab uses a small number of strictly necessary cookies to keep you signed in, remember which organisation you are viewing and keep the service secure. These do not require consent because they are necessary for a service you have asked for. There are no advertising cookies.

6.2 Analytics. If product analytics is switched on, we use PostHog, hosted in the EU, to count which pages and screens are used so we can improve the product. It does not build individual profiles, does not record sessions, does not capture clicks automatically and masks page text. It stores a first-party cookie and a local storage entry to count usage. UK law allows this kind of statistical analytics without consent, provided we tell you and you can object. To object, use the "Turn off analytics" link in the site footer at any time and we stop on that browser.

6.3 Managing cookies. You can also control or delete cookies through your browser settings. Blocking essential cookies may stop parts of Broker Lead Lab working.

7. Who we share data with

We share personal data with service providers who help us run Broker Lead Lab and our business, under contracts that protect your data: Supabase (database, authentication and storage), Vercel (hosting), Resend (transactional and outreach email), Stripe (payments), Google (optional sign-in), PostHog (analytics, only if switched on) and Typesafe (optional decision support, only if switched on, aggregate data only). We do not sell personal data to anyone, and we do not share it with third parties for their own marketing purposes.

8. International transfers

Our database and application functions run in London. Some of our service providers involve a transfer of personal data outside the UK: Vercel, Resend, Stripe and Google are US companies, and our contract with Supabase is with Supabase Pte Ltd in Singapore even though our data is stored in London. Where we transfer personal data to a country without UK adequacy, we use safeguards recognised under UK data protection law, such as the International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, together with a transfer risk assessment. We do not rely on the UK-US data bridge alone. You can ask us for more detail about these safeguards using the contact details in section 1.

9. Your rights

Depending on where you are and which law applies, you may have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to delete your data; restrict how we use it; receive a copy of it in a portable format; object to our processing, including processing based on legitimate interests; and not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. Broker Lead Lab does not make this kind of automated decision about individuals. To exercise any of these rights, contact us using the details in section 1. We will not charge a fee unless your request is clearly unfounded or excessive, and we aim to respond within one month. If your data reached us through a customer's import, we will point you to that customer, who is the controller, and help them respond.

10. Complaints

If you are unhappy with how we have handled your personal data, please email arnold.oshenye@oshylabs.eu first. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. UK data subjects can also complain to the Information Commission (ico.org.uk), which replaced the Information Commissioner's Office on 30 September 2026. US residents can complain to their state attorney general or, where applicable, the Federal Trade Commission. You do not have to complain to us first, but we would appreciate the chance to put things right.

11. US residents

If you are a resident of a US state with its own privacy law (such as California, Virginia, Colorado, Connecticut or Texas), you may have rights under that law in addition to the rights in section 9, including the right to know what personal data we hold about you, to delete it and to correct it. We do not sell personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined under applicable US state privacy laws. We do not use automated profiling that produces legal or similarly significant effects about you.

12. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, row level access controls in the database, and working only with service providers who maintain appropriate security standards. No system is completely secure, but we take reasonable steps to reduce the risk of unauthorised access, loss or misuse.

13. Changes to this notice

We may update this notice from time to time, for example to reflect changes in the law or in how we process data. We will update the date at the top of this page when we do, and if a change is significant we will let you know by email or an in-app notice.