Privacy | Ostara

Ostara Privacy Policy

Last updated: 06/06/2026
Applies to: the Ostara field-survey mobile app (com.ostara.fieldapp) and the Ostara web platform at ostara.eco.

1. Who we are

Ostara is operated by OSTARA ECOLOGICAL SERVICES LTD (the "controller" for the purposes of UK GDPR), company number 13824359.

If you have questions about how we handle personal data, contact support@ostara.eco. We do not currently have a statutorily-appointed Data Protection Officer; the same address reaches the team responsible for privacy decisions.

2. Scope

This policy explains the personal data Ostara collects when you use the Ostara mobile app or web platform, why we collect it, how long we keep it, who we share it with, and your rights under UK GDPR.

Ostara is a B2B platform: most users are surveyors employed by, or working under contract for, an ecology consultancy that subscribes to Ostara. Where the consultancy is the controller of your data and Ostara acts as a processor on their behalf, the consultancy's own privacy notice takes precedence for those processing activities. Where Ostara is the controller (account credentials, support communications), this policy applies.

3. What we collect

Information you give us directly:

Email address and name — collected at sign-in (Google Sign-In) or by admin invite. Used to identify your account, send service emails, and tie survey contributions to a person.
Profile details (role, organisation) — collected at account setup. Used to apply role-based permissions and route work.
Survey content you produce — collected while conducting surveys (habitat records, species records, photos, voice notes, GPS-tracked walked paths, drawn polygons). This forms the core deliverable of the platform.
Support correspondence — collected when you contact support. Used to respond and to keep a record of past requests.
Information collected automatically:
Precise device location (when in use) — collected by the mobile app with your explicit consent, to centre the field map, record finding locations, and track your walked path during an active survey.
Photos and voice recordings you choose to attach — collected by the mobile app with your explicit consent, to attach evidence to a survey finding.
Crash logs, diagnostic information, performance metrics — collected by Firebase Crashlytics, to diagnose and fix bugs.
App install ID, device model, OS version — standard mobile telemetry via Firebase / Crashlytics, used to correlate crashes and triage support requests.

The mobile app does not run an analytics SDK — Crashlytics (crash and diagnostics) is the only telemetry that leaves the device. We do not collect: financial information, health or fitness data, contacts, calendar, messages, web browsing history, race, religion, sexual orientation, political views, or precise health identifiers.

Cookies and similar technologies (web platform):

The Ostara web platform at ostara.eco uses cookies and similar technologies for authentication, session management, and aggregate analytics. We do not use advertising cookies. Details are in the website cookie banner. The mobile app does not use web cookies; it stores authentication tokens and an offline cache locally on the device.

4. Why we collect it (lawful bases under UK GDPR Article 6)

Operate the service and deliver surveys to your consultancy — performance of a contract.
Authenticate you and secure your account — performance of a contract; legitimate interests.
Collect precise location and microphone audio during a survey — consent (Article 6(1)(a)); you grant the runtime permission.
Crash logs and diagnostic telemetry — legitimate interests (product reliability).
Service emails (password resets, scheduling notifications) — performance of a contract.
Marketing emails — consent; you can opt in or out at any time.
Retain financial and statutory records — legal obligation (Companies Act 2006 / HMRC).
Retain forensic audit logs — legal obligation (UK GDPR Article 32).

5. Who we share it with

We share personal data only with the categories of recipient listed below, and only as far as needed for the stated purpose.

Google LLC (Firebase Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Run, Crashlytics, Cloud Messaging, Vertex AI) — hosting, identity, database, crash diagnostics, AI report drafting. EU / UK regions where possible; Google's standard contractual clauses apply to any onward transfer.
Algolia — search indexing. EU.
Mapbox — map tile delivery. No personal data sent (only anonymised tile-fetch requests). EU / US.
DEFRA MAGIC — ecological constraint lookups against UK statutory designations (anonymised polygon queries, no user identifiers). UK.
Your ecology consultancy — the findings you produce form the deliverable Ostara provides to them.
Their end clients (developers, landowners, planning authorities) — final survey deliverables include surveyor-attribution metadata as required by CIEEM professional standards.

We do not sell personal data. We do not share for advertising purposes. International transfers outside the UK rely on the UK's adequacy regulations or on Standard Contractual Clauses adopted by the UK ICO.

6. How long we keep it

Active account credentials and profile — until you (or your consultancy) request deletion.
Survey findings delivered to a client — typically 7 years from delivery (CIEEM professional standards; contractual).
Crash logs and diagnostic telemetry — 90 days.
Audit and security event logs — 400 days (UK GDPR Article 32 forensic-trail requirement).
Financial records linked to your account — 6 years from the end of the tax year (Companies Act 2006 section 388; HMRC).
Backups — up to 30 days rolling. Deletion requests are honoured against live data first, then propagated to backups within 30 days.

For full details on what happens on account deletion, see our "How to delete your Ostara account and data" page.

7. Offline storage on your device

The mobile app stores survey data locally in an encrypted database so you can work offline. Data syncs back to our servers when connectivity is available. If you sign out, the local database is cleared. If you lose the device, your data is still safe on our servers and not accessible without your sign-in.

8. Your rights under UK GDPR

You have the right to:

Access the personal data we hold about you (Article 15)
Rectify inaccurate or incomplete data (Article 16)
Erase your data, subject to the retention rules in section 6 (Article 17) — see our account-deletion page
Restrict processing while a dispute is being resolved (Article 18)
Port your data to another controller in a structured, commonly-used format (Article 20)
Object to processing based on legitimate interests (Article 21)
Withdraw consent for processing based on consent (Article 7) — you can revoke location, microphone, or notification permissions in your device settings at any time, and unsubscribe from marketing email via the footer of any marketing message

To exercise any of these rights, email support@ostara.eco. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (the ICO) at ico.org.uk.

9. Children

Ostara is a professional ecology tool. It is not intended for use by children under 16. We do not knowingly collect data from children. If you believe we have, contact support@ostara.eco and we will delete it.

10. Security

We use HTTPS / TLS for all data in transit. Data at rest is encrypted using Google Cloud's default at-rest encryption. We enforce least-privilege access controls, multi-factor authentication for our team's admin accounts, and time-bound forensic audit logging on all data reads and writes.

If a personal data breach affects your data and is likely to result in a risk to your rights and freedoms, we will notify you within 72 hours of becoming aware, in line with UK GDPR Article 34.

11. Changes to this policy

We may update this policy from time to time. We will publish the updated version on ostara.eco/privacy and update the "Last updated" date at the top. Material changes are also communicated via in-app notice or service email.

12. Contact

For anything privacy-related, email support@ostara.eco.