The Observatoryby ob2.

Data Processing Agreement

This agreement forms part of the Terms of Service. It covers the personal data of your customers that you put into The Observatory, or that reaches it through the Orbiters.

1. Who is who

  • You (the business using The Observatory) are the controller. You decide why and how your customers' details are used.
  • We (Owen Burrows trading as OB2 House, ICO reference ZC257799) are the processor. We handle those details only on your instructions, which are: run The Observatory for you as described in the Terms.

2. What we handle

Whose dataYour customers, people who enquire with you, and people who email you if you use Inbox
What dataName, mobile number, email address, postal address if you add it, what the job is, amounts quoted, invoiced and paid, booking times, the text of their replies and of emails forwarded to Inbox, questions asked in your website chat, and photos you upload for social posts
WhyTo send your quote follow-ups, invoices, payment and booking reminders and routine emails, answer website questions, sort your email and draft replies, draft social posts, and show you what is happening
How longWhile you are a customer, then deleted 30 days after you leave

Sensitive details. You agree not to enter special category data (such as health information), ID document numbers, or card or bank account numbers. Email that arrives containing them is stored only as part of your Inbox and is never passed to our AI provider.

3. What we promise

We will:

  1. Use the data only to run the service for you, and never sell it or use it for our own marketing.
  2. Keep it confidential. Only Owen Burrows has access, and only when needed to run or fix the service.
  3. Keep it secure: encrypted in transit and at rest, sign-in by one-time link, connected-account keys stored encrypted, and each business's data kept apart from every other's.
  4. Tell you without undue delay, and within 48 hours of becoming aware, if there is a breach affecting your customers' data, so you can meet your own duty to report within 72 hours.
  5. Help you answer requests from your customers to see, correct or delete their data. Email hello@ob2.co.uk and we will act within 5 working days.
  6. Honour opt-outs automatically: a customer who replies STOP is never texted for your business again.
  7. Delete or return all of it when you leave.
  8. Give you the information you reasonably need to show you are meeting your own data protection duties, including to your regulator.

4. Other companies we use

You agree to us using these companies to provide the service. Each has a written data processing agreement with us.

CompanyWhat forWhere
SupabaseDatabase and file storageUnited Kingdom (London)
VercelHosting the applicationUnited Kingdom (London); United States company
TwilioSending and receiving textsUnited States and Ireland
ResendSending emails, and receiving email forwarded to InboxUnited States
AnthropicAI for the Answers, Social and Inbox Orbiters, and for reading jobs you add by photo or text, only if you use them. Photos are read and not kept. Anthropic does not train its models on this dataUnited States
GoCardlessReading your Direct Debit payments, only if you connect itUnited Kingdom
StripeReading your card payments, only if you connect itIreland and United States

Where data goes outside the UK, it is covered by each provider's UK-approved transfer terms: the UK International Data Transfer Addendum to the standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework.

We will email you at least 30 days before adding or replacing a company on this list. If you object, you can cancel.

5. Your side

You confirm that:

  • you have a lawful reason to hold each customer's details and to contact them about their quote, booking, invoice or email;
  • your own privacy notice tells your customers that you use a service provider to send messages and manage your work;
  • you will not use The Observatory to send marketing to people who have not agreed to it;
  • if you are regulated, you have checked that your regulator or network allows you to use a service like this.

6. Checks

Once a year, on reasonable notice, you may ask us written questions about how we protect the data and we will answer them. We are a small business, so on-site audits are not practical; if a regulator requires one, we will cooperate.

7. Liability and law

The liability limits and governing law in the Terms apply to this agreement.

Version 2026-11-13 · last updated 13 November 2026. These documents are being reviewed by a solicitor. We will email every customer if anything changes.