Privacy Policy

Last updated 13 August 2026

Decentralised Experience Lda (“us”, “we”, or “our”) operates the Osorik application (the “Service”).

This page explains how we collect, use, and disclose personal data when you use the Service, and the choices you have associated with that data.

We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined here, terms have the same meanings as in our Terms and Conditions.

Definitions

Service

Service is the Osorik application operated by Decentralised Experience Lda.

Personal Data

Personal Data means data about a living individual who can be identified from that data, or from that data together with other information in our possession or likely to come into our possession.

Usage Data

Usage Data is data collected automatically from use of the Service or from the Service infrastructure itself, such as the duration of a page visit.

Cookies

Cookies are small files stored on your device (computer or mobile device).

Data Controller

Data Controller means the natural or legal person who determines the purposes and means of processing personal information. For this Privacy Policy, Decentralised Experience Lda is the Data Controller of your Personal Data.

Data Processors (or Service Providers)

Data Processor means any natural or legal person who processes data on behalf of the Data Controller. We may use Service Providers to operate the Service.

Data Subject (or User)

Data Subject is any living individual who is using the Service and is the subject of Personal Data.

Information collection and use

We collect several types of information to provide and improve the Service.

Personal Data

While using the Service, we may ask you to provide personally identifiable information that can be used to contact or identify you (“Personal Data”). This may include:

  • Email address
  • Name
  • GitHub account details used to sign in
  • Team and workspace membership details
  • Cookies and Usage Data

We may use your Personal Data to contact you about the Service, including product updates and operational notices. You may opt out of non-essential communications by following the instructions in those emails or by writing to us.

Business records

If you use Osorik to run a business, the Service stores the records you create or import. That may include:

  • Bank account connections and imported transactions
  • Expenses, receipts, invoices, and other documents
  • Contacts, clients, suppliers, and related company details
  • Projects, time entries, and related files
  • Public client-portal activity, such as when an invoice link is opened

These records can contain Personal Data about you and about other people, such as clients or suppliers. You are responsible for making sure you have a lawful basis to store that information in the Service.

Usage Data

We may collect information automatically when you access the Service, including IP address, browser type, device information, diagnostic data, and how you use the Service.

Tracking and cookies

We use cookies and similar technologies to operate the Service, remember preferences, and keep your session secure.

You can instruct your browser to refuse cookies or to indicate when a cookie is being sent. If you do not accept cookies, some parts of the Service may not work.

Examples of cookies we use:

  • Session cookies, to operate the Service and keep you signed in
  • Preference cookies, to remember settings
  • Security cookies, to protect accounts and the Service

Use of data

Decentralised Experience Lda uses collected data to:

  • Provide and maintain the Service
  • Create and manage accounts, teams, and invitations
  • Connect bank accounts, import transactions, and organise business records
  • Extract information from documents and enrich transactions
  • Send invoices and operate public client links
  • Notify you about changes to the Service
  • Provide customer support
  • Monitor usage, diagnose problems, and keep the Service secure
  • Improve the Service
  • Send information about the Service that is similar to features you already use, unless you have opted out

Automated processing and AI

Osorik may send documents, transaction descriptions, and related business records to third-party AI providers, currently including Google Gemini, to extract fields from receipts and invoices and to suggest merchant or contact details.

We do not use customer Content to train our own generalised AI or machine-learning models. Processing by third-party AI providers is subject to their terms and privacy policies. You should review extracted results before relying on them.

Legal basis for processing under the GDPR

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, our legal basis for collecting and using Personal Data depends on the data and the context.

Decentralised Experience Lda may process your Personal Data because:

  • We need to perform a contract with you
  • You have given us permission to do so
  • The processing is in our legitimate interests and those interests are not overridden by your rights
  • We need to process payments or operate paid plans
  • We need to comply with the law

Retention of data

Decentralised Experience Lda retains Personal Data only for as long as needed for the purposes in this Privacy Policy. We also retain and use Personal Data as needed to comply with legal obligations, resolve disputes, and enforce our agreements.

Usage Data is generally kept for a shorter period, except when we need it for security, to improve the Service, or to meet a legal obligation.

Transfer of data

Your information, including Personal Data, may be transferred to and maintained on computers outside your state, province, country, or other jurisdiction, where data-protection laws may differ.

Decentralised Experience Lda is established in Portugal. If you are located outside Portugal and provide information to us, that data may be transferred to Portugal and to countries where our Service Providers operate, including the United States.

Your consent to this Privacy Policy, followed by submission of such information, represents your agreement to that transfer. We will take steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and that transfers only take place where adequate safeguards are in place.

Disclosure of data

Business transaction

If Decentralised Experience Lda is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Disclosure for law enforcement

We may disclose your Personal Data if required to do so by law or in response to valid requests by public authorities, such as a court or government agency.

Legal requirements

Decentralised Experience Lda may disclose Personal Data in the good-faith belief that doing so is necessary to:

  • Comply with a legal obligation
  • Protect and defend the rights or property of Decentralised Experience Lda
  • Prevent or investigate possible wrongdoing in connection with the Service
  • Protect the personal safety of users of the Service or the public
  • Protect against legal liability

Security of data

The security of your data is important to us, but no method of transmission over the Internet or electronic storage is 100% secure. While we use commercially reasonable means to protect Personal Data, we cannot guarantee its absolute security.

Do Not Track signals

We do not currently respond to Do Not Track (“DNT”) signals. DNT is a preference you can set in your browser to tell websites you do not want to be tracked. You can enable or disable DNT in your browser settings.

Your data protection rights under the GDPR

If you are a resident of the EEA, the United Kingdom, or Switzerland, you have certain data-protection rights. Decentralised Experience Lda aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

If you want to know what Personal Data we hold about you, or want it removed, contact us. In certain circumstances you have the following rights:

  • The right to access, update, or delete the information we have on you. Where possible, you can do this in your account. Otherwise, contact us.
  • The right of rectification, if information is inaccurate or incomplete.
  • The right to object to our processing of your Personal Data.
  • The right to restrict processing of your personal information.
  • The right to data portability, so you can receive a copy of your information in a structured, commonly used, machine-readable format.
  • The right to withdraw consent at any time where we relied on consent to process your personal information.

We may ask you to verify your identity before responding to these requests.

You also have the right to complain to a data-protection authority. In Portugal, that authority is the Comissão Nacional de Proteção de Dados (CNPD).

Service Providers

We may employ third-party companies and individuals to facilitate the Service, provide it on our behalf, perform Service-related work, or help us understand how it is used. These parties have access to Personal Data only to perform those tasks and are obligated not to disclose or use it for any other purpose.

The Service currently relies on providers that may include:

  • Convex, for the application backend and database
  • Cloudflare, for infrastructure and transactional email
  • GitHub, for optional account sign-in
  • GoCardless and Enable Banking, for bank-account connections and transaction import
  • Google, for document extraction and transaction enrichment

Payments

If we offer paid plans, we use third-party processors for payment. We do not store your full payment-card details. That information is provided directly to the processor, whose use of your personal information is governed by its own privacy policy.

Links to other sites

The Service may contain links to sites we do not operate. If you click a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of third-party sites or services.

Children’s privacy

The Service is not directed at anyone under the age of 18 (“Children”). We do not knowingly collect personally identifiable information from anyone under 18. If you are a parent or guardian and you believe your Child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we will take steps to remove that information.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new Privacy Policy on this page and update the “Last updated” date.

For material changes, we will notify you by email and/or a prominent notice on the Service before the change becomes effective. You are advised to review this Privacy Policy periodically. Changes are effective when they are posted on this page.

Contact us

If you have questions about this Privacy Policy, contact support@osorik.com.

See also our Terms and Conditions.

Questions about this document? Write to support@osorik.com.