Privacy Policy

1. Who is responsible

The controller of your personal data is [legal entity name], registered in Latvia under number [registration number], [address] ("Offlist", "we"). For anything about your data, email hello@joinofflist.com.

This policy covers joinofflist.com, your Offlist account, the emails we send and receive, and people we contact by email who do not have an account.

2. What we collect, why, and on what legal basis

Your account

Your email address, and your name if you give it. When you sign in, we store a one-time sign-in token (valid for 15 minutes) and a session (valid for 30 days). Both are stored only as hashes. We record whether you have a membership and, once you pay, your Stripe customer reference.

Why and legal basis: to create and run your account and give you the access you have signed up for (performance of a contract, GDPR Art. 6(1)(b)).

Payments

Payments are handled by Stripe. Stripe receives your card details and billing information directly; we never see or store your full card number. We keep a record of your plan, payment status and invoices.

Legal basis: performance of a contract, and our legal obligations under accounting and tax law (Art. 6(1)(b) and (c)).

Emails with us

When you email hello@joinofflist.com, we keep your message, your address and our reply so we can answer you and follow up.

Legal basis: our legitimate interest in answering and keeping track of correspondence (Art. 6(1)(f)), or performance of a contract where it concerns your account.

Newsletter

If you sign up for our newsletter, we store your email address and where you signed up, and send you a roundup of new perks.

Legal basis: your consent (Art. 6(1)(a)). You can unsubscribe at any time from any email.

Perk scan

When you enter a website on our scan page, our server visits that site's public pages (the homepage and up to two linked pages, such as pricing or about) and reads them to suggest perks. It identifies itself as "OfflistScanner". The pages are held in memory only while they are read and are not stored. We keep a short summary of the site (its title, description, keywords, the kind of business and the tools it appears to use) in memory for up to 24 hours, so a repeat scan is instant. We do not keep a record of which sites were scanned, except where a site could not be read, which our server log notes for troubleshooting.

To prevent abuse, we hold your IP address in memory for one hour to limit how many new scans can be run from it.

If you answer the scan's questions about your company (funding, revenue, founding year, team size, country and programmes), the answers stay in your browser while you are signed out. If you are signed in, we save them to your account so your next scan, on any device, starts with them. You can change or clear them on the scan page at any time.

Why and legal basis: to run the scan you asked for, and to keep the service available by preventing abuse (our legitimate interests, Art. 6(1)(f)); for saved answers, to provide your account (performance of a contract, Art. 6(1)(b)). Please enter only websites you are entitled to have us read, such as your own company's.

People we contact who do not have an account

We sometimes email people at companies who may be interested in Offlist, for example founders or partners. For this we hold a work email address and, where available, a name, company and similar business details. We get these from public business sources or from people who introduced us. Every such email says who we are and includes a one-click unsubscribe. If you unsubscribe or an email bounces, we keep your address on a do-not-contact list so we never email you again.

Legal basis: our legitimate interest in telling relevant businesses about Offlist (Art. 6(1)(f)), within the limits the e-privacy rules set for business email. [To be confirmed by legal review for Latvia and recipients' countries.]

Using the site

Like any website, our servers and our content delivery network (Cloudflare) process your IP address, browser type and the pages you request, to deliver the site and protect it against abuse. We count how often each perk is viewed and claimed, but those counts are not linked to you.

Legal basis: our legitimate interest in running a secure and reliable service (Art. 6(1)(f)).

3. Cookies and browser storage

We use only what the site needs to work, so we do not ask for cookie consent:

• perkstack_session: a cookie that keeps you signed in, for up to 30 days. Strictly necessary.
• Local storage: your email address and plan, kept in your own browser so the site can show that you are signed in. Signing out clears it.
• Scan answers: your answers to the perk scan's questions, kept in your own browser so you are not asked again. "Clear and start over" on the scan page removes them.

We do not use analytics, advertising or tracking cookies.

4. Who receives your data

We do not sell your data. We share it only with providers who process it for us under data-processing agreements:

• DigitalOcean (Frankfurt, Germany): hosts our servers and database.
• Cloudflare: delivers the website and protects it from attacks.
• Resend: sends and receives our email (sign-in links, replies, newsletters).
• Stripe: processes payments.
• Supabase: hosts perk logo images. Your browser requests them directly, which shares your IP address with Supabase.

We may also disclose data where the law requires it, or to protect our rights in a dispute. If you follow a link to a vendor, the vendor's own privacy policy applies to what you share with them.

5. Transfers outside the EU

Our database is in the EU. Some providers above are based in the United States or use staff and systems outside the EU, so data may be transferred there. Where that happens, we rely on the EU–US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses.

6. How long we keep data

• Account: while your account exists. We delete it within 30 days after you close it, apart from what we must keep by law.
• Sign-in links and sessions: until they expire (15 minutes and 30 days), after which we delete them.
• Payment and invoice records: for as long as Latvian accounting and tax law requires.
• Emails with us: up to 2 years after the conversation ends.
• Newsletter: until you unsubscribe.
• Contacts who are not users: up to 12 months after we last contacted you, unless you become a user. The do-not-contact list keeps only your email address and the reason, for as long as needed to respect your choice.
• Perk scan: the site summary for up to 24 hours and your IP address for one hour, both in memory only. Answers saved to your account: until you clear them or close your account.
• Server and security logs: up to 30 days.

7. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to you in a portable format. You can object at any time to processing based on our legitimate interests, and always to direct marketing. Where we rely on your consent, you can withdraw it at any time without affecting what happened before.

To use these rights, email hello@joinofflist.com. We will reply within one month. We may ask you to confirm the request from the email address on your account.

You can also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv) or the data protection authority where you live or work.

8. Other things you should know

You need to give us an email address to have an account; without one we cannot sign you in. Everything else is optional.

We do not make decisions about you based solely on automated processing.

Offlist is meant for adults and businesses, not children under 16.

We protect your data with encryption in transit (HTTPS), hashed sign-in and session tokens, access controls and a database that is not reachable from the internet.

9. Changes to this policy

If we change this policy in a way that matters, we will tell account holders by email before the change takes effect. The date at the top shows when it was last updated.