Privacy Policy

Data controller: OfflinAI Limited, a company registered in Ireland (company number 789725), 2 Stockwell, Sandyford Road, Dublin 16, Ireland ("OfflinAI", "we", "us" or "our"). We decide how and why the personal data described here is processed. We are committed to protecting your privacy and to complying with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

This Privacy Policy explains what personal data we collect, and how we use and protect it, when you use our software, including OfflinAI Server; when you activate or buy a licence; when you contact us; and when you visit our website, offlinai.com (the "Site"). We aim to use clear and plain language. If you have any questions, contact us using the details in section 9.

1. Our software and your content

Your content stays on your machines. Our software runs on devices and servers that you or your organisation control. The prompts, documents, files, conversations and outputs you work with are processed there and are not sent to OfflinAI. We cannot access them.

No account needed. You do not need an account with us to install or use our software. The Free plan of OfflinAI Server sends us nothing.

Other services you choose. Our software contacts other services only for features that need them and that you choose to use — for example downloading a model, a cloud model provider you configure, a certificate authority, or forwarding audit records to a destination you set. Those exchanges take place directly between your machines and those services, and OfflinAI does not receive them. Licence activation is described in section 1A.

Other OfflinAI applications. If we publish other applications, they will follow the same principle, and this Policy will describe anything they send us before they are released.

1A. OfflinAI Server, Licences, Purchases and Enquiries

Your content stays with you. OfflinAI Server runs on machines that you or your organisation control. The prompts, documents, outputs, usage records and audit logs it keeps stay on those machines; OfflinAI does not receive them. If you run OfflinAI Server for your organisation, your organisation decides how that data is used and is responsible for it.

Licence activation. To activate a paid plan and keep it active, OfflinAI Server sends our licence service the licence key, a pseudonymous machine identifier (a one-way hash, not the raw hardware identifier), the machine's host name, its operating system and the product version, and it refreshes the licence periodically. We use this to issue and verify licences, to apply the number of servers a licence allows and to prevent misuse. The legal basis is the performance of our contract with the licence holder and, for misuse prevention, our legitimate interests. We keep activation records for as long as the licence is in use and for up to six years afterwards. Offline activation works through a file you carry to a connected machine and sends the same information.

Purchases. When you buy a licence from us, we process your name, email address, organisation, billing address, VAT number and order details to provide the licence, send invoices and meet our accounting and tax obligations (performance of a contract and legal obligation). Payments may be handled by a payment provider acting for us or as the seller of record; we do not store full card details. Financial records are kept for six years, as Irish tax law requires.

Enquiries and early-access requests. When you contact us or request early access through our website, we receive your name, email address and message by email so that we can reply and follow up on your request (our legitimate interests, or steps you ask us to take before a contract). Our forms use Cloudflare Turnstile to check that a request comes from a person, which processes technical signals such as your IP address and browser information for that purpose only. We keep enquiries for up to 24 months after our last exchange, unless they become part of a contract.

Hosting. Our website and licence service run on Cloudflare's network, and emails are sent through Amazon Web Services. These providers act as our processors and may process technical data such as IP addresses to deliver and secure the services.

2. The OfflinAI website

You can use our Site without telling us who you are, and without creating an account.

No tracking cookies. Our Site does not use cookies for analytics or advertising, and it does not load advertising, social-media or analytics trackers run by others. Cloudflare, which hosts and protects the Site, may set strictly necessary cookies to keep it secure and to stop abuse.

Visitor statistics. We count visits with Cloudflare Web Analytics and Cloudflare's own traffic statistics: which pages are viewed, the referring site, the type of browser and device, and the country, derived from the IP address. Cloudflare Web Analytics does not use cookies and does not follow you across other sites, and we see these figures only in aggregate. Our legitimate interest is to understand which pages are useful and to keep the Site working.

Forms. What happens to the details you send through our forms is described in section 1A.

Fonts and other content. The Site's fonts, images and scripts are served from offlinai.com itself, so your browser does not contact font or content services run by others — except Cloudflare Turnstile, on pages with a form. Links to other websites, such as Docker Hub or LinkedIn, take you to sites with their own privacy policies.

Email updates. If you ask us to keep you informed — for example about new releases, or about AI Accountant — we use your email address only for that, once you have confirmed it. Every such email has an unsubscribe link, and you can also ask us at [email protected] to stop.

3. Legal bases for processing personal data

We process personal data only when the GDPR gives us a legal basis to do so:

Performance of a contract — to provide, activate, verify and invoice the licences you buy, and to take the steps you ask for before a contract (section 1A).
Legitimate interests — to reply to enquiries and follow them up; to keep our Site and licence service secure and to prevent misuse; and to understand, in aggregate, how our Site is used. We balance these interests against your rights, keep the data to a minimum, and you can object at any time (section 6).
Legal obligation — to keep financial records as Irish tax law requires, and to answer lawful requests from public authorities.
Consent — to send you the email updates you asked for. You can withdraw your consent at any time.

We do not make decisions about you by automated means, including profiling, that produce legal or similarly significant effects on you.

We do not sell your data. OfflinAI does not sell, rent or trade personal data.

Service providers. A small number of providers process personal data for us, under data processing agreements and only as far as they need to provide their service:

Cloudflare — hosting and protecting our Site and licence service, visitor statistics, and the Turnstile check on our forms;
Amazon Web Services — sending the emails that our forms and services produce;
Microsoft — our mailboxes (Microsoft 365), where your messages to us arrive;
a payment provider, once we offer online payment, as section 1A describes.

Legal disclosures. We may disclose information where the law requires it, or where necessary to establish, exercise or defend legal claims, to investigate fraud or to protect the safety of others — only as far as data protection law allows, and telling you where we lawfully can.

International transfers. Some of these providers are based in, or may process data in, countries outside the European Economic Area, such as the United States. Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, for the companies certified under it) or on the European Commission's Standard Contractual Clauses. Ask us at [email protected] if you would like details.

5. Data retention

We keep personal data only for as long as we need it for the purposes above, or as the law requires:

Enquiries and early-access requests: up to 24 months after our last exchange, unless they become part of a contract.
Licence activation records: for as long as the licence is in use and for up to six years afterwards.
Financial records: to comply with Section 886 of the Taxes Consolidation Act 1997, we keep financial records, including invoices that contain personal data, for six years from the end of the accounting period they relate to, and then delete them securely.
Email updates: for as long as you remain subscribed. After you unsubscribe we keep only a short suppression record, so that we do not email you again.
Visitor statistics: only in aggregate form, which does not identify anyone.
Backups: personal data in our backups is deleted as the backups are replaced, and stays protected until then.

When a retention period ends, we delete the data securely or anonymise it so that it no longer identifies anyone.

6. Your rights under the GDPR and other privacy laws

You have the following rights over your personal data:

Access: to ask for a copy of the personal data we hold about you and how we use it.
Rectification: to have inaccurate or incomplete data corrected.
Erasure: to have your data deleted where we no longer need it, where you withdraw consent and no other basis applies, where you object and we have no overriding legitimate interest, or where the law requires it. Data we must keep by law, or to establish or defend legal claims, may be kept for that purpose; we will tell you if so.
Restriction: to ask us to pause the processing of your data, for example while we check its accuracy or consider an objection.
Objection: to object at any time to processing based on our legitimate interests, and always to direct marketing. We will stop unless we have compelling legitimate grounds, or need the data for legal claims.
Portability: to receive the data you gave us, where we process it by automated means on the basis of consent or a contract, in a structured, machine-readable format, or to have it sent to another controller where technically feasible.
Withdrawing consent: to withdraw consent at any time, for example by unsubscribing from email updates. This does not affect processing that took place before.
Complaint: to complain to a data protection supervisory authority. Our lead authority is the Irish Data Protection Commission (www.dataprotection.ie); you may also contact the authority where you live. We would appreciate the chance to address your concern first.

To exercise any of these rights, contact us (section 9). We may need to verify your identity first. We reply without undue delay and within one month, which the law allows us to extend by two further months for complex or numerous requests; we will tell you if we need to. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

7. Data security

Less data, less risk. Because our software processes your content on your own machines, your content never reaches our systems: what we do not collect cannot be lost or misused.

Protecting what we hold. The limited personal data we hold — enquiries, licence records and invoices — is kept with providers that protect it with encryption and access controls. Only the people at OfflinAI who need it can access it, and accounts with access use two-factor authentication.

Encryption in transit. Our Site and licence service are served only over HTTPS.

Vulnerabilities and incidents. Our Security page explains how to report a vulnerability and how we handle it. If a personal data breach affects you, we will notify the supervisory authority and, where the law requires, you.

No system is completely secure, but we work to protect your information to the best of our ability.

8. Changes to this Privacy Policy

We may update this Policy as our products, our Site or the law change. We will post the updated Policy here with a new effective date, and for significant changes we will give a more prominent notice, for example on the Site or in our software. We will not reduce your rights under this Policy without your consent.

9. Contact us

If you have any questions or requests about this Policy or your personal data, contact us:

Email: [email protected]
Post: Privacy, OfflinAI Limited, 2 Stockwell, Sandyford Road, Dublin 16, Ireland

OfflinAI Limited is the data controller responsible for the processing described in this Policy. When you contact us, we may ask you to verify your identity before acting on your request, so that we protect personal data from anyone else.