Last updated [Date]

Privacy policy

What we collect, why, who else sees it, and what you can ask us to do with it. Written to be read, not skimmed past.

Draft. Have a lawyer check this before launch. Anything in [square brackets] is a placeholder for the owner's details.

01 Who is responsible

[Company legal name], at [Address], runs Offerslide. For questions about your data, write to [Contact email]. [If required: name of data protection officer or EU/UK representative.]

There are two kinds of people in Offerslide. Businesses sign up and send proposals. Clients receive them and answer. For business accounts we decide how data is used (we are the "controller"). For the client details a business puts into a proposal, the business is the controller and we process that data on its behalf (we are the "processor").

02 What we collect

If you have a business account

Your name, email address and a scrambled (hashed) version of your password. We never store the password itself.
Your business name, logo, brand color and currency.
The proposals you write and the prices in them.
The names and email addresses of the people on your team, if you add any.
Your plan and billing status. Card details go to Paddle, not to us.

If you are a client who received a proposal

Your name and email address, as the business entered them.
What you did with the proposal: the options you ticked, any question and note you sent, and when.
If you sign: the name you typed, the date and time, and the network (IP) address it came from. This is the record that shows who agreed to what.

From everyone

Basic technical logs (IP address, browser type, pages requested, errors) that keep the service secure and working.
A cookie that keeps you signed in. We do not use advertising or tracking cookies. [Update this if analytics are added.]

03 How we use it

To run the service: show proposals, record answers, and let each side know what happened.
To keep a trustworthy record of signed agreements.
To send the emails the service needs, such as password resets, team invitations and news about your proposals.
To bill paid plans, through Paddle.
To keep things secure, stop abuse, and fix faults.

04 Our legal reasons

Where privacy law asks for a legal reason (for example under the UK or EU GDPR), ours are:

Contract: to provide the service you signed up for.
Legitimate interests: keeping the service secure, keeping signing records, and improving the product. We balance these against your rights.
Legal obligation: keeping records for tax and accounting.

For client details, the business that sent the proposal is responsible for having a legal reason to share them with us.

05 AI helpers

If a business uses the AI helpers, the parts of a proposal, note or voice recording needed for that task are sent to our AI provider, Anthropic, to produce a suggestion, a translation or a draft. That can include a client's note or name when it is part of the text being translated or answered.

We send only what the task needs. [Confirm and state here: that the provider does not use this data to train its models under the API terms in use, and how long it keeps it.] The AI helpers are off unless a business uses them.

07 Where it is stored

Data is stored with [Hosting provider] in [Region]. Some of the providers above are in other countries, including the United States. Where data leaves the UK or EU, we rely on [the safeguards used, e.g. standard contractual clauses].

08 How long we keep it

Account and proposal data: while the account is open, then deleted within 30 days of closing.
Signing records: 7 years, because they are the proof of an agreement.
Billing records: as long as tax law requires, usually [number] years.
Technical logs: [number] days.

09 Your rights

Depending on where you live, you can ask to see the data we hold about you, correct it, delete it, get a copy to take elsewhere, or object to how we use it. Write to [Contact email] and we will answer within [one month].

If you are a client and your request is about a proposal a business sent you, we may pass it to that business, since it is responsible for that data. You can also complain to your local data protection authority.

10 Keeping it safe

Connections are encrypted, passwords are stored hashed, and access to data is limited to what is needed to run the service. What only the business should see, such as its account details, is never sent to its clients. No system is perfectly secure. If we learn of a breach that affects you, we will tell you as the law requires.

11 Children

Offerslide is for businesses. It is not meant for anyone under 18, and we do not knowingly collect children's data.

12 Changes to this policy

If we change this policy in a way that matters, we will tell business account holders by email or in the app before it takes effect. The date at the top shows when it last changed. See also our Terms of service.