What we collect,
and what we don't.

This Privacy Policy applies to two groups of people:

• Creators: people and businesses who sign up to send offers using Offry.
• Prospects: people who receive an offer from a Creator and may pay through Offry's branded portal.

For Creator personal data (the account-holder's name, email, business details, Stripe Connect status, etc.), MZED Studio Limited is the data controller: we decide how and why that data is processed, and this Privacy Policy describes that processing.

For Prospect personal data (a Creator's customers, leads, and payment history), the Creator is the data controller (or, under the California CCPA / CPRA, the "business") and MZED Studio Limited acts as a data processor (or, under the CCPA / CPRA, a service provider) on the Creator's behalf. MZED Studio Limited retains, uses, and discloses Prospect personal information only for the specific business purposes set out in our agreement with the Creator and as otherwise permitted by applicable law. We do not "sell" or "share" Prospect personal information as those terms are defined under the CCPA / CPRA, and we do not combine Prospect personal information with personal information we receive from other sources except where permitted by law for security, fraud prevention, or to comply with a legal obligation. Prospects who want to exercise rights over their data should contact the Creator who collected it. If that Creator cannot be reached, you can contact us at legal@offry.co and we will route the request appropriately or, where required by law, fulfil it ourselves.

Our Data Processing Addendum (DPA) is available on request from Creators who require one. Email legal@offry.co.

From Creators when they sign up and use the Service:

• Email address, name, and business name.
• Stripe Connect account identifier and capability status. We never see your Stripe secret keys, card numbers, or bank-account credentials.
• Stripe Connect account metadata recorded when we classify your business for risk and merchant-category purposes: merchant category code, business type, business website, registered country and region, the age of your business domain, whether your sign-in email matches that domain, whether your account can currently take charges and receive payouts, and the date, IP address, and user-agent of your acceptance of Stripe's terms. This is kept as an audit record of the classification decision and is not used for advertising or profiling.
• Account settings: business name, brand logo, currency, default deposit terms.
• Offer content you create: product details, prices, prospect names and emails, installment schedules.
• Webhook endpoint configuration: destination URLs, signing-secret material, and delivery metadata. Secret material is stored with restricted access in our database.
• If, and only if, you connect your Google Calendar: a read-only access token for that calendar, and — at the moment you are on a call and building an offer — the names and email addresses of the people invited to that one meeting. See §10.
• Standard server logs: IP address, user-agent, request paths, and timestamps for security, debugging, and abuse prevention.
• Error diagnostics: when our app crashes in your browser or on our servers, we send a sanitised error report — stack trace, page URL, and timestamp — to our error-monitoring subprocessor (Sentry). The report does not identify you: no account identifier is attached to it, and cookies, IP addresses, authentication tokens, and email addresses are stripped before transmission.
• Acceptance records for our Terms of Service, Acceptable Use Policy, and this Privacy Policy: which version you accepted, when you accepted it, the SHA-256 hash of the document you accepted, and the IP address and user-agent at the time of acceptance. Retained for the lifetime of your account and, after closure, for the period required to evidence your acceptance (see §7).

From Prospects when they receive, accept, or pay an offer:

• Name and email address (provided to the Creator at the time the offer was created).
• Payment status (deposit paid, installment paid, refund, etc.). Card numbers, bank-account details, and any other sensitive payment data are collected directly by Stripe, never by Offry.
• Server-side, anonymised analytics about portal visits (page, timestamp, country derived from IP). Offry does not currently set advertising cookies or share Prospect data with advertisers.
• Error diagnostics: when the offer portal crashes in your browser, we send a sanitised error report — stack trace, page URL, and timestamp — to our error-monitoring subprocessor (Sentry). The report does not identify you: no account identifier is attached to it, and cookies, IP addresses, authentication tokens, and email addresses are stripped before transmission.

For Creators, we process personal data on the following lawful bases:

• Performance of a contract: operating the Service you signed up for, processing your offers, and delivering transactional emails (offer notifications, deposit confirmations, installment reminders, payment failures, refunds).
• Legitimate interests: preventing fraud and abuse, securing the Service, maintaining server logs, and improving the product through aggregated, de-identified usage patterns.
• Consent: for any product-update or marketing emails. Creators can opt out at any time from the dashboard or via the unsubscribe link in each message.
• Legal obligation: meeting tax, accounting, and anti-money-laundering record-keeping requirements; responding to lawful requests from authorities.

For Prospects, we process personal data only on the documented instructions of the Creator who controls that data, plus to the extent necessary to operate and secure the Service. We do not send marketing emails to Prospects. If a Prospect later signs up as a Creator, they become subject to the Creator processing described above with respect to their own account data.

We do not sell personal information. We do not share Creator or Prospect data with advertisers. We do not use Prospect data to train third-party advertising or profiling systems.

We use the following service providers to operate Offry. Each is contractually bound to handle data on our behalf and to provide adequate protections under UK GDPR, EU GDPR, and applicable US privacy laws.

We will give Creators reasonable advance notice (typically 30 days) before adding or replacing a subprocessor that processes personal data on our behalf, by updating this list and emailing affected account owners.

MZED Studio Limited is established in the United Kingdom. Several of the subprocessors listed above are located in the United States or operate globally. Where personal data is transferred outside the UK or the European Economic Area, we rely on one or more of the following safeguards:

• UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses for transfers from the UK to the US and other third countries.
• EU Standard Contractual Clauses (2021) for transfers originating in the EEA.
• Subprocessor self-certifications under applicable adequacy or data-transfer frameworks (such as the EU–US Data Privacy Framework), where the subprocessor maintains an active certification.

A copy of the relevant transfer mechanism for each subprocessor is available on request from legal@offry.co.

We retain personal data for as long as needed to provide the Service to you, and afterwards as required by law or to resolve disputes.

• Account data (Creator profile, business details, preferences): retained for the lifetime of the account, plus up to 6 years after account closure to satisfy UK record-keeping requirements (HMRC, Companies Act).
• Transactional records (offers, payments, installments, refunds): retained for 7 years after the transaction to satisfy UK tax, accounting, and anti-money-laundering obligations.
• Webhook endpoint configuration (destination URL, signing secret, subscribed events): stored in our database while the endpoint is active. When you delete an endpoint, the row and its signing secret are removed from our database immediately, and we issue a deletion request to our delivery subprocessor (Hookdeck).
• Webhook delivery history (request/response logs and payload snapshots): held by Hookdeck Outpost on our behalf and subject to Hookdeck's published retention schedule for our current plan tier. Deleting a destination removes its configuration at Hookdeck; existing delivery records age out per that retention schedule rather than being purged on demand.
• Document acceptance records (which version of Terms, Acceptable Use, or Privacy Policy you accepted, when, and the hash you accepted): retained for the lifetime of the account plus 6 years after closure, matching account-data retention. These records are necessary evidence of contract formation and cannot be deleted on request while the retention period applies.
• Server logs: retained for up to 90 days for security and operational purposes, after which they are deleted or de-identified.
• Marketing-suppression list: if you opt out of marketing communications, we keep the minimum information needed to honour that opt-out indefinitely.

When you request deletion (see §8), we honour the request within 30 days, except where law requires us to retain specific records longer. In those cases we will tell you which records we are retaining and the legal basis for doing so.

Depending on where you live, you may have some or all of the following rights in relation to personal data we hold about you. You can exercise any of them by emailing legal@offry.co.

Under UK GDPR and EU GDPR, you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data rectified.
• Have data erased ("right to be forgotten"), subject to §7.
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time where processing is based on it.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local EU supervisory authority.

Under the CCPA / CPRA (California), you have the right to know what personal information we collect about you, to delete it, to correct it, to opt out of any "sale" or "sharing" of it (we do not sell or share personal information for cross-context behavioural advertising), and to not be discriminated against for exercising these rights.

We aim to respond to verified requests within 30 days (1 month), extendable to 90 days for complex requests as permitted by law. We may need to verify your identity before fulfilling a request.

Offry uses a small number of strictly necessary cookies and similar local-storage entries to keep you signed in, remember your preferences, and protect the Service against abuse. These cookies do not require consent under UK PECR or the EU ePrivacy Directive.

We do not currently use third-party advertising, behavioural-tracking, or cross-site analytics cookies. If we add product analytics or similar tooling in the future, we will update this section and (where required) present a cookie-consent prompt before setting non-essential cookies.

Offry publishes a browser extension that lets a Creator build and send an offer without leaving a video call. It is for Creators only — Prospects never install it, and nothing in this section describes processing of Prospect data beyond what §3 already covers.

Where it runs. The extension adds anything to the page on five named meeting sites only: Google Meet, Zoom, Microsoft Teams (work and school), Microsoft Teams (personal), and Whereby. It also has permission to reach the Offry dashboard, which is how it uses the session you are already signed in with — but it adds nothing to that page and reads nothing from it. It runs nowhere else, and cannot: the permitted sites are fixed in the extension's manifest and are shown to you by your browser before you install it.

What it reads on those sites. The web address of the meeting tab, in order to tell that a call is in progress and which call it is. It does not read, record, or transmit the contents of a meeting: no audio, no video, no chat messages, no participant list, no page content, and no data from any other tab. The only thing it adds to a meeting page is a small card of Offry's own.

What it stores on your device. Offer drafts you have started but not sent (including a Prospect's name and email), a copy of your recent offers so the panel opens without a blank screen, a copy of your own account details for the same reason, which call you are currently on, whether you have already dismissed the prompt on that call, and which of the two layouts you prefer. All of it is held in your browser's own extension storage. Everything except the layout preference is cleared when you close your browser; the layout preference persists until you change it or uninstall. This data is not transmitted anywhere by the extension. Offer content reaches Offry only when you create or send an offer, and is then handled as described in §3 and §4.

Connecting your calendar (optional). You may connect a Google Calendar so that the offer you start on a call arrives with the Prospect's name and email already filled in. This is off unless you turn it on, from Settings → Account, and the extension works without it.

If you turn it on, you grant Offry the calendar.events.readonly scope on your Google account. The access token is held on Offry's servers and is never given to the extension or to your browser. When you are on a call and the panel needs a name, our server asks Google for the events on your primary calendar within one hour either side of the current time, and looks for the single event whose joining link is the call you are actually on — matched on the meeting identifier in the link, not on the time. From that one event we take the invitees' names and email addresses; we take nothing from any other event, and no event title, description, location, or attachment is stored. Where an invite has more than fifty invitees on it, we take nobody, and you type the address as usual. The names and addresses we do take are held only in your browser's extension storage for the length of that call, on the same terms as everything else in What it stores on your device above, and reach Offry's database only if you go on to create an offer for one of those people.

Offry's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, we do not sell it, we do not transfer it to anyone except as needed to provide this feature or where required by law, and we do not allow humans to read it except with your explicit consent, for security or legal purposes, or where the data has been aggregated and anonymised.

You can withdraw the grant at any time from your Google account's permissions page, which stops the reads immediately and leaves your Offry sign-in intact. We do not retain a copy of your calendar.

Signing in. The extension has no login of its own. It reuses the session you already have with the Offry dashboard, and never sees your password or your Stripe credentials.

Error diagnostics. The extension sends sanitised crash reports to Sentry, as our web app does. They are limited to the extension's own windows — never a meeting page — and are further restricted: no meeting-page address, no account identifier, and no record of what was clicked or typed. What a report can contain, besides the error itself, is the addresses of the extension's own requests to Offry, which is how a failed request is told from a failed render. On Firefox, this is declared as an optional data-collection permission which you may refuse; refusing it stops the reports being sent at all.

Clipboard. When you press Copy, the extension writes the offer link to your clipboard. It never reads your clipboard.

Removing it. Uninstalling the extension deletes everything it stored on your device. Offers already created remain in your Offry account and are retained as set out in §7.

We do not sell data collected by the extension, transfer it to third parties for purposes unrelated to the extension's single purpose, or use it to determine creditworthiness or for lending purposes. The extension is distributed through the Chrome Web Store, Microsoft Edge Add-ons, addons.mozilla.org, and the Apple App Store, each of which applies its own policies in addition to this one.

Connections to Offry are encrypted in transit using TLS. We follow Stripe Connect security best practices and never store full card numbers or bank-account credentials; those go directly to Stripe. Webhook signing secrets and similar sensitive credentials are stored with restricted database access.

We maintain organisational controls including least-privilege access to production systems, audit logging of administrative actions, and incident-response procedures for suspected security events. If a data breach occurs that materially affects you, we will notify you and the relevant supervisory authority within the timeframes required by applicable law.

Suspected vulnerabilities should be reported in good faith to legal@offry.co.

Offry is not intended for use by individuals under 18 and is designed for business use. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, email legal@offry.co and we will delete it.

We may update this Privacy Policy from time to time. We will announce material changes at least 14 days before they take effect via in-app notification or email. The "Last updated" date at the top of this page tells you when the most recent change was made.

Privacy questions go to legal@offry.co.

For postal correspondence, write to MZED Studio Limited, 8 Eastfield Close, Townhill, Swansea, Wales, SA1 6SG.