Privacy policy

1. Controller and processor

Offmy’s role depends on the data concerned:

• Data of our direct users (agencies and their team members). When you create an account, subscribe or contact our support, Offmy acts as data controller. This policy primarily addresses this processing.
• Data processed on behalf of our clients (creators and fans). When an agency uses the Service to process the data of its creators and their fans, the agency is the data controller and Offmy acts as a data processor, solely on its documented instructions, in accordance with Article 28 of the General Data Protection Regulation (GDPR).

If you are a creator or a fan whose data is processed by an agency through the Service, please address your requests to that agency first; we assist it in responding.

2. Data we collect

As data controller, we collect the following categories of data:

As data processor, we process on behalf of agencies the data they import or generate in the Service, in particular from the platforms they connect to it (MYM): their creators’ account data (profile, revenue, sales), their fans’ data (usernames, subscription dates, purchase history, online status), the text content of messages sent and received, content entered by the agency (notes, tags, message templates, bulk messages, automations), team members’ activity (logins, messages sent, attributed sales, shifts) and derived data produced by the Service (statistics, spending indicators, translations, profiles, suggestions).

Media. We do not store the media of connected accounts: photos, videos and audio files remain on the platform they come from. We only keep their identifier and technical metadata (type, format), used to display them on demand from that platform. Only the profile pictures you upload yourself to the Service are stored by us.

We do not intentionally collect special categories of personal data within the meaning of Article 9 of the GDPR. If an agency processes such data through the Service, it does so as data controller and must have a lawful basis under Article 9(2) of the GDPR.

3. Purposes and lawful bases

As data controller, we process your data for the following purposes:

As data processor, we process agencies’ data solely to host, store and secure it, provide the Service’s features, provide technical support and maintenance, and comply with our legal obligations.

4. Recipients

Your data is accessible only to authorized Offmy personnel who need it for their work. It may be disclosed:

• to our technical service providers, acting as processors, including Google Cloud and PlanetScale (hosting), Stripe (payments), MailerSend (email delivery), PostHog and Sentry (usage measurement and error tracking);
• to our professional advisers (lawyers, accountants, auditors, insurers);
• to administrative or judicial authorities, where required by law or to establish, exercise or defend our rights;
• to your agency’s administrators, who can see your account and usage data according to the permissions set in the Service;
• to a buyer or successor, in the event of a merger, sale or reorganization of all or part of our business.

Our service providers may only process your data for the purposes we set and in accordance with our instructions. We do not sell your data.

5. Hosting and international transfers

Your data is hosted in the European Union, in Belgium, in Google Cloud data centers (europe-west1 region), including the database, operated by PlanetScale on the same infrastructure.

As Offmy is a company incorporated in the United States, your data may be accessed from outside the European Union, including from the United States, and processed by some of our service providers outside the European Economic Area. These transfers rely on one of the following safeguards:

• an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified providers;
• the standard contractual clauses adopted by the European Commission, in accordance with Article 46 of the GDPR.

You can obtain details of these safeguards by contacting us.

6. Security

We implement appropriate technical and organizational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access: encryption in transit and at rest, role-based access control, separation of environments. We apply the same measures to the data we process on behalf of agencies. As no system is completely secure, we cannot guarantee absolute security.

7. Data retention

• As data controller, we keep your data for as long as necessary for the purposes described above, then for the periods required by our legal, tax and accounting obligations.
• As data processor, we keep agencies’ data for the term of their contract, then delete or anonymize it, unless the law requires otherwise.
• We may keep some data longer where necessary to comply with a legal obligation, resolve a dispute, enforce our terms or establish, exercise or defend our rights.

When these periods expire, the data is securely deleted or irreversibly anonymized.

8. Your rights

For the data for which we are the controller, you have the following rights, under the conditions set by the GDPR:

• the right of access to your data;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object, including to direct marketing;
• the right to data portability;
• the right to withdraw your consent at any time, where processing is based on it.

To exercise these rights, write to us at contact@offmy.co. We may ask you to prove your identity. We respond within one month, which may be extended by two months for complex requests.

For data processed on behalf of an agency, please address your request to that agency, which is the data controller; we assist it in responding.

You may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. In France, this is the CNIL (cnil.fr).

United States residents. We do not sell your personal information or share it for targeted advertising. Depending on your state’s law, including in California, you may request to know the information we hold about you, and to have it corrected or deleted. Exercising these rights will not result in any discrimination.

9. Cookies and similar technologies

The fansquare.so website sets no advertising or audience measurement cookies: it only uses your browser’s local storage to remember the theme you chose. The app uses cookies and local storage needed to keep you signed in, as well as usage measurement and error tracking tools (PostHog, Sentry). You can set your browser to refuse cookies; some features may then stop working.

10. Minors

The Service is reserved for adults. We do not knowingly collect data about people under 18. If you believe we hold such data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. The date of the last update appears at the top of the page. For material changes, we notify registered users by email or through a notice in the Service.

12. Contact us

Offmy, a company incorporated in the United States, publisher of Fansquare.

By email: contact@offmy.co