Privacy Policy

1. Who We Are

OfferInbox is an AI-powered document comparison platform. We are the data controller responsible for your personal data processed through this website. If you have questions about this privacy policy or how we handle your data, contact us at [contact@offerinbox.com].

2. What Data We Collect

Account data: None. OfferInbox does not require an account or an email address to use the comparison service.

Pro waitlist data: If you voluntarily join the Pro waitlist, we store your normalized email address, the wording/version of your consent, the signup source, and signup time. This information is kept separately from private project data.

Uploaded documents: Documents you upload are processed temporarily to provide the comparison service. The project, files, and derived comparison data are scheduled for permanent deletion 30 days after project creation. You can delete them earlier from the project page.

Usage data: Our hosting provider processes technical request data needed to deliver and protect the service. Vercel Web Analytics additionally provides aggregated, cookie-free page-view statistics. Private project pages and API routes are excluded from Vercel Analytics. On the server, we count product milestones, processing outcomes, byte totals, duration, AI model names, and token totals. These measurements do not contain IP addresses, filenames, secret project links, document content, extracted values, or AI prompts.

Advertising data: When advertising is enabled and you provide any legally required consent, Google may process device, consent, and usage information to provide or measure ads on public editorial pages. Uploaded documents, extracted offer data, and private project pages are excluded from advertising.

3. How We Use Your Data

We use your data exclusively to provide the OfferInbox comparison service:

• To process uploaded documents and build structured comparisons
• To send document text to our AI provider (Google Gemini API) for extraction and analysis
• To maintain service security and prevent abuse
• To generate server logs for debugging and performance monitoring
• To measure aggregate product completion, reliability, processing time, storage use, and AI token use without storing document content in analytics
• To measure interest in OfferInbox Pro and, with your consent, email you about its launch and occasional product updates
• To finance the free service with ads on public editorial pages when enabled

4. Legal Basis (GDPR Art. 6)

Art. 6(1)(b) — Contract performance: Processing your uploaded documents is necessary to provide the service you requested when you created a project.

Art. 6(1)(f) — Legitimate interests: Server logs and data-minimised operational measurements are maintained for security monitoring, fraud prevention, cost control, product improvement, and service stability. These legitimate interests are not overridden by your rights given the limited and aggregated data involved.

Art. 6(1)(a) — Consent: Pro waitlist emails are based on the explicit consent provided with the signup form. You can withdraw it at any time by contacting contact@offerinbox.com.

5. Data Retention

Projects, uploaded files, extracted data, comparisons, and secret access tokens are retained for 30 days after project creation, then automatically deleted. Users can delete a project immediately from its project page. Infrastructure logs and backups follow the retention controls of the configured hosting and database providers.

Project-linked measurement milestones are deleted with the project. Anonymous daily totals contain no project or user identifier and may be retained longer to compare service reliability and resource use over time.

Pro waitlist data is retained until you withdraw consent or for a maximum of 24 months after signup, whichever occurs first. The daily retention job removes entries that reach this limit.

See our full Data Retention Policy for a detailed schedule.

6. Third-Party Services (Sub-Processors)

We use the following sub-processors to deliver our service:

• Neon — managed PostgreSQL database in the configured EU region. Privacy policy
• Cloudflare R2 — private document storage configured with EU jurisdiction. Privacy policy
• Google Gemini API or OpenAI API — the configured AI provider processes document content for extraction and comparison.
• Vercel — application hosting, CDN, and aggregated cookie-free web analytics. Private project routes are excluded from analytics events. Privacy policy
• Google AdSense — advertising on public editorial pages only, when advertising is enabled and subject to applicable consent choices. Privacy policy

Full list: Sub-Processor List

7. Your Rights (Art. 15–22 GDPR)

Under GDPR you have the right to: access your data, rectify inaccurate data, erase your data (right to be forgotten), restrict processing, receive your data in a portable format, and object to processing.

Full details: Your GDPR Rights

8. How to Exercise Your Rights

Email [contact@offerinbox.com] with the subject "GDPR Request". We will respond within 30 days.

9. Supervisory Authority

You have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria. www.dsb.gv.at

10. Changes to this Policy

We may update this policy as our service evolves. Material changes will be noted with an updated date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.