Privacy Policy

Last updated: August 5, 2026

This Privacy Policy explains how Offloda Labs Inc. (“Offloda”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards information when you use Offloda.ai and related services (the “Service”) — a white-label marketing operations platform sold to marketing agencies and used by those agencies on behalf of their own clients (“brands”).

By accessing or using the Service you agree to this Policy. If you do not agree, please do not use the Service.

1. Who this policy covers

The Service is business-to-business and invite-only. It is used by three kinds of people: (a) agency staff who operate the platform, (b) brand-client users invited by an agency to view reporting, and (c) super-admin operators of Offloda. When an agency uses Offloda to process information about its own clients or end-customers, the agency is the “controller” (or “business”) of that information and Offloda acts as its “processor” (or “service provider”). This Policy describes our own practices; your agency’s privacy policy governs its relationship with you.

2. Information we collect

• Account & profile data — name, email address, hashed password (managed by our authentication provider), agency and role, and the branding you configure (agency name, logo, colors, custom domains).
• Agency & brand data — the brands, campaigns, reports, ad copy, SEO/GEO analyses, CRM records, and other content you create or upload while using the Service.
• Connected-platform data — when you connect a third-party advertising or analytics account, we store the OAuth access/refresh tokens (or API keys) needed to reach it, and we retrieve the marketing performance data you request (for example from Google Ads, Google Analytics 4, Google Search Console, Google Business Profile, Google Merchant Center, Meta Ads, TikTok Ads, Reddit Ads, and OpenAI/ChatGPT Ads). We request the minimum scopes required and use this data only to provide the Service to you. Link-shared Google Sheets are read through Google’s public export endpoints and require no Google sign-in or data-access permission at all.
• Usage & activity data — we log platform requests (which tool or API was called, timestamps, duration, status, and the agency/user involved) for security, billing, rate limiting, and observability. We also collect standard technical data such as IP address, browser type, and device information.
• Billing data — subscription plan, seat/brand counts, and billing status. Payments are processed by Stripe; we do not store full card numbers on our systems.
• Cookies & affiliate tracking — we use strictly-necessary cookies for authentication and session management. On our public marketing site only, our affiliate partner (First Promoter) sets a referral cookie (e.g. _fprom_tid) to attribute sign-ups to the affiliate who referred you. See “Cookies” below.

3. How we use information

• To provide, operate, secure, and improve the Service.
• To generate the reports, dashboards, ad copy, and analyses you request.
• To authenticate users, enforce access controls, and prevent abuse.
• To process subscriptions, seats, and payments.
• To send transactional email (invitations, password resets, billing notices).
• To comply with legal obligations and enforce our Terms of Service.

4. AI processing

Some features (report insights, ad copy, marketing plans, SEO/GEO analysis, review-reply drafts) send relevant data — such as your campaign metrics and prompts — to our third-party AI provider (Anthropic Claude) to generate output. We only send what is needed to fulfill your request, and the output is shown to you inside the Service. We do not sell your data, and we do not use AI providers to build advertising profiles of you. We do not use your data — including data retrieved from connected platforms — to create, train, or improve any AI or machine-learning models, whether foundational or otherwise, and our AI provider processes API-submitted content under commercial terms that prohibit using it to train their models.

5. Google API Services & Limited Use

Offloda’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use data received from Google APIs (Google Ads, Google Analytics, Search Console, Business Profile, Merchant Center) only to provide and improve the user-facing features you see in the Service — dashboards, reports, and analyses you explicitly request.
• We do not use raw, aggregated, anonymized, or derived data received from Google APIs to create, train, or improve machine-learning or artificial-intelligence models (foundational, generalized, or otherwise). Where AI features process Google-sourced data (for example, generating a written insight from your analytics), it is processed solely to produce that output for you, at your request, and is never used for model training.
• We do not transfer Google user data to third parties except as necessary to provide the features you use, to comply with applicable law, or as part of a merger or acquisition (with prior notice consistent with this Policy). We never sell Google user data, and we never use or transfer it for serving advertisements.
• Humans do not read Google user data except with your explicit permission, where necessary for security or abuse investigations, to comply with applicable law, or where the data is aggregated for internal operations.

See our Google API Services Disclosure for the full list of Google permissions the Service requests and the feature each one powers.

6. Sub-processors

We rely on trusted third parties to run the Service. Each processes data only as needed to perform its function:

• Supabase — database, authentication, and backend hosting.
• Oracle Cloud — application server hosting.
• Cloudflare — CDN, DNS, and custom-domain (SaaS) provisioning.
• Stripe — subscription billing and payment processing.
• Anthropic (Claude) — AI generation.
• Google, Meta, TikTok, Reddit, and OpenAI — advertising/analytics platforms you choose to connect.
• Resend — transactional email delivery.
• First Promoter — affiliate referral tracking (marketing site only).

7. How we share information

We do not sell your personal information. We share information only: with the sub-processors listed above; with the agency that invited you (for brand-client users); when required by law or to protect our rights and users; and in connection with a merger, acquisition, or sale of assets (subject to this Policy).

8. Data retention

We retain your data for as long as your account is active and as needed to provide the Service. When an account, brand, or connection is deleted, we delete or de-identify the associated data within a commercially reasonable period, except where retention is required for legal, tax, security, or fraud-prevention purposes. You may disconnect a platform at any time, which revokes our stored tokens for it.

If a subscription lapses or is cancelled and the account becomes inactive and non-paying, the data is not deleted immediately — it remains dormant so the account can be reactivated without losing its history. We permanently delete dormant account data 12 months after the account becomes inactive. You can have it deleted sooner by requesting deletion; see our Data Deletion Instructions.

9. Security

We use industry-standard measures including encryption in transit (TLS), tenant isolation enforced at the database layer (row-level security), scoped access tokens, and least-privilege access controls. No method of transmission or storage is 100% secure, but we work to protect your information and to promptly address any incident.

10. International transfers

Offloda is operated from Canada and our providers may process data in Canada, the United States, and elsewhere. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

11. Your rights

Depending on where you live (including under Canada’s PIPEDA, the EU/UK GDPR, and the California CCPA/CPRA), you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at hello@offloda.ai; to delete your account and its data, follow our Data Deletion Instructions. If your data is managed by an agency using Offloda, we may direct your request to that agency as the controller. You also have the right to lodge a complaint with your local data-protection authority.

12. Cookies

We use only strictly-necessary cookies to keep you signed in and to operate the app. Our public marketing site additionally loads our affiliate partner’s referral cookie to attribute sign-ups; this is not loaded inside the app or on agency white-label domains. You can control cookies through your browser settings.

13. Children

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

14. Changes to this policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notifying you. Your continued use of the Service after an update constitutes acceptance of the revised Policy.

15. Contact us

Offloda Labs Inc.

834 Kananaskis Dr., Kingston, Ontario, K7P 0B1, Canada

hello@offloda.ai