Privacy policy

Offr is an order-management product run by Vereon Ltd ("we", "us"). This page says what Offr holds, why, who else handles it, how long we keep it, and what you can ask us to do. Write to us about any of it at info@vereon.tech. Last updated 20 October 2026.

Who is responsible

For your account and your subscription, we decide how the information is used (we are the "controller"). For what a business puts into Offr — its products and prices, and its customers' names, contact details, answers and orders — the business decides, and we handle it on their behalf (we are their "processor"). If you ordered something through a business's page, that business is responsible for your details; send requests about a order to them first, and we help them answer. A business that needs a data processing agreement can ask us for one.

What we hold

• Your account: your name, email address and time zone, and your password (stored only as a one-way scrypt hash; Offr runs its own sign-in). If you sign in with Google, Google's id for you; with Microsoft, Microsoft's id for your account (and its organisation's). Whether your email is confirmed, and which businesses you belong to with what role.
• What your business puts in: products, prices, photos, stock, delivery and order policies, discount codes, your bank details as you choose to show them to customers, and who on the team did what and when.
• Your customers' orders: the name, contact details and delivery address they give at checkout, their answers to your product questions, the orders themselves with their payment, refund and tracking records, back-in-stock requests and enquiries. Every order snapshots what was bought and at what price, so the record stays true even after you edit your products.
• My orders: when a customer signs in to a business's My orders page, the one-time code we email them (kept only as a keyed hash, and usable for 15 minutes), the name and phone number they correct there, and any request they send the business to delete their data.
• Payment-proof images: the bank-transfer receipt a customer uploads. Proofs are stored privately and reached only through short-lived signed links; they are deleted on the schedule below, because a receipt doesn't need to outlive its review.
• Emails we send for you: order confirmations, payment nudges, “on its way” with tracking, follow-ups, cancellations, back-in-stock alerts and enquiry acknowledgements — each recorded against the order so nothing sends twice. The same goes for WhatsApp messages when a business has turned WhatsApp on, along with what each one cost.
• A business's sending mailbox: if a business sends its emails from its own address, the sign-in that lets Offr send as it (Google or Microsoft access tokens, or SMTP details), encrypted.
• Offy and connected AI assistants: what you ask Offy, his answers and the changes you approve, kept for a short while so a conversation can carry on; and which AI assistants (Claude, ChatGPT, Gemini) you have connected to Offr. Changes made through them are recorded under your name.
• Running the product: technical logs (time, address, errors) kept to keep Offr working and secure. We don't track the pages you visit, and there is no advertising or analytics — on the dashboard, the shop pages or the order code on a business's website.

Why we use it, and on what basis

• To provide the product you signed up for — taking orders, holding spaces, sending the order emails and WhatsApp messages, billing the subscription: because it is needed to perform our contract with you or your business.
• To keep Offr secure, prevent misuse and fix faults: because we have a legitimate interest in a safe, working product, which doesn't override your rights.
• To keep financial records: because the law requires it.

We do not sell your information, use it to advertise to you, or use it to train AI models. Your customers' details are never used to market to them.

Google user data

Offr asks Google for as little as it can, and only when you choose to use Google:

• Signing in with Google (openid, email, profile): we read your name, email address, whether Google has confirmed that address, and Google's id for you, to sign you in or create your account. We keep no Google token afterwards.
• Sending a business's emails from its Gmail (gmail.send): we send that business's order emails to its own customers from its address, so they appear in its Sent folder. Offr can only send: it never reads, searches, changes or deletes anything in the mailbox. The access it needs is stored encrypted, and is deleted when the business disconnects the mailbox or is closed. You can also remove Offr's access at any time from your Google Account's security settings.

We don't share Google user data with anyone, use it for advertising, sell it, or use it to train AI models, and no person at Vereon reads it unless you ask us to help with a problem or the law requires it. Offr's use and transfer of information received from Google APIs adheres to the Google API Products User Data Policy, including the Limited Use requirements.

Microsoft user data

• Signing in with Microsoft (openid, email, profile): we read your name, email address, whether Microsoft has confirmed that address, and Microsoft's id for your account, to sign you in or create your account. Signing in gives Offr no access to your mailbox or files, and we keep no Microsoft token afterwards.
• Sending a business's emails from its Microsoft 365 or Outlook.com mailbox (Mail.Send): Offr only sends that business's order emails, and never reads the mailbox. The access it needs is stored encrypted, and is deleted when the business disconnects the mailbox or is closed.

Offy and AI

Offy, Offr's assistant, runs on Amazon Bedrock in London: your questions and the parts of your business he needs to answer them stay in the UK under AWS, are not kept by the model provider, and are not used to train any model. AI assistants you connect yourself (Claude, ChatGPT, Gemini) see what you ask them to fetch from Offr, under their own privacy terms. Neither can reach billing, payment details, passwords, sign-in settings or customers' contact details.

Customer payments

Money for orders moves directly between a customer and the business — a bank transfer to the business's own account, or a card payment on the business's own payment page or its own Safepay account. Offr records what the business confirms (or what Safepay reports) and stores the uploaded receipt; it never holds the money and never sees anyone's card number or bank balance.

Who else handles it

The people in your business see it according to their role. These providers handle it for us, each only as far as their job needs:

Nobody else, unless the law requires it.

Sending data outside the UK

Offr runs in the UK (AWS London, eu-west-2), so your data mostly stays here. Stripe handles subscription billing in the EU and US, and the optional providers in the table above (Google, Microsoft, Telnyx and Meta) work where it says, only when you or a business choose them; Safepay is a business's own provider, under its own agreement with them. When data leaves the UK it is protected the way UK law requires, by the UK's adequacy regulations (including the UK–US data bridge) or by the International Data Transfer Agreement or Addendum in our contract with the provider. Ask us for details.

How long we keep it

Your rights

• See and take your data: your catalogue, orders and customers are visible in the dashboard, and the owner and admins can export orders and customers as CSV. A business's customers see their own orders in its My orders page. For a copy of everything we hold about you, write to us.
• Correct it: your own details are editable in Your profile, and the owner and admins edit the business's under Settings. A customer can correct their name and phone number in the business's My orders page.
• Delete it: you can delete your account from Your profile, and a business owner can close the business from Settings, which deletes it and its records straight away. A business's owner or admins can erase one customer's personal details from that customer's page; the money records stay, without a name, because tax law requires it. A customer can ask the business to do that from My orders.
• Object, or ask us to restrict how we use it: write to us.

We answer within a month. You can also complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, your own data protection authority. If you are a business's customer, point your request at the business first — the order is theirs — and we will help them answer it.

Cookies and storage in your browser

Offr sets no advertising or analytics cookies, so there is nothing to opt into. The dashboard keeps what it needs to work in your browser: your sign-in and which of your businesses you last had open. The public shop pages and the embedded shop page track nothing. The one thing they keep is for a customer who signs in to My orders: a secure, HttpOnly cookie that keeps them signed in to that one business for up to 30 days, removed when they sign out. Without it, a customer returns to their order through the private link in their confirmation email.

Security

Everything travels encrypted. Passwords are stored only as one-way hashes, payment-proof images are reachable only through links that expire, and every record carries the business it belongs to, checked on every request. If something ever went wrong with your data, we would tell the Information Commissioner's Office within 72 hours and tell you without delay if it put you at risk.

Children

Offr accounts are for businesses, and you must be 18 or over to run one. A business's customers order as guests, without accounts; a business that sells to under-18s is responsible for collecting those details lawfully.

Changes

If this page changes in a way that matters, we tell business owners by email first.