OffensAI Logo

Legal

Privacy Policy

How we collect, use, and protect your data at OFFENSAI.

Privacy Policy for OffensAI

Effective Date: 06/25/2025 Last Updated: 07/03/2026

Welcome to OffensAI Inc., a Delaware Corporation ("OffensAI," "we," "us," or "our"). We are committed to protecting your privacy. This Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard your information when you visit our website https://www.offensai.com (the "Site") or use any related software-as-a-service (SaaS) platform, products, or services (collectively, the "Services"). By using the Site or Services, you agree to the terms of this Policy.

2. How We Use Your Information

We use your information to:

  • Provide and maintain the Services.
  • Process your transactions and manage your account.
  • Provision and manage Sandbox and Trial accounts, and send passwordless "magic link" sign-in and account-lifecycle emails (e.g., welcome, expiry reminders).
  • For the Trial, connect to the cloud environment you authorize in order to perform the security validations you request and generate findings.
  • Respond to your inquiries and provide support.
  • Send administrative, promotional, and technical communications.
  • Improve our Site and Services through analytics and research.
  • Detect and prevent bots, fraud, and abuse (including through CAPTCHA/bot-detection services), and ensure compliance with legal obligations.

3. How We Share Your Information

3.1 Service Providers and Sub-Processors

We may share your information with trusted third-party service providers ("sub-processors") who assist us in operating the Site and Services. These currently include:

  • Cloudflare, Inc. — bot detection and abuse prevention (Turnstile CAPTCHA) on our sign-up and contact forms.
  • Amazon Web Services, Inc. (AWS) — cloud hosting and transactional email delivery (including Sandbox and Trial sign-in emails).
  • Google LLC — website analytics (Google Analytics).
  • HubSpot, Inc. — customer relationship management for demo and contact requests.
  • Payment processors, where applicable.

These providers are authorized to use your information only as necessary to provide services to us. This list may change as our providers change; contact us at privacy@offensai.com for the current list.

We may disclose your information:

  • To comply with legal obligations, such as court orders or subpoenas.
  • To protect our rights, property, or safety, or that of others.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

4. Your Rights and Choices

4.1 General Rights

You have the right to:

  • Access, update, or delete your personal information.
  • Object to or restrict certain processing of your information.
  • Receive a copy of your information in a portable format.

4.2 California Privacy Rights (CCPA)

If you are a California resident, you may:

  • Request disclosure of the categories and specific pieces of personal information we have collected about you.
  • Request deletion of your personal information.
  • Opt out of the "sale" of your personal information, if applicable.

To exercise these rights, please contact us at privacy@offensai.com.

4.3 GDPR Compliance (For EU/EEA Residents)

If you are located in the European Union (EU) or European Economic Area (EEA):

  • Data Subject Rights: You have the right to access, correct, delete, and restrict processing of your personal data.
  • Withdraw Consent: Where consent is the legal basis for processing, you may withdraw it at any time.
  • Data Transfers: We ensure adequate safeguards for transferring personal data outside the EU/EEA, such as Standard Contractual Clauses (SCCs).

To exercise your GDPR rights, please contact us at privacy@offensai.com.

5. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes outlined in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Sandbox and Trial environments are time-limited: Sandbox access is short-lived, and Trial access is limited to a defined evaluation period. Data generated during a Sandbox or Trial, including any security findings, is retained for a limited period after the environment ends and is then deleted or anonymized, unless you convert to a paid plan or we are required to retain it by law.

6. Security

We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. However, no security system is entirely foolproof, and we cannot guarantee absolute security.

The Site or Services may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these third parties. Please review their privacy policies before interacting with them.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on the Site or through other communication methods. Your continued use of the Site or Services after such changes constitutes your acceptance of the revised Policy.

9. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at: