Privacy Policy

Last updated: 2026-07-26

This Privacy Policy explains how Henia, a sole proprietorship based in Vietnam ("offloadcms") collects, uses, and protects personal data when you use our website and Service. We act as the data controller for account and billing data, and as a processor for the content you publish.

01Data we collect

Account data: your email address (used for magic-link sign-in), display name, and account settings.
Usage data: logs, device/browser metadata, and product analytics needed to operate and secure the Service. This includes your IP address and browser user-agent string.
Billing data: processed by Polar. We receive subscription status and invoice metadata; we never receive or store full card numbers.
Content: the WordPress data and media you import and publish.
Messages you send us: when you use a contact form on this website we record your name, email address, chosen topic, message, IP address and browser user-agent string, so we can reply and to prevent abuse.
Messages sent to a site you publish: if your published site uses a contact form, submissions to it (name, email, message and the sender IP address) are stored in your own instance's database, which you control.

02How we use data

To provide, maintain, and secure the Service.
To process subscriptions and send transactional email.
To respond to support requests.
To comply with legal obligations.

03Legal bases (GDPR)

We process data to perform our contract with you, for legitimate interests (security, product improvement), to comply with legal obligations, and with consent where required (e.g. non-essential cookies).

We share data with processors strictly to run the Service: Cloudflare, Polar, Resend, MailerSend, Amazon Web Services (SES), Amazon Web Services (Secrets Manager), OpenAI and Anthropic. We do not sell personal data. Note in particular that when you use the AI editor or the orchestration agent, the prompt you write and the site content the agent reads or edits are sent to OpenAI or Anthropic, the model provider behind the feature you use. See our DPA for the full subprocessor list and purposes.

05Cookies

We use essential cookies for authentication and security. See our Cookie Policy.

06Data retention

We retain account and content data while your account is active. When you close your account it is marked deleted immediately and stops being usable, and a scheduled purge permanently erases it 30 days later — this window exists so you can still request an export, or reverse an accidental closure, within the one-month response deadline the GDPR sets. Contact-form submissions made by visitors to a published site are deleted 90 days after they are received. Billing records are kept as required by law.

07Your rights

Depending on your location (GDPR / UK GDPR / CCPA), you may request access, correction, export (portability), deletion/erasure, or restriction, and may object to certain processing. Exercise these by emailing hello@offloadcms.com. Erasure requests trigger a real, logged hard-delete.

08International transfers

Data may be processed in regions where our providers operate. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

09Security

We use TLS in transit, scoped credentials, hashed session tokens, and least-privilege access. No system is perfectly secure, but we work to protect your data and will notify you of breaches as required by law.

10Children

The Service is not directed to children under 16 and we do not knowingly collect their data.

11Changes

We may update this policy; material changes will be notified. The "last updated" date reflects the current version.

12Contact

Privacy questions or requests: hello@offloadcms.com. offloadcms is operated by Henia, a sole proprietorship based in Vietnam. We have not appointed a Data Protection Officer or an EU representative; privacy requests are handled directly by the operator at the address above.

Questions about this policy? Email hello@offloadcms.com.