PRIVACY
Privacy policy.
This policy covers the Offensa studio website at offensa.com and the keyword replies we send on Instagram. It explains what we collect, why, who else handles it, how long we keep it and what rights you have. It is written to meet the EU and EEA GDPR and ePrivacy rules, the UK GDPR and PECR, the Swiss FADP, the California CCPA/CPRA, other US state privacy laws and the FTC Act. Our products have their own policies: the PROOF website and waitlist are covered at proof.offensa.com/privacy, and HairTrimd by its own site.
The short version
- Visiting offensa.com collects almost nothing. There are no cookies, analytics or ad pixels.
- If you comment a keyword on one of our Instagram posts, we may send you one direct message with a link. We keep your Instagram ID and username to do that and to avoid messaging you twice.
- We do not sell personal information or share it for advertising, and we do not use Instagram data to build ad audiences.
- You can ask us for a copy, correction or deletion at any time at proof@offensa.com.
1. Who we are
Offensa operates this website and the Instagram replies described here. Offensa is the “controller” under the GDPR, UK GDPR and FADP and the “business” under the CCPA. Operator: Andrei Tigaieriu, an individual trading as Offensa, based in Iași, Romania. Privacy contact: proof@offensa.com.
2. What we collect
Visiting this website
Our host, Cloudflare, processes your IP address and request details (browser, page, time) to deliver the site, block abuse and keep it running. We do not use this data to profile you. The site has no forms and no accounts.
Writing to us
If you email us, we receive your email address, your name if you give it, and your message, and we use them to reply.
Commenting a keyword on our Instagram posts
When you comment a keyword we have chosen (for example “PROOF”) on a post of an Offensa Instagram account, Instagram tells us. We then receive and store your Instagram user ID, your username, the comment and post IDs, and which keyword matched. We do not store the full text of your comment. We send you one private reply by direct message with a link to the product page, and may post a short public reply under your comment. Some replies ask you to follow the account first. In that case we also store a small status (for example, that you tapped “I’m following”, and how many reminders we sent), and we ask Instagram whether you follow the account only to decide whether to send the link. We send no further marketing messages.
Instagram and Meta handle your account, your comment and the message thread under their own terms and privacy policy, as independent controllers.
3. Why we use it, and our legal bases
- Reply to your comment. Sending the link you asked for by commenting, and not sending it twice. Basis: legitimate interests (GDPR Art. 6(1)(f)) in answering people who ask for it, which we have weighed against your rights because we keep little and send nothing beyond the reply.
- Reply to your email. Basis: taking steps at your request (Art. 6(1)(b)) or legitimate interests.
- Security and abuse prevention. Basis: legitimate interests, and legal obligations where they apply (Art. 6(1)(c)).
- What we do not do. We do not sell personal information, share it for cross-context behavioral advertising, or build advertising profiles. No decision with legal or similarly significant effect is made by automated means. The keyword reply is a fixed rule, and a person can review anything on request.
You can object at any time (see section 8). An objection to messaging is always honoured.
4. Cookies and browser storage
This website sets no cookies and loads no analytics, advertising or social media scripts. Fonts are served from our own domain. We show no cookie banner because none is needed. We do not track you across websites, so there is nothing for a Do Not Track or Global Privacy Control signal to change.
5. Who we share it with
- Cloudflare hosts the website and the database where the Instagram records are stored, and sees request data such as IP addresses.
- Meta (Instagram) delivers the comments and messages. We send it only the replies described above.
- Offensa staff. A small number of authorised people use a protected admin tool, behind a login, to manage replies and view these records.
- Legal and safety. We may disclose information if required by law or a valid legal request, to protect someone’s safety, or to enforce our rights, and as part of a merger or sale of the business (we would tell you first).
6. International transfers
Cloudflare and Meta operate globally, and your information is processed mainly in the United States. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on safeguards such as the European Commission’s standard contractual clauses, with the UK Addendum and Swiss amendments where relevant. You can ask us for a copy of the safeguards at proof@offensa.com.
7. How long we keep it
- Instagram reply records (ID, username, comment and post IDs, matched keyword, status): up to 12 months, then deleted, or earlier on request.
- Emails to us: while the conversation is active and for up to 24 months afterwards.
- Request data at Cloudflare: kept by Cloudflare under its own schedule. See its privacy policy.
- Backups: deleted data may persist in provider backups for a short period before it is overwritten.
8. Your rights: EEA, UK and Switzerland
Under the GDPR, UK GDPR and FADP you have the right to be informed, to access your data and receive a copy, to correct it, to erase it, to restrict its use, to data portability, to object to uses based on legitimate interests, to withdraw consent where we rely on it, and to ask a person to review any automated result. Email proof@offensa.com. We reply within one month (30 days under the FADP), may extend by up to two further months for complex requests and will tell you why, and charge no fee unless a request is clearly unfounded or excessive. You can complain to your data protection authority: in the EEA, the authority where you live or work; in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to fix the problem first.
9. Your rights: United States
Depending on where you live (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states), you may have the right to know and access the personal information we hold about you, correct it, delete it, receive a portable copy, and opt out of sale, targeted advertising and certain profiling. We do none of the last three. You will not be discriminated against for using any right. In the past 12 months we have not sold personal information or shared it for cross-context behavioral advertising. We collect identifiers (Instagram ID, username, email address, IP address) and nothing sensitive, for the purposes in section 3 and for the periods in section 7. Email proof@offensa.com, and we confirm receipt within 10 business days and respond within 45 days, extendable once by another 45 days with notice. We verify requests by matching them to the username or email you give us. An authorised agent may ask on your behalf with your written permission. If we decline a request you may appeal by replying with the subject “Appeal”, and we answer in writing within the time your state requires. California’s “Shine the Light” law lets you ask which third parties received your information for their direct marketing (none did), and Nevada residents may opt out of sale (we do not sell).
10. Delete your Instagram data
To have us delete everything we hold about your Instagram account, email proof@offensa.com with your Instagram username, ideally from the email address linked to the account. We delete the records described in section 2 and confirm by email, normally within 30 days. You can also remove our access to anything you shared with us by blocking the account in Instagram. Deleting your comment on Instagram does not remove our record of it, so ask us as above.
11. Children and teens
Instagram requires users to be at least 13, and we do not direct anything to children. We do not knowingly collect personal information from children under 13, as COPPA and the GDPR’s age-of-consent rules require. If you believe a child has given us information, email proof@offensa.com and we will delete it. We do not show advertising to anyone or track them across sites.
12. Security and breaches
We keep the data to what each purpose needs, store it with Cloudflare, protect the admin tool behind a login limited to named people, and keep account credentials encrypted. If a breach puts your rights at risk we will tell you and the regulator as the law requires.
13. Changes
We will post changes here and update the effective date. If a change makes our use of your information materially broader, we will ask for your consent where the law requires it.
14. Contact
Offensa, Andrei Tigaieriu, Iași, Romania. proof@offensa.com.