Privacy Policy

This policy explains what personal data Off Hours ("we", "us"), operated by Kosta Rakonjac, Serbia, collects and why. We are the data controller for the data described here. If you have any question, write to hello@offhoursagent.com.

Two kinds of people, two roles

Our customers are the businesses who buy Off Hours. For their data we are the controller. Their website visitors chat with the plugin on the customer's own site. For that conversation data the customer is the controller and we are their processor, acting only on their instructions.

What we collect from customers

• Your name and email, to run your account and answer support.
• Your website address, to activate your licence and stop it being used elsewhere.
• Billing information, handled entirely by Lemon Squeezy, Inc., which sells the subscription to you. We never see or store your full card details.
• Usage counts (how many conversations your plan has used), to enforce your allowance.

If a partner referred you

Some customers arrive through one of our affiliate partners, on a link carrying that partner's id. If you go on to buy, that id is passed to Lemon Squeezy along with the checkout so the partner is paid, and that happens whatever you answered about cookies, because nothing has to be stored in your browser to do it. Saying yes additionally loads Lemon Squeezy's referral script, which remembers the partner across visits rather than only during this one. The full detail is in the cookies section below.

Because the partner is paid a share of your payments, we share with them the state of the thing their commission depends on: that you became a customer, your name and website, your plan, and when your subscription ends or a payment stops. They never see your card details or your conversations, and the updates stop when their commission stops. In GDPR terms this is our legitimate interest in honest commission accounting with the partner who introduced you. If you would rather not be named to them, email us and we will keep you anonymous in those updates.

What the plugin handles for visitors

When a visitor chats on a customer's site, their messages are sent to our service to generate a reply, and to Google (Gemini) as our sub-processor for that purpose only, under API terms that do not allow the messages to be used for training Google's models. An ordinary chat is not written down on our servers: we store a count of conversations, because that is what the subscription meters, and the messages themselves are held only in the visitor's own browser for the length of their visit.

Three things are the exception, and each is deleted automatically after 90 days. If a visitor asks to speak to a person, the conversation up to that point and everything said afterwards is stored, because that is what the business reads in order to answer them. If the assistant could not answer a question, that question is stored in the visitor's own words so the business can see what to add to its own information; any phone number or email address in it is removed before it is written down. If a visitor leaves their details, the lead includes a short summary of the enquiry drawn from the conversation.

If a visitor leaves a name and phone number, that lead is delivered to the business, and a copy (name, phone, a short summary of the enquiry) is held on our systems so a lost email can be re-sent and the business's weekly summary can be built. That copy is deleted automatically after 90 days. The business's own copy, in their WordPress and their inbox, belongs to them. A business can ask us to delete anything earlier at any time, and the plugin can be set to purge all visitor data on uninstall.

The two chat demos on this website work the same way. What you type into them is sent to our service and to Google (Gemini) to generate the reply, and nothing else. The practice in the demo is fictional, so a name and phone number entered there is not stored or delivered to anyone, and neither demo is used to build a profile of you.

If you give the demo on our home page your own website address, we fetch a few pages of that website and send their text to Google (Gemini) so the assistant can answer as your business. We keep the resulting summary for one hour so the conversation can continue, and then it is deleted automatically. That summary includes the address you typed and whatever contact details your pages show publicly, because that is what the assistant answers from. We do not keep a copy of the pages themselves, we do not record the address in our analytics, and we do not email you about it. Only pages your website already serves publicly are read, and we never sign in to anything.

What we do not do

• We do not sell personal data. Ever.
• We do not use conversations to train our own models.
• We do not run advertising trackers of any kind. We do not sell or share anything for advertising, and nothing here follows you to other websites.
• We do not record your screen, track your mouse, or log the clicks you make. We count four things on this website and nothing else: that a demo message was sent, that the pricing slider was moved, that a checkout link was clicked, and that an email was submitted. Those counts run through PostHog in anonymous mode, which stores no identifier in your browser, so they cannot be joined up into a picture of you. What you type into either demo is never part of them.

Sub-processors

• Google (Gemini API), to generate chat replies.
• Cloudflare, hosting and request processing.
• Lemon Squeezy, Inc., which sells the subscription and handles payment and tax.
• Resend, which sends lead and account notification emails on our behalf.
• PostHog (EU region), which counts the four website interactions listed above. It receives no name, no email and nothing you have typed.
• Google Analytics, which counts page visits, and only if you agreed when we asked. Decline and it is never loaded at all.
• Lemon Squeezy's referral script, which remembers across visits which partner introduced you. Also only if you agreed. Lemon Squeezy is told which partner introduced you at the checkout either way, since it is the one paying them.
• Lovable, which hosts this website and injects its own loading-speed measurement into every page.

Where data is processed, and which law applies to you

We are based in Serbia, which is outside the EEA, and we prefer providers with EU data handling. Where personal data reaches us, or one of the providers above, from the EEA or the UK, that transfer relies on the European Commission's Standard Contractual Clauses, with the UK Addendum where UK data is involved.

We apply one standard everywhere rather than a different policy per country, and that standard is the GDPR, because it is the strictest of the regimes we deal with. If you are in the EEA or the UK, that is your law and the rights below are your statutory rights. If you are elsewhere, you get the same treatment as a matter of our policy, and your own country's law may give you further rights on top:

• California. We do not sell or share personal information as the CCPA defines it, and we never have, so there is nothing to opt out of. You can still ask what we hold, ask for a copy, and ask us to delete it, and we will not treat you differently for asking.
• Other US states, the UK, Canada, Brazil, Australia, Japan, Singapore, Korea and India have privacy laws that broadly track the same rights of access, correction and deletion. Use the same address below and we will honour them.
• Mainland China. We do not target the Chinese market and do not keep data in China, so we do not hold ourselves out as compliant with PIPL. If you plan to run the assistant on a site aimed at users in mainland China, take local advice first, because PIPL has requirements (a local representative, and localisation for some data) that this product does not meet.

That last point is the honest one. It is easy to write a policy claiming worldwide compliance and much harder to be it, and claiming a standard we do not meet would be a worse problem than naming the limit.

Why we are allowed to process this data

In GDPR terms: we process customer account and billing data to perform our contract with you, usage counts and abuse prevention under our legitimate interest in running the service safely, and visitor conversation data on the instructions of the business you are talking to, which is responsible for its own lawful basis.

Children

Off Hours is sold to businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has left their details through a chat, email us and we will delete the record.

Your rights

Under the GDPR you can ask to access, correct, export or delete your personal data, and object to certain processing. Email hello@offhoursagent.com and we will respond within one month. You can also complain to your local data protection authority.

Cookies

Until 15 August 2026 this page said the website set no cookies at all. That had stopped being true when Google Analytics was added, and we would rather say so plainly than quietly reword it. What follows is what actually runs today.

Google Analytics, only if you agree. The first time you visit we ask. Say no and it is never loaded, nothing is written to your browser by it, and the site behaves exactly the same. Say yes and Google Analytics sets its own cookies (_ga and one named after our property) so it can tell a returning visit from a new one. Your choice is remembered in your browser under aca-cookie-consent so we stop asking. To change your mind at any time, use the Cookie settings link at the bottom of every page: it brings the question back. Until 19 August 2026 this paragraph told you to clear the site's data in your browser instead, which was the only way there was, and was not a fair match for how easy saying yes had been. If you change a yes to a no, we delete the analytics identifiers already in your browser and reload the page, because a tag that is already running cannot be called back any other way.

Remembering the partner who sent you, only if you agree. Some visitors arrive through one of our affiliate partners. Crediting that partner for something you buy during this visit needs nothing stored here at all: their id travels in the link you arrived on and is handed to Lemon Squeezy with the checkout. What the question above governs is remembering it for longer. Say yes and Lemon Squeezy's referral script runs, which reads a set of characteristics of your device that together tell it apart from others, and stores a referral id in your browser, so the partner is still credited if you come back days later and subscribe then. It records which partner sent you, not who you are, and it is never used for advertising. Say no and it never loads, the partner is still credited if you buy today, and nothing about your device is read or kept.

Our host, which we cannot switch off from the page. The platform that serves this site injects its own small script (/~flock.js) into every response. It is added by the hosting platform rather than by our code, so the consent choice above does not govern it, and we will not pretend otherwise. It reports on how the site performs rather than on who you are, but we would rather describe what it leaves behind than summarise it kindly: whatever you choose above, it writes cookies named AMP_… and AMP_MKTG_… and an AMP_unsent_… entry in local storage, and those hold a device id and a session id that persist between visits. That is more than a loading-speed measurement, which is what this paragraph used to claim.

Checkout, and one cookie it sets early. Paying happens through Lemon Squeezy, in their overlay or on their store. The cookies for the purchase itself, and for crediting an affiliate who referred you, are theirs on their domain, and their privacy policy governs them.

One part of that does happen here, and the honest version is that it happens sooner than you would expect. Lemon Squeezy's checkout script loads on every page of this site, not only when you are buying, so a payments cookie named __stripe_mid is set on this domain on an ordinary visit, before you have gone near a checkout. It is a fraud and payment-integrity identifier rather than an advertising one, and the consent choice above does not govern it either, because the buttons that open a checkout have to work.

Your language, if you ask for one. If your browser is set to a language other than English, this site can translate itself using the translator built into the browser. That happens entirely on your own machine: no part of what you read, and nothing you type, is sent to us, to Google, or to any translation service in order to do it, and no request leaves your computer for it at all. If you press the button to translate, or press Show original to turn it off again, that one answer is kept under oh-language so we do not ask you the same question on every page. If the page translates itself automatically and you say nothing, nothing is stored. Closing the offer without answering is remembered only until you close the tab. The entry holds a language code and nothing else.

What still sets nothing. The four interaction counts described above run through PostHog in anonymous mode, which stores no identifier in your browser. The chat, both on this website and on a customer's own site, sets no cookies either: it keeps a few small entries in the browser's tab-scoped session storage. A random conversation id, so the replies stay in one conversation. A note that you dismissed the greeting bubble, and whether you had the chat open. And, since 20 August 2026, the conversation itself, so that following a link the assistant gives you does not throw away what you were in the middle of saying. That last one is the only one that holds anything you typed, and we would rather name it than let "two small entries" quietly cover it. All of them are written by your own browser, none of them is sent to us, all of them disappear when you close the tab, and nothing in them identifies you beyond what you chose to type.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and, for changes that affect customers materially, tell you by email before they take effect. Minor clarifications just update the page.

This document is a plain-language summary offered in good faith. It is not legal advice.