Privacy policy

Last updated: September 2026

This Privacy Policy explains how OFFBIT ("we", "our", "us") collects, uses, and protects your personal data when you visit our website (offbitdevices.com), use our online store, or use the OFFBIT mobile application.

We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and applicable Spanish data protection law.

1. Who we are
OFFBIT is operated by:
Bernat Eguiluz Serra
NIF: ES38883856X
Barcelona, Spain
hello@offbitdevices.com
offbitdevices.com
For any questions regarding your personal data, contact us at hello@offbitdevices.com.
We are not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. The data controller listed above handles all data protection matters directly.

2. Data we collect

2.1 Website and online store
When you visit our website or place an order, we may collect:
* Contact details — name, email address, shipping and billing address.
* Financial information — payment card data, processed securely by Shopify Payments. We do not store card details on our servers.
* Transaction information — items purchased, order history, returns or cancellations.
* Device and usage data — IP address, browser type, pages visited, and how you interact with our website (collected automatically via standard server logs and Shopify's platform).

2.2 OFFBIT app
The OFFBIT app does not require an account. Most of what you do in the app never leaves your phone:
* Your content — lens selections, crew lists, notes, patches, presets and custom lenses are stored on your phone and sent only to your OBM-1 over Bluetooth. Backups you export stay in the location you choose.
* Camera and photos — images you scan or import are processed on your phone. They are never uploaded to our servers.

We only receive data in these cases:
* Cloud document conversion (optional). When you scan a call sheet or a shooting schedule and choose "Continue", the app first removes phone numbers, email addresses and street addresses on your phone. The remaining text (for example names, job titles, times and shot descriptions) is sent to our server and processed by Anthropic, PBC, our service provider, to convert it into notes for the OBM-1. The result is sent straight back to your phone. Our server does not store the document: the text is processed in memory and discarded immediately after conversion. Anthropic processes it on our behalf, does not use it to train its models, and keeps it only for a limited period under its commercial terms. If you choose "Local only", or turn the option off in Preferences, the document is read on your phone and nothing is sent.
* Support and feedback. When you contact us from the app, we receive your message, the contact details you choose to add (optional), and a diagnostic report: app and firmware versions, phone model and iOS version, your OBM-1's serial number and name, Bluetooth connection and sync logs, and error traces. Email addresses, phone numbers and project names are removed from the report automatically.
* Automatic diagnostic reports. When the app detects a fault (for example a connection that keeps dropping, a failed firmware update, a failed sync or an app error), it may send the same diagnostic report on its own, a few times a day at most. It contains no message and no contact details.
* Custom lens submissions. If you choose to send us your custom lens sets, we receive the lens data only (brand, series, focal lengths and specifications).
* Technical identifiers. The app creates a random identifier on your phone that is not linked to your identity. We use it to group reports and to apply fair-use limits to cloud conversion. Your IP address is used briefly to prevent abuse and is stored only in a one-way hashed form.

We do not use analytics SDKs. We do not track usage behaviour, install events, or advertising identifiers.

Documents you scan may contain other people's names and job titles. Please only scan documents you are entitled to use for your work.

3. How we use your data
We use the data collected for the following purposes:
* To process and fulfil your order (name, address, email).
* To send order confirmations and shipping updates.
* To contact you if you have joined our waiting list.
* To convert the documents you scan in the app, when you ask for it.
* To answer your support requests and feedback.
* To diagnose and fix technical issues in the OFFBIT app and the OBM-1.
* To review custom lenses you send us and add them to our lens database.
* To detect and prevent fraud, abuse or security incidents.
* To comply with legal obligations (tax records, accounting).
We do not use your data for advertising, profiling, or automated decision-making.

4. Legal basis for processing (GDPR)
* Order processing and product delivery — contract performance, Art. 6(1)(b) GDPR.
* Cloud document conversion — your consent, Art. 6(1)(a) GDPR, given in the app before anything is sent. You can withdraw it at any time in the app's Preferences. Names of other people that appear in the documents you scan are processed on the basis of legitimate interest, Art. 6(1)(f) GDPR, only to deliver the conversion you requested, after removing contact details and without keeping the document.
* Support requests and feedback — contract performance and legitimate interest, Art. 6(1)(b) and (f) GDPR.
* Diagnostic reports (including automatic ones) and product improvement — legitimate interest, Art. 6(1)(f) GDPR.
* Custom lens submissions — your consent, Art. 6(1)(a) GDPR.
* Waiting list communications — consent, Art. 6(1)(a) GDPR.
* Fraud prevention and security — legitimate interest, Art. 6(1)(f) GDPR.
* Tax and accounting records — legal obligation, Art. 6(1)(c) GDPR.
Regarding our legitimate interests: we have assessed that they are not overridden by your rights and freedoms, given that the data is limited in scope, pseudonymous where possible, and used only for support, product improvement and security. You can object to this processing at any time by emailing hello@offbitdevices.com.
You can withdraw your consent at any time, without affecting the lawfulness of prior processing.

5. Data storage and retention
Your data is stored on servers operated by:
* Shopify Inc. (e-commerce platform) — under Shopify's Data Processing Agreement.
* OFFBIT's own server at api.offbitdevices.com, hosted by Bluehost (Newfold Digital, Inc.) — support messages, diagnostic reports and custom lens submissions.
Retention:
* Order data — for the period required by Spanish tax law (currently 5 years, pursuant to the Ley General Tributaria).
* Support messages and diagnostic reports — deleted from our server after 90 days. Copies in our support inbox are kept only as long as needed to resolve your request.
* Documents sent for cloud conversion — not stored by OFFBIT; discarded immediately after conversion. Anthropic keeps them only for the limited period set out in its commercial terms.
* A monthly count of conversions per app identifier, with no content, to apply fair-use limits.

6. Our relationship with Shopify
Our store is hosted and powered by Shopify Inc. When you interact with our website or place an order, Shopify collects and processes certain personal data on our behalf in order to provide and improve the service. Data submitted through our store may be transmitted to and stored by Shopify.
For more information on how Shopify handles your personal data and the rights available to you, please refer to Shopify's Consumer Privacy Policy (https://www.shopify.com/legal/privacy/consumers). You may also exercise certain rights regarding data processed by Shopify directly via their Privacy Portal (https://privacy.shopify.com/en).

7. International data transfers
Some of our service providers process personal data outside the European Economic Area (EEA), including in the United States and Canada: Shopify Inc., Anthropic, PBC (cloud document conversion) and Bluehost / Newfold Digital, Inc. (hosting). Where this occurs, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:
* Standard Contractual Clauses (SCCs) approved by the European Commission, and/or
* Adequacy decisions issued by the European Commission, including the EU-U.S. Data Privacy Framework, where applicable.
You can obtain more information about these safeguards by contacting us at hello@offbitdevices.com.

8. Data sharing
We do not sell or rent your personal data. We may share it with:
* Shopify — to process payments and manage the online store.
* Shipping carriers — name and address to fulfil your order.
* Anthropic, PBC — only the text of documents you choose to convert in the cloud, as described in section 2.2.
* Hosting and email providers — to run our server and our support inbox.
* Apple Inc. / Google LLC — the OFFBIT app is distributed via the App Store and Google Play, subject to their respective privacy policies.
* Public authorities — if required by applicable law or valid legal process.
All third-party processors are required to handle your data in accordance with GDPR.

9. Your rights
Under GDPR, you have the right to:
* Access the personal data we hold about you.
* Correct inaccurate data.
* Request deletion of your data (right to erasure).
* Object to or restrict processing.
* Data portability.
* Withdraw consent at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, email hello@offbitdevices.com. We will respond within one month (extendable by a further two months where necessary, with prior notice). We will not discriminate against you for exercising any of these rights.
You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es.

10. Cookies
Our website is built on Shopify. We use cookies only as necessary for the store to function (e.g., shopping cart, session management). Shopify may set additional technical cookies required for payment processing and fraud prevention.
We do not use advertising or behavioural tracking cookies. When you first visit our website, you will be informed of the cookies in use and given the option to manage your preferences.
The OFFBIT app does not use cookies.

11. Third-party links
Our website may contain links to third-party websites or platforms. We are not responsible for the privacy practices or content of those sites and encourage you to review their privacy policies before providing any personal data.

12. Children
Our products and services are not directed at children under 16. We do not knowingly collect personal data from minors. If you are a parent or guardian of a minor who has provided us with personal data, please contact us at hello@offbitdevices.com to request its deletion.

13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal and regulatory reasons. We will post the updated version on this page and update the "Last updated" date. If a change affects processing based on your consent, we will ask for it again in the app before it applies.

14. Contact
For any privacy-related questions or requests:
OFFBIT — Bernat Eguiluz Serra
hello@offbitdevices.com
offbitdevices.com