Privacy Policy

Version 2026-10-11 · in force from 11 October 2026

This Privacy Policy explains what personal data OfflineLegal.com processes, why, on what legal basis, for how long, who receives it, and what your rights are. The short version: OfflineLegal.com is offline-first software, so your legal documents stay on your computer. We only process the limited personal data needed to run the website, sell you a subscription, activate your licence and protect the service.

1. Who is responsible (the controller)

The controller is UAB Visata, company code 304315676, registered address Sėlių g. 10A-2, LT-08124 Vilnius, Lithuania. Contact for all privacy questions and requests: support@offlinelegal.com, phone +370 601 44255. We have not appointed a data protection officer; write to the address above.

2. Your documents never leave your device

Document parsing, OCR, drafting, analysis, comparison, document chat, exports, and the local AI model run on your computer. We do not receive, store, or have access to the documents you upload or create, the questions you ask the AI, or the answers it gives. Nothing you process in the app is sent to us or used to train any AI model. You can disconnect from the internet and the core features still work.

3. What we process, why, on what legal basis, and for how long

• Order and licence data — the e-mail address you enter at checkout, the plan, order reference, amount, currency, payment status, device label and device ID, unlock-code and activation dates. Purpose: to conclude and perform the contract (order, activation, renewal, cancellation, support). Legal basis: contract (Art. 6(1)(b) GDPR) and, for accounting records, legal obligation (Art. 6(1)(c)). Kept: while your subscription is active, then as long as needed to handle refunds, chargebacks and legal claims (the statutory limitation period); invoices and accounting records are kept for the period required by Lithuanian accounting and tax law.
• Terms acceptance record — the version of the Terms you accepted, the time you accepted it, the time our server received it, and your request for immediate delivery with the acknowledgement that the right of withdrawal ends at activation. It is stored with your order and, for card payments, in the payment record at Stripe. Purpose: to prove what you agreed to. Legal basis: legal obligation under consumer law (Art. 6(1)(c)) and our legitimate interest in proving the contract (Art. 6(1)(f)). Kept: as long as the order record.
• Payment data — card payments are handled by Stripe. Stripe receives your card details, billing address and any VAT number; we receive only the payment status, invoice, tax and refund information. We never see or store full card numbers. Legal basis: contract and legal obligation. Kept: as order and accounting records.
• Bot-protection counters — to stop bots and abuse, our server counts requests to ordering, activation, download, sign-in and similar services per network address (IP address; IPv6 addresses are grouped by their /64 network) and, for orders and activation requests, per e-mail address entered. A counter holds the address or e-mail, a number and the time the counting window ends. Purpose: keeping the service available, preventing fraud and automated abuse. Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f)). Kept: only for the counting window — at most 24 hours — and then deleted automatically.
• Server logs — IP address, time, requested address, response status and browser identification string, recorded by our web server and application for security and troubleshooting. Legal basis: legitimate interest in running and securing the website (Art. 6(1)(f)). Kept: web-server logs 14 days, application logs 7 days, unless a specific log is needed longer to investigate a security incident.
• Website statistics — see section 4. Legal basis: legitimate interest in measuring and improving our own website (Art. 6(1)(f)).
• Support messages — what you choose to send us (messages, screenshots, logs, files). Purpose: answering you. Legal basis: contract or, for pre-sale questions, legitimate interest. Kept: as long as needed to answer you and handle follow-up, and no longer than the limitation period for related claims.
• Local preferences (on your device only) — language, jurisdiction, practice area and workspace state are stored in the app or browser storage on your computer, not on our servers.

Our legitimate interests are: keeping the website, downloads and activation available and secure; preventing fraud, bots and abuse; proving the contract; and understanding, in pseudonymous statistics, how visitors use our own website. You can object to processing based on legitimate interest at any time (section 8).

4. Cookies, browser storage and website statistics

This website sets no cookies and uses no advertising trackers — no Google Analytics, no advertising pixels, no cross-site tracking. That is why there is no cookie banner. We use only this browser storage, all of it strictly necessary or deleted when you close the tab:

• Checkout state (sessionStorage) — your checkout e-mail, selected plan and download-unlock flag during a purchase. Deleted when you close the tab.
• Language preference (localStorage) — the interface language you chose.
• Session statistics id (sessionStorage) — a random id that exists only while your tab is open and is deleted when you close it.
• Consent record (localStorage) — only if we ever introduce consent-requiring technology, your accept/reject choice would be stored here.

Our own visit counter. Our server records page views and clicks on buttons such as "Buy": the page address and title, the referring page, device type, screen size, browser language, time zone, the browser identification string and the random session id above. It does not store your IP address, and the data is sent only to this website's own domain.

Umami statistics. We also use Umami, a cookieless analytics tool that we host ourselves on our own server — no third party receives the data. It records the page, referrer, browser, operating system, device type, screen size, language and approximate location (country, region and city derived from your IP address; the IP address itself is not stored). It derives a pseudonymous visitor ID from your IP address and browser details with a secret salt that changes every month, so visits within the same month can be linked to each other, but not to you by name and not across months. Legal basis: legitimate interest in measuring our website's audience (Art. 6(1)(f) GDPR). The statistics are kept while the website is operated; because the salt changes monthly, records from different months cannot be linked to the same visitor. You can object at any time (section 8) or block the script /anal/v.js in your browser.

If this ever changes — for example, if we start using advertising technology — a consent banner with equal "Accept" and "Reject" choices will appear before any such technology loads, and this Policy will be updated first.

5. What the desktop app sends over the internet

• First-run downloads. On first use the app downloads its local AI model (about 5 GB) and engine files directly from Hugging Face (Hugging Face, Inc., USA) and GitHub (GitHub, Inc., USA). Those services see your IP address and the file requested, under their own privacy policies; the app sends them no documents and no account data.
• Daily law-pack check. Once a day the app downloads the public list of law-pack dates from offlinelegal.com. Only your IP address reaches our server logs; no account data is sent.
• Activation. Activating with an unlock code links the licence to your checkout e-mail and a device ID.

6. Who receives your data

• Hostinger (Hostinger International Ltd.) — hosts our server (located in France, EU) and the support@offlinelegal.com mailbox, as our processor.
• Stripe (Stripe Payments Europe, Limited and Stripe Technology Company Limited, Ireland) — card payments, fraud prevention and invoices. Stripe acts as our processor for payment processing and as an independent controller for its own legal and fraud-prevention duties.
• Umami — self-hosted on our own server; no data goes to the Umami project or any other third party.
• Hugging Face and GitHub — only for the first-run downloads described in section 5, as independent controllers.
• Accountants, auditors and legal advisers bound by confidentiality, and public authorities where the law requires it.

We never sell your data, and we do not have your documents to share in the first place.

7. Transfers outside the EU/EEA

Our server is in the EU. Stripe may transfer payment data to the United States; Stripe is certified under the EU-U.S. Data Privacy Framework and also uses the European Commission's Standard Contractual Clauses. Hugging Face and GitHub are US companies: your computer connects to them directly for the first-run downloads, under their own privacy policies. Your documents are never transferred anywhere, because they stay on your computer.

8. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests (including the statistics in section 4). Write to support@offlinelegal.com; we answer within one month. These rights cover the order, licence and log data we hold — not documents that never left your device.

You also have the right to complain to a data protection supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt. You may also complain to the authority in the EU country where you live or work.

We do not make decisions about you based solely on automated processing, and we do not profile you.

9. Security

We use appropriate technical and organisational measures for the order, licence and log data we hold: encrypted connections, access limited to the operator, throttling against abuse, and backups kept with restricted access. Because your documents live on your device, keep your computer, operating system, e-mail account and OfflineLegal.com installation protected — especially when processing confidential files.

10. Children

OfflineLegal.com is not directed to children and should not be used by anyone who cannot legally enter into the Terms in their country.

11. Changes

Every published version has its own version number and date at the top of this page. If a change affects how we use data we already hold about you, we will tell you before it applies.

OfflineLegal.com · UAB Visata · company code 304315676 · Sėlių g. 10A-2, LT-08124 Vilnius, Lithuania · support@offlinelegal.com · +370 601 44255
Terms of Service · Privacy Policy · Refund Policy · Legal Disclaimer