Privacy Policy

How we collect, use, and protect your personal information.

Effective Date: January 1, 2026  |  Last Updated: April 1, 2026

1. Introduction

OffboardSafe, operated by Lafoba (“we,” “us,” or “our”), is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our employee lifecycle management platform.

By using OffboardSafe, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, company name, job title, and phone number when you register for an account.
  • Employee Data: Information about employees that you enter into the platform, including names, roles, departments, start/end dates, and assigned tasks.
  • Communications: Messages, feedback, and support requests you send to us.
  • Payment Information: When you subscribe to a paid plan, billing details including your name, billing address, and payment card information are collected by our payment processor (see Section 5).

2.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, time spent on the platform, and interaction patterns.
  • Device Information: Browser type, operating system, device type, screen resolution, and IP address.
  • Log Data: Server logs including access times, referring URLs, and error logs.
  • Cookies & Tracking Technologies: See Section 8 for details.

3. How We Use Your Information

We use the information we collect for the following purposes:

Purpose Legal Basis
Providing and maintaining the Service Contract performance
Processing payments and billing Contract performance
Sending transactional emails (receipts, alerts) Contract performance
Improving the platform and user experience Legitimate interest
Analytics and usage reporting Legitimate interest
Responding to support requests Contract performance
Complying with legal obligations Legal obligation
Marketing communications (with consent) Consent

4. Data Sharing & Disclosure

We do not sell your personal information. We may share your data with:

  • Service Providers: Trusted third parties who help us operate the platform (hosting, analytics, customer support). These providers are contractually obligated to protect your data.
  • Payment Processor: Stripe processes all payment transactions on our behalf (see Section 5).
  • Legal Compliance: When required by law, subpoena, or government request.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.
  • With Your Consent: When you explicitly authorize us to share your data with a third party.

5. Payment Data & Stripe

OffboardSafe uses Stripe as our exclusive payment processor. Understanding how your payment data is handled is important to us.

5.1 What Payment Data We Collect

When you subscribe to a paid plan, the following data is involved in the payment process:

  • Collected by OffboardSafe: Your name, email, billing address, subscription plan, and transaction history (amounts, dates, plan changes).
  • Collected by Stripe (not stored by us): Full credit/debit card number, CVV/CVC code, and card expiration date.
  • Stored by OffboardSafe via Stripe: Last four digits of your card, card brand (e.g., Visa), and a unique Stripe customer ID for managing your subscription.

5.2 How Stripe Processes Your Data

Stripe handles all sensitive payment card data directly. Your card details are entered into Stripe’s secure payment form (Stripe Elements) and are transmitted directly to Stripe’s servers—they never pass through or are stored on OffboardSafe servers.

Stripe processes your payment data in accordance with:

5.3 PCI DSS Compliance

Stripe is a certified PCI Level 1 Service Provider, which is the most stringent level of certification in the payment card industry. By using Stripe, OffboardSafe ensures that:

  • Credit card data is encrypted using industry-standard protocols
  • Sensitive authentication data is never stored after authorization
  • Regular security assessments are conducted by qualified security assessors
  • OffboardSafe itself does not need to handle raw card data, significantly reducing security risk

5.4 Payment Data Retention

We retain payment-related records (transaction history, invoices, subscription details) for the duration of your account plus an additional 7 years to comply with tax and financial reporting obligations. Stripe retains your card details in accordance with their own data retention policy. You may request deletion of your Stripe payment profile by contacting us.

6. Data Security

We implement comprehensive security measures to protect your data:

  • Encryption: 256-bit SSL/TLS for data in transit; AES-256 for data at rest
  • Access Controls: Role-based access with multi-factor authentication for administrative access
  • Infrastructure: Hosted on SOC 2 compliant cloud infrastructure with automated backups
  • Monitoring: 24/7 intrusion detection and automated threat monitoring
  • Audits: Regular third-party security audits and penetration testing
  • Employee Training: All team members undergo security awareness training

While we take extensive precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but will notify affected users promptly in the event of a data breach.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specific retention periods include:

  • Account Data: Retained while your account is active, plus 90 days after cancellation
  • Employee Data: Retained while your account is active, plus 90 days after cancellation. You may delete individual employee records at any time.
  • Payment Records: Retained for 7 years after the transaction for tax and legal compliance
  • Usage Analytics: Aggregated and anonymized data may be retained indefinitely for product improvement
  • Support Communications: Retained for 3 years after resolution

8. Cookies & Tracking Technologies

OffboardSafe uses cookies and similar technologies to enhance your experience:

8.1 Types of Cookies We Use

Cookie Type Purpose Duration
Essential Authentication, security, and core functionality Session / 30 days
Functional User preferences, language settings 1 year
Analytics Understanding usage patterns and improving the platform 2 years
Stripe/Payment Fraud prevention, payment session management Session / as set by Stripe

8.2 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Service. Stripe may set its own cookies for fraud detection purposes when you interact with payment forms.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate or incomplete data
  • Deletion: Request deletion of your personal data (subject to legal retention requirements)
  • Portability: Request your data in a machine-readable format
  • Restriction: Request restriction of processing in certain circumstances
  • Objection: Object to processing based on legitimate interest
  • Withdraw Consent: Withdraw consent for marketing communications at any time

To exercise any of these rights, contact us at sales@offboardsafe.com. We will respond within 30 days.

10. International Data Transfers

OffboardSafe is based in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. We implement appropriate safeguards, including Standard Contractual Clauses (SCCs), to ensure your data is protected in accordance with applicable data protection laws.

11. Children’s Privacy

OffboardSafe is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

  • Post the updated policy on this page with a new “Last Updated” date
  • Notify registered users via email at least 14 days before the changes take effect
  • Provide a clear summary of what changed

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: