Privacy Policy

Last updated: 13 October 2026

Who we are

Offbeat-IoT ("Offbeat-IoT", "we", "us", "our") operates the Offbeat-IoT platform: the service, the public website, the device protocol and the integrations that connect your devices to third-party cloud services. This Privacy Policy explains how we collect, use, share and protect personal data when you use the platform.

If you have any questions about this policy or your personal data, contact us at privacy@offbeat-iot.com.

Scope

This policy applies to personal data we process when you:

• create and use an Offbeat-IoT account;
• register a device and connect it to the platform;
• link a third-party integration (for example Spotify, Todoist, Google Health, Google Calendar, Yahoo Calendar, Alexa or Google Home);
• visit the public website and its documentation and status pages; or
• contact us for support.

Data we collect

We collect the following categories of data.

Account and authentication data

• Username, email address and display name.
• A hashed password, or identity data provided by your identity provider when you sign in through single sign-on.
• Account preferences and role.

Integration and OAuth data

When you link an integration, the provider redirects you to Offbeat-IoT with an authorization code, and we exchange it for an access token (and, where the provider issues one, a refresh token). We store these tokens, the granted scopes and the token expiry so that we can call the provider on your behalf.

This includes data you choose to expose through an integration, for example calendar entries, tasks, health data points, or the playback state of a music account. We process that data only to fulfil the commands your device or the user interface sends. The provider's own privacy policy also applies to the data held in your provider account.

Device and telemetry data

• A device identifier (endpoint id) and the mapping between a device and the integrations you link to it.
• Commands sent to and from a device over the WebSocket protocol.
• Readings and telemetry a device reports (for example sensor values), stored as the latest value and exported as metrics.
• Network metadata such as the device's remote IP address and connection timestamps, used for connectivity and for location-based services such as the time and weather integrations.

Usage and technical data

• Log data (IP address, browser type and version, pages visited, timestamps, diagnostic and error information).
• Aggregate service metrics used for availability, monitoring and capacity.

Communications

• Messages you send to us for support, and the contact details you use.

How we use your data

We use personal data to:

• create and administer your account and authenticate you;
• route device commands to the correct provider and return the result;
• refresh and store integration tokens and revoke them when you unlink;
• map devices to integrations and keep that mapping up to date;
• operate, secure and monitor the platform, including availability and abuse prevention;
• provide support and respond to your requests; and
• improve and develop the platform.

We do not sell your personal data, and we do not use it for third-party advertising.

Legal bases for processing

Where the EU/UK General Data Protection Regulation (GDPR) applies, we rely on:

• Performance of a contract — to provide the platform and the integrations you request.
• Consent — to link an integration and to grant it access to your provider account. You can withdraw consent at any time by unlinking the integration.
• Legitimate interests — to secure and improve the platform, prevent abuse and keep it reliable, balanced against your rights.
• Legal obligation — where we must retain or disclose data to comply with the law.

Third-party integrations and OAuth

Offbeat-IoT acts as a gateway between your device and the cloud services you choose to connect. When you link a provider, you authorize Offbeat-IoT to access a defined set of data at that provider, described by the requested scopes at consent time.

• Tokens are stored server-side and are never sent to your devices.
• We call the provider only to fulfil the commands and queries you or your device initiate.
• Unlinking an integration revokes the token where the provider supports revocation, and removes the stored credentials.
• The provider processes your data under its own privacy policy. We encourage you to read the privacy policy of each service you connect.

Sharing and sub-processors

We share personal data only with the parties needed to run the platform:

• infrastructure and hosting providers that run the service and store data;
• identity and single sign-on providers used for authentication;
• the third-party cloud services you explicitly connect; and
• authorities, where we are legally required to disclose data.

Service providers act under contract and may process data only on our instructions.

International data transfers

Some providers and sub-processors may process data outside the EU/EEA. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, additional technical measures.

Data retention

We keep personal data only as long as needed for the purposes described above:

• Account data is kept until you delete your account.
• Integration tokens are kept until you unlink the integration or delete your account.
• Device telemetry is kept according to the configuration of the platform and your devices.
• Logs and diagnostics are kept for a limited period for security and troubleshooting.

When data is no longer needed, we delete or anonymize it.

Security

We protect personal data with technical and organizational measures, including encryption in transit, hashed credentials, tokens stored server-side, access controls and monitoring. No method of transmission or storage is completely secure, but we work to protect your data and to limit access to it.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of, or object to, certain processing;
• receive your data in a portable format;
• withdraw consent at any time; and
• lodge a complaint with your local data protection authority.

You can exercise most of these rights directly in the platform (for example by unlinking an integration or deleting your account), or by contacting us at privacy@offbeat-iot.com.

Cookies

The platform uses cookies that are necessary to operate it, in particular for authentication sessions. We do not use advertising or third-party tracking cookies.

Children's privacy

The platform is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will revise the "last updated" date above and, for significant changes, provide additional notice where appropriate. We encourage you to review this page periodically.

Contact

For questions, requests or complaints about this Privacy Policy or your personal data, contact:

Offbeat-IoT
privacy@offbeat-iot.com