Privacy Policy
Last updated: October 2026
Offra is a product of Consuly Pte. Ltd., a company registered in Singapore ("Consuly," "we," "us"). This policy explains how we collect, use, and protect your personal data in accordance with Singapore's Personal Data Protection Act (PDPA).
1. Data we collect
We collect the information you provide directly (name, email address, company name), the documents you upload to the platform, and data on how you use the Offra application (pages visited, buttons and features used), linked to your account, for the purpose of improving the service. We collect that usage data with PostHog (see section 8). It never includes what you type, the contents of your documents, bids or tenders, or any recording of your screen. If you choose to sign up or sign in with Google, Google shares your name, email address, profile picture and Google account identifier with us; we never receive your Google password or anything else from your Google account.
2. How we use your data & consent
Your data is used solely to provide and improve the Offra service, to send you service-related communications and, with your consent, product updates. In line with the PDPA, we collect, use, and disclose your personal data only for purposes you have consented to or that are permitted by law. We do not sell your personal data.
3. Disclosure & data hosting
We may engage trusted service providers who process data on our behalf and only on our instructions. Your account, tender and bid data is stored on servers located in the United States, as are this website's servers and our email provider, so information you send us through the forms on this site is processed there as well. Because Consuly Pte. Ltd. is established in Singapore, our own staff may access that data from Singapore to operate and support the service; where personal data moves between Singapore and the United States we require the receiving party to protect it to a standard comparable to the PDPA. Section 7 explains the cookies this site can set and how to turn them off. We do not sell your personal data, and we do not share it with third parties for commercial purposes.
4. Storage, security & retention
Your documents and data are stored on secure servers. We apply appropriate technical and organizational measures to protect your information against unauthorized access; our security page (offra.cc/security) describes them. We retain your personal data only for as long as necessary for the purposes described in this policy or as required by law.
5. Your rights under the PDPA
Under the PDPA, you may request access to the personal data we hold about you, request corrections to it, and withdraw your consent to its collection, use, or disclosure at any time. You may also request deletion of your data. To exercise these rights, contact us at the address below.
6. Artificial intelligence
Offra uses artificial intelligence in two places, and one rule governs both: your data is never used to train AI models — ours or our providers'. We contract only with providers whose terms forbid training on customer content and limit retention to what is needed to return a result. In the application, the documents you upload and the workspace information a feature needs are sent to our AI providers so they can produce your analyses, checklists and recommendations. That content is processed to answer your request and returned to your workspace. It is not added to any training set, it is not used to build our benchmarks, and it is never used to serve another customer. The tender and award records Offra shows you are gathered separately, from public procurement registries — SAM.gov, USAspending and the state portals — never from customer workspaces. On this website, an AI assistant answers questions about Offra's plans and features. Your messages are processed by our AI provider to generate replies. To tailor its answers, the assistant also receives the page you are currently viewing and the pages you viewed earlier in the same visit — this is first-party context that stays on our own servers and is never shared with advertisers. The conversation is stored — without your name, and without your raw IP address (only a salted, one-way hash) — so we can improve the assistant and our product. These records are deleted automatically after 90 days. The assistant sets no advertising or tracking cookie. Section 8 names the providers involved and what each one handles.
7. Cookies, measurement and advertising
We measure how this site is used with Google Analytics, provided by Google LLC. It places cookies and builds a picture of how an individual visitor moves through the site — pages viewed, links clicked, time on each page, approximate location and the campaign that referred you. It runs from your first page view, and the banner shown on that visit tells you so and gives you a one-click way to turn it off. You can also turn it off at any time afterwards through the "Cookie preferences" link at the bottom of every page. Opting out costs you nothing — the site works identically either way — and when you do, we stop sending data to Google and delete the analytics cookies already set in your browser. An opt-out is remembered in your browser and we do not reinstate analytics on our own; we only ask again if you clear your browser storage. Google processes this data on our behalf; you can read how at google.com/policies/privacy/partners, and we keep it for no longer than 14 months. We have not enabled Google's advertising features, Google Signals or ad personalisation, so this data is not used to target advertising to you and is not sold or shared for commercial purposes. Advertising measurement is a separate purpose and stays off unless you switch it on yourself in that same banner.
8. Service providers we use
We engage a small number of providers to run Offra. Each processes data only on our instructions and only for the purpose listed here. None of them may use your data to train AI models, and we do not sell your personal data. • Supabase — hosting and storage of your account, tender and bid data, on servers in the United States. • Railway — runs the Offra application servers that process your requests (United States). • OpenRouter — routes the documents and workspace content a feature needs to the AI models that produce your analyses, checklists and recommendations, and the replies of our in-app and website assistants (United States). We restrict this routing to five model providers — Together AI, Parasail, Modal, Google (Vertex AI) and Amazon Web Services (Amazon Bedrock), all U.S. companies — and, with each of them, only to services that operate under zero data retention and do not train on what is sent to them, so your content is not retained by the model provider after your result is returned. • Mistral AI — text recognition on the PDFs and images you upload. • Cerebras — AI processing when our primary provider is unavailable. • Exa — web search. When you ask our deep-dive assistant to verify an external fact (a standard, a regulation, a form, a public body's procedure), it sends that question to Exa and receives public web pages in return. It is not sent your documents, and it does not write your results. • Stripe — payment processing and billing records. Offra never receives or stores your full card number. • Resend — service and transactional email (United States). • PostHog — product analytics for the Offra application: which pages and features signed-in users use, linked to their account, as described in section 1 (United States). • Vercel — hosting of this marketing website (United States). • Google LLC — Google Analytics for this website, as described in section 7, and “Continue with Google” sign-in when you choose it, as described in section 1. We keep this list current. If you would like to be told before we add a new provider, write to us at the address below.
9. Contact us
For any questions about this policy, or to reach our data protection officer, write to us at privacy@offra.cc. Consuly Pte. Ltd. (UEN: 202404226H), 68 Circular Road, #02-01, 049422, Singapore.