Privacy policy
Last updated: 19 August 2026
Data controller
OffMap is operated by Elena Chrysaki, an individual, at Adrianou 26, Keratsini, 18755, Greece.
Contact for privacy matters: hello@offmap.gr
What OffMap is
OffMap lists selective student opportunities — programmes with a real deadline, a real organiser, and a real application route. Browsing is free for everyone. Under-16s can browse the full site without creating an account.
Data we collect, why, and on what legal basis
If you don't create an account, we don't collect anything about you beyond standard server logs (see "Server logs" below).
If you create an account, we collect:
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address | Sign you in, send deadline alerts you've asked for | Performance of a contract (running your account) |
| Sign-in method (email/password, or basic Google profile info if you use Google sign-in) | Authenticate you securely | Performance of a contract |
| Age confirmation (16+, yes/no — no birth date, no ID) | Comply with our own 16+ policy | Legitimate interest / legal compliance |
| Saved opportunities and alert preferences | Remember what you've saved, send alerts you've opted into | Consent (for alerts) / performance of a contract (for saving) |
We do not collect payment information. OffMap is free for students — there's no paid tier, and we never will build one.
Server logs
Like any website, our hosting and database providers automatically log standard technical data (IP address, browser type, request timestamps) for security and debugging. Legal basis: legitimate interest (keeping the service secure and working). We don't use this to build profiles of visitors.
Automated decision-making
We don't use automated decision-making or profiling that produces legal or similarly significant effects on you.
Who we share it with
Nobody sells your data. Ever. No student email, name, or list of saved opportunities is ever sold, rented, or shared with third parties for marketing.
We use a small number of service providers ("processors") to run OffMap, each only processing data on our behalf under a data processing agreement:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Database, authentication | Frankfurt, Germany (EU) |
| Resend | Sending deadline/digest emails | EU region |
| Vercel | Hosting the website | Frankfurt, Germany (EU) |
| Sign-in, if you choose to use "Sign in with Google" | United States |
International transfers: checked against each provider's own Data Processing Addendum and the official Data Privacy Framework register (dataprivacyframework.gov) as of August 2026:
- Supabase — relies on Standard Contractual Clauses (2021 EU SCCs, per their DPA). Not currently Data Privacy Framework-certified. Your data itself stays in their Frankfurt (EU) region; this covers their own subprocessors.
- Resend — certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), with Standard Contractual Clauses as a contractual backstop.
- Vercel — certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), with Standard Contractual Clauses (2021 EU SCCs, plus the UK IDTA for UK transfers) as a contractual backstop.
- Google — certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), with Standard Contractual Clauses available as an alternative basis.
Certifications can lapse or change; if this matters to you, verify current status directly at dataprivacyframework.gov before relying on it.
There is no student-to-student visibility on OffMap — no messaging, no comments, no public profiles. Other students can never see your saved list, your email, or your alerts.
How we protect your data
Data is encrypted in transit (HTTPS) and at rest (via Supabase's managed database encryption). Access to production data is restricted to what's needed to operate the service. We don't build custom authentication — sign-in is handled by Supabase Auth and, optionally, Google.
How long we keep it
We keep your account data for as long as your account is active. If you stop using OffMap, we don't currently auto-delete inactive accounts, but you can request deletion at any time (see below).
Your rights
If you're in the EU/EEA (which includes Greece), you have rights under GDPR, including the right to:
- Access the data we hold about you
- Correct inaccurate data
- Request deletion of your account and data
- Object to or restrict certain processing
- Withdraw consent at any time, where we rely on consent (e.g. alert emails) — this won't affect processing that happened before you withdrew it
- Data portability (get a copy of your data in a usable format)
- Lodge a complaint with a supervisory authority. In Greece, this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα): Kifisias Av. 1-3, 11523 Athens, complaints@dpa.gr, dpa.gr. You can also complain to the supervisory authority of your own EU/EEA country of residence.
To exercise any of these rights, email hello@offmap.gr. We don't yet have automatic self-serve account deletion built into the product — until we do, email us and we'll delete your account and associated data by hand, promptly.
Cookies
We use only the minimum cookies necessary to keep you signed in (authentication session cookies). We don't use tracking or advertising cookies.
Children's privacy
OffMap accounts require self-declared confirmation that you are 16 or older — a stricter bar than Greek law's own digital-consent age of 15, applied as our own policy. We don't knowingly collect account data from anyone under 16. Under-16 visitors can browse listings without an account and without providing any personal data. If we learn that someone under 16 has created an account, we'll delete it.
Changes to this policy
If we make material changes to this policy, we'll update the date at the top and, where appropriate, let account holders know by email.
Contact
Questions about this policy or your data: hello@offmap.gr