Privacy policy

This policy explains what Outreach Desk (“we”, run by Outreach Desk) collects, why, and the choices you have. We have tried to write it in plain language.

Who is responsible

Outreach Desk is responsible for the personal data of people who use Outreach Desk. You can reach us at burhanb53.work@gmail.com.

There are two kinds of data here. Data about you, which we control. And data about the people you email (your leads and contacts), which you control and we process on your behalf. The sections below explain both.

What we collect about you

• Account details: your name and email address, and either a password (stored only as a one-way hash) or the identifier from Google if you sign in with Google.
• What you add: your companies and contacts, templates, settings, pictures, CVs and other files you upload.
• Mailbox and service credentials: the app passwords or keys you give us so we can send on your behalf. They are encrypted, and never shown again.
• Activity: a record of emails sent from the app (who, when, which template), replies and bounces we detect, and, if you turn tracking on, clicks, opens and unsubscribes.
• Technical data: our hosting provider keeps standard server logs. We use one essential cookie to keep you signed in. We do not use advertising or tracking cookies.

What else we keep about you

• Billing: your plan, its status and the payments made, as reported by our payment provider. We never see or store card numbers.
• Security: if you turn on two-factor sign-in, its secret (encrypted) and your backup codes (stored only as one-way hashes); and, for each device you sign in on, a rough device name, its IP address and when it was last active, so you can see and sign out your devices.
• Sending health: how many of your emails bounce or are marked as spam, so we can pause sending that would harm deliverability for everyone. When our team looks at a workspace for support or abuse review, that look is logged.

What we collect about the people you email

Only what you put in: names, email addresses and any other columns of the lists you import. If you turn on click or open tracking, we record that a link was clicked or an email opened, against the lead it belongs to. We do not store the IP addresses of the people who click or open. We also keep a suppression list of addresses that unsubscribed or that you blocked, so they are never emailed again.

If you use signup forms, we keep a record of each signup for you: the form, the exact words the person agreed to, the topics they chose, when they confirmed, and the IP address and browser they used, so you can show their consent. If you connect an online store (Shopify or WooCommerce), we receive the customers, orders and checkouts it sends, and use them for your lists, purchase tracking and abandoned-cart emails.

How we use data

• To run the service: store your lists and templates, send email through the mailbox or email service you connect, find replies and bounces, and show results.
• To send you messages about your account, such as sign-in codes, password resets and your daily summary if you turn it on.
• To keep the service secure, prevent abuse and fix problems.

We do not sell your data, and we do not use it for advertising.

Your responsibilities for the people you email

You decide who to email and why. You are responsible for having a lawful reason to contact them, for following the rules that apply to you (such as CAN-SPAM, GDPR, PECR, CASL or local rules), and for including accurate sender details. We provide unsubscribe links and honour every unsubscribe, but we cannot decide whether a particular email is lawful.

Who we share data with

We use trusted providers to run the service, and they process data for us:

• Hosting and file storage (Vercel).
• Our database (MongoDB Atlas).
• The mailbox provider or email service you connect (for example Gmail, Outlook, Amazon SES, SendGrid, Resend, Brevo or Mailgun), to send your email. Their own terms and privacy policies apply to what they do.
• Google, if you choose to sign in with Google.
• Razorpay, to take payments for paid plans.
• An AI service, only when AI features are used: the text needed for the task (for example a reply to label, a lead's details for a first line, or an email to improve) is sent to its API. With our AI, that is the service listed on our sub-processors page (Anthropic or Google), under API terms that don't use the data to train their models. If your workspace adds its own AI key, the text goes to the service you chose, under your own agreement with it.
• The email provider we use to send account emails (sign-in codes, receipts, notices).

The full, current list is on our sub-processors page. Business customers can read our data processing agreement.

We may disclose data if the law requires it. We do not share it for any other reason.

Security

Credentials are encrypted with AES-256-GCM, passwords are hashed, traffic uses HTTPS and sessions are signed. Links in emails that record clicks or unsubscribes are signed so they cannot be forged. No system is perfectly secure, so please use a strong, unique password.

How long we keep data

We keep your data while your account exists. Companies you delete stay in a trash for 30 days so you can undo it. When you delete your account, we delete your workspace, files and credentials. Copies may remain in backups for a limited time.

Your choices and rights

• Export your lists at any time from the app.
• Correct or delete your information in the app, or delete your whole account from Settings.
• Depending on where you live, you may have the right to access, correct, delete, restrict or object to the use of your personal data, and to complain to a data protection authority.

If someone on one of your lists asks you to remove them, use the unsubscribe list in the app. If you contact us about data you uploaded, we will pass the request to you, as you control it.

Where data is processed

Our providers may process data in countries other than yours. Where the law requires it, we rely on appropriate safeguards.

Children

Outreach Desk is not intended for anyone under 18.

Changes to this policy

If we make an important change, we will tell you in the app or by email. The date at the top shows when it was last updated.

Contact

Questions about privacy? Write to burhanb53.work@gmail.com.