OutboundPrivacy policy
Last updated 15 October 2026
1. Who is responsible
[Company legal name and address] (“OutboundLeadPro”, “we”) is the controller for personal data about our customers and website visitors. For personal data about the prospects and contacts our customers upload, find or email with OutboundLeadPro, the customer is the controller and we act as their processor (see section 6).
Contact: use the in-app chat or email support. [Data protection officer, if appointed]
2. Data about you as a customer
| What | Why | Legal basis |
|---|---|---|
| Name, email, password hash, company, plan | Create and run your account | Contract (Art. 6(1)(b) GDPR) |
| Billing details (handled by our payment processor; we see the last four digits and billing address) | Charge for paid plans, keep invoices | Contract; legal obligation (Art. 6(1)(c)) |
| Log-in times, IP address, device and security events | Keep accounts secure, prevent abuse and fraud | Legitimate interest (Art. 6(1)(f)) |
| Sending statistics, bounce and complaint rates | Protect deliverability for everyone and enforce our terms | Legitimate interest |
| Support conversations | Help you | Contract; legitimate interest |
We send you service emails (confirmations, security, billing). Product news only if you agree, and you can unsubscribe at any time.
3. Website visitors and cookies
Our website uses only cookies that are necessary to log you in and keep the session secure, plus a local setting that remembers light or dark mode. We do not use advertising cookies or third-party trackers on the website. Our web server keeps short-lived logs (IP address, time, page) for security, deleted after 14 days. The spam-word tester on the homepage runs entirely in your browser; what you type there is not sent to us.
4. Data about prospects (processed for our customers)
When a customer uses OutboundLeadPro, we process on their behalf: business contact details (name, role, business email, phone, company, website, address), where each detail came from, email verification results, the messages exchanged, opt-out status, and CRM notes.
- Sources: information businesses publish about themselves (websites, Google Maps, OpenStreetMap, business directories), data the customer imports, and enrichment providers the customer connects with their own keys.
- No guessed emails: we only keep an email address that the business publishes or that its mail server confirms; we do not create addresses by guessing patterns.
- Opt-outs: when someone unsubscribes or asks not to be contacted, their address is added to the customer’s suppression list so they are not emailed again from that workspace.
If you received an email sent with OutboundLeadPro and want to know what data the sender holds about you, or want it deleted, please contact the sender — they are the controller. You can also contact us and we will forward your request and help the sender answer it.
5. AI features
When AI features are used (writing emails, drafting or labelling replies), the relevant text — for example the email thread and the prospect’s business details — is sent to the AI provider configured for the workspace. Which providers are used is chosen by the platform administrator; they may include several model vendors. We use providers’ business/API offerings that do not use submitted data to train their models, and we send only what the task needs.
6. Processor terms for customers
For prospect data, we act only on the customer’s documented instructions (using OutboundLeadPro as configured), ensure staff confidentiality, apply appropriate technical and organisational measures (encryption in transit, encrypted secrets and mailbox credentials, access control, backups, logging), use only the subprocessors listed below and inform customers before adding new ones, assist with data-subject requests and data-protection impact assessments, report personal-data breaches without undue delay, and delete or return data at the end of the contract. Our terms and this policy together form the data processing agreement.
7. Subprocessors and recipients
| Category | Purpose | Location |
|---|---|---|
| Hosting and infrastructure [provider] | Run the application and store data | [region] |
| AI providers connected by the administrator | AI writing, reply drafts and labels | May include the USA |
| Payment processor [provider] | Subscriptions and invoices | [region] |
| Transactional email provider [provider] | Account emails (confirmations, password resets) | [region] |
| Services the customer connects (e.g. Google, Microsoft, Cloudflare, Twilio, HubSpot, GoHighLevel, enrichment providers) | Only when the customer connects them, under the customer’s own agreement | Varies |
Where data is transferred outside the EU/EEA or UK, we rely on adequacy decisions (such as the EU–US Data Privacy Framework) or Standard Contractual Clauses with additional safeguards.
8. How long we keep data
- Account data: while your account is open, then deleted within 30 days of closure (after the export window).
- Prospect data, messages and CRM data: until the customer deletes it or closes the account; deleted within 30 days after that, and from backups within a further 30 days.
- Suppression (opt-out) lists: kept for as long as the workspace exists, because they exist to stop further emails.
- Invoices and tax records: as long as the law requires (often up to 10 years).
- Security logs: up to 90 days; web server logs: 14 days.
9. Your rights
Under the GDPR and UK GDPR you can ask for access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest — including at any time to direct marketing. Where we rely on consent, you can withdraw it at any time. You also have the right to complain to a data protection authority, for example the one where you live or work. Contact us through the app and we will reply within one month.
10. Security
All traffic is encrypted with TLS. Passwords are stored as salted hashes. Mailbox and API credentials are encrypted at rest. Access to production data is restricted and logged. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
11. Changes
We will update this policy when our processing changes and tell customers about material changes in advance.