Privacy Policy

The two roles, and why it matters

For your own account information, including your email address and login, we are the data controller.

For information about your connections, the people you might contact, you are the data controller and we are your processor. We hold and process that data because you instructed us to, and we do not use it for our own purposes.

That distinction matters practically: you need your own lawful basis for processing your connections' data, and if one of them makes a data subject request, it comes to you, and we help you answer it.

What we hold about you

• Your email address and an authentication credential.
• Identifiers for the third-party accounts you connect, but never their passwords. Credentials for LinkedIn are held by our channel gateway, not by us.
• Records of what the service did on your behalf, kept as an audit log.

What we hold about your connections

We obtain this data from LinkedIn through the connected account, meaning we see what you can see. We do not buy contact data, we do not scrape people you are not connected to, and we do not build a database of people across customers.

• Name, headline, location, and the LinkedIn identifier.
• Where you have asked us to look them up: email address, phone number, follower and connection counts, and other profile detail LinkedIn exposes to you as a connection.
• Public posts of theirs that triggered a signal, and the content of messages exchanged between you.
• Records of what was drafted, approved, sent or cancelled.

Who else processes it

Each is a sub-processor acting on our instructions. A current list is maintained in the Data Processing Agreement, and we will tell customers before adding a new one.

• Unipile, the channel gateway that connects to LinkedIn and other channels.
• Anthropic, which generates message drafts. Draft content and the signal that prompted it are sent to their API.
• Prisma Postgres, which stores the database, hosted in the EU.
• Vercel, which hosts and runs the application.

What we do not do

• No advertising trackers, no analytics trackers, no third-party pixels. The only cookie the site sets is the one that keeps you signed in.
• We do not sell personal data, and we do not share it for anyone else's marketing.
• We do not use your data, or your connections' data, to train any model.

How long we keep it

Account data is kept while your account is active and for up to 30 days after you close it, then deleted.

Connection and message data is deleted when you delete the associated records or close your account. Suppression records, meaning people who asked not to be contacted, are kept indefinitely, because deleting them would risk contacting somebody who has opted out.

Audit logs are kept for 24 months, since their purpose is to show what happened.

Your rights

You have the right to access, correct, delete and port your data, to object to or restrict processing, and to complain to the Information Commissioner's Office.

To exercise any of these, email hello@outreachconvert.com. We will respond within one month.

If you are one of our customers' connections rather than a customer, the customer is the controller of your data. Contact them, or contact us and we will pass it on and assist.

Transfers outside the UK

The database is hosted in the EU. Some sub-processors, including the model provider, process data in the United States under appropriate safeguards including the UK addendum to the EU Standard Contractual Clauses.