Privacy Policy

This Privacy Policy describes what information OutReachlo ("OutReachlo", "we", "us") collects when you use the OutReachlo application (the "Service"), how we use it, and the choices you have. It's written to match what the product actually does today, not generic boilerplate -- if a feature described here doesn't exist yet in your account, it isn't collecting anything about you.

1. Information you provide directly

• Account information: your email address and password when you sign up, handled by our authentication provider (Supabase Auth). We never see or store your raw password ourselves.
• Connected email accounts: when you connect a sending mailbox (Gmail, Yahoo, Outlook, Zoho, or a custom SMTP/IMAP server), we store that mailbox's address, host, and port, and the password/app-password you provide. The password is encrypted (AES-256-GCM) before it's written to our database, is never displayed back to you after entry, and is only decrypted in server memory at the moment we need to send a campaign or check for replies.
• Leads and contacts: names, email addresses, company names, tags, and status you upload or add -- whether typed in manually, imported, or gathered with one of our scraper tools.
• Campaign content: the subject lines, bodies, and sequence/scheduling configuration of the campaigns you create.
• Your signature and reply content: any email signature you save, and any manual replies you send to a lead through the Inbox.
• Email Verifier submissions: the addresses you submit (individually or in bulk) to check deliverability.
• Appointments: contact name/email, meeting time, and notes you (or the AI auto-reply feature, on your behalf) create from a lead conversation.

2. Information generated by using the Service

• Send records: for every campaign email sent through a connected account, we log the recipient, timestamps, and delivery status (queued/sending/sent/failed) so you can see campaign progress.
• Open tracking (optional, per campaign): if you turn tracking on for a campaign, a 1x1 tracking pixel is embedded in the emails it sends. We record whether and when that pixel was requested (open count, last opened time) against the specific send. We do not record the recipient's IP address or device/location information from this pixel load.
• Inbox replies: we connect to your connected mailbox over IMAP to check for new mail. We only ever store a message if it correlates to a campaign you actually sent (i.e., it's a reply from one of your leads) -- subject, sender, body text, and any attachments on that specific message. Everything else in your mailbox (personal mail, newsletters, unrelated correspondence) is read only transiently to determine relevance and is never stored or transmitted anywhere.
• Warmup activity: if you enable account warmup, we log the automated warmup emails sent and received between your own connected accounts, used to compute a health score. This never involves your leads or campaigns.
• Email verification results: the status (valid/invalid/risky/disposable/catch-all/unknown) and SMTP response code we obtain by probing the recipient mail server, without ever sending an actual message.

3. AI-assisted features

If you use AI-assisted campaign writing or turn on AI auto-reply for a connected account, the relevant content -- your prompt, the lead's name/company, the original campaign email, and the lead's reply text -- is sent to a third-party AI provider to generate a draft. We currently use Google's Gemini API as the primary provider, with Groq as an automatic fallback if Gemini is unavailable. These providers process that content to return a generated response; we do not control their independent retention practices beyond what's documented in their own terms, and you should review those if this matters to you. AI-generated replies are not sent automatically without you enabling that feature -- you can turn it off per account at any time in Settings.

4. How we use this information

We use the information above solely to operate the Service you've asked for:

• Sending campaigns through the email account you connected, on your instruction.
• Syncing and displaying replies from your leads in your Inbox.
• Generating AI-assisted content when you request it.
• Verifying email addresses you submit.
• Showing campaign performance, warmup health, and dashboard statistics back to you.
• Gating access to downloadable scraper tools to accounts with an active subscription status.
• Maintaining account security, and -- if you're on a plan that requires it -- admin approval of new signups.

We do not sell your data, your leads' data, or your campaign content to anyone.

5. Who else processes this data

• Supabase -- our database, authentication, and file storage provider. All application data described above is stored in Supabase's infrastructure, protected by row-level security policies that scope every table to your own account.
• Your connected email provider (Gmail, Yahoo, Outlook, Zoho, or your own SMTP/IMAP host) -- campaigns are sent, and replies synced, directly through the account you connected. That provider's own privacy policy and deliverability/reputation rules govern mail sent through their infrastructure.
• Google (Gemini API) and Groq -- used for AI-assisted content generation as described in Section 3, only when you use those features.

6. Data security

• Connected-account passwords are encrypted at rest (AES-256-GCM) and never displayed again after entry.
• Every table holding your data is scoped by row-level security policies keyed to your account, so one user's leads, campaigns, or inbox can't be read by another user through the application.
• File attachments and downloadable scraper binaries are stored in private storage buckets, accessible only via short-lived signed URLs issued after checking you're authorized.

No system is perfectly secure, and we can't guarantee absolute security of information transmitted to the Service.

7. Data retention and deletion

We retain your account data for as long as your account is active. Deleting an account permanently removes the leads, campaigns, sent-mail records, inbox messages, and connected-account credentials owned by that account. To request deletion of your account and associated data, contact us at support@outreachlo.com.

8. Your choices

• You can disconnect a connected email account at any time from Settings, which removes its stored credentials.
• You can turn off open tracking per campaign, and AI auto-reply per account, at any time.
• You can delete individual leads, campaigns, or inbox threads you no longer want stored.

9. Children's privacy

The Service is intended for business use and is not directed at, or knowingly used by, children under 16.

10. Changes to this policy

We may update this policy as the Service changes. We'll update the "Last updated" date above when we do; for material changes, we'll make reasonable efforts to notify active users.

11. Contact

Questions about this policy or your data can be sent to support@outreachlo.com.