Privacy policy

1. Who we are

We have not appointed a data protection officer, as the law does not require one for our activity. For anything about your data, write to {{CONTACT_EMAIL}}.

2. Our two roles

• Controller. We decide why and how we process data about visitors to our website, our customers and their users (accounts, billing, support, security). Sections 3 and 5 to 13 describe that processing.
• Processor. Customers bring into their workspaces data about other people, mostly LinkedIn profiles of the people they want to reach, and the messages exchanged with them. For that data the customer is the controller and we are its processor, acting only on its instructions under our Data Processing Agreement. Section 4 describes it.

3. Data we process as controller

Website visitors

getoutvoy.com is a static website. It loads no analytics, advertising or social-media trackers, and its fonts are served from our own servers. Our web server and proxy process technical request data (IP address, date and time, requested URL, browser user agent, response code) to deliver the pages and keep them secure. If you open the support chat, see "Support" below and the cookie policy.

Customers and their users

• Account data: name, email address and password. The password is stored only as a one-way argon2id hash.
• Workspace data: workspace name, members, plan and settings.
• Billing data: your plan, trial and renewal dates and subscription status, and the Stripe customer and subscription ids. Card details are entered on Stripe's pages and never reach us. Your email address is shared with Stripe to create the customer.
• Licence data: for AppSumo licences, the licence key, its tier and status, and the licence events AppSumo sends us. AppSumo keeps your purchase details as an independent controller.
• Connected LinkedIn accounts: for each account you connect, its name, profile URL, the provider account id and its connection status. Your LinkedIn password is never entered on Outvoy (see section 5).
• Usage and security data: sign-in times; API key metadata (name, prefix, creation and last-used times — the key itself is stored only as a SHA-256 hash); an audit log of the commands run in your workspace, with who ran them (a user, an API key or the system) and when; IP addresses, processed briefly to rate-limit sign-in and public connection pages; and application logs and traces.
• Emails we send: service emails such as LinkedIn reconnection notices, sent through Brevo.
• Support: what you write to us by email or in the support chat (operated by Crisp), and the name and email you give there.

4. Data we process for our customers

When a customer uses Outvoy, they choose the people they want to reach and bring their data into their workspace, by LinkedIn search, by profile URL or CSV, or from the people who engaged with a post. That data can include public LinkedIn profile data (name, headline, job title, company, location, profile URL, LinkedIn member id, profile photo URL), custom fields the customer adds, the campaign activity about each person (profile visits, likes, invitations sent, accepted or withdrawn, replies) and the messages exchanged with them through the customer's LinkedIn accounts. Only conversations with the workspace's leads are stored: when someone who is not a lead writes to, or is written to from, a connected LinkedIn account, Outvoy discards the message without storing its content or who it was with (an operational log keeps only technical ids). The same goes for new connections of those accounts with people who are not leads.

The customer decides who is contacted and why, and must have a lawful basis to do so and inform people where the law requires. We process this data only to provide the service to that customer, under the DPA; we don't use it for our own purposes, sell it, combine it across customers or use it to train AI models.

5. Your LinkedIn session

To connect a LinkedIn account, you sign in on a hosted page operated by our provider Unipile SAS (France). Your LinkedIn password, two-factor codes and security checks are handled on that page; Outvoy never sees or stores your LinkedIn password. Unipile keeps the session so that Outvoy can carry out the actions you configure (searching, visiting profiles, liking posts, sending invitations and messages, reading conversations) and returns the results to us. When you disconnect an account in the console, Outvoy stops using it immediately and removes the session from Unipile (if Unipile can't be reached at that moment, we retry automatically until it is removed). You can also end the session from LinkedIn at any time (Settings → Sign in & security → Where you're signed in).

6. Why we use data, and on what legal basis

We don't sell or rent personal data, we don't use it for advertising, and we don't make decisions about you based solely on automated processing that produce legal or similarly significant effects.

7. Who receives data

We use the providers below, bound by contracts that meet article 28 GDPR. The current list, and how we announce changes, is on the sub-processors page.

These parties receive data in their own right, as independent controllers:

We may also disclose data to professional advisers under confidentiality, to a buyer or successor in a merger or acquisition (who must keep this policy's protections), or when required by law or a competent authority.

8. International transfers

Workspace data is hosted in the European Economic Area. When a provider processes data in a country without an adequacy decision (such as the United States), we rely on the provider's certification under the EU–US Data Privacy Framework (and its UK Extension) where available, or on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), plus additional measures where needed. You can ask us for a copy of the relevant safeguards.

9. How long we keep data

10. Security

We encrypt connections with TLS, store passwords with argon2id and API keys only as hashes, scope every request to its workspace, sign the webhooks we send and verify the ones we receive, keep secrets out of the code, restrict production access and keep an audit log of changes. Annex II of the DPA lists our measures in detail. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

11. Your rights

Under the GDPR and the UK GDPR you can ask us to access your data, rectify it, erase it, restrict or object to its processing (including at any time to direct marketing), and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Customers can export or delete their whole workspace themselves in Settings → Data. Otherwise, write to {{CONTACT_EMAIL}} from the email on your account, or tell us how we can verify your identity. We answer within one month (extendable by two months for complex requests, in which case we will tell you).

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es), the authority of your EU country of residence or work, or, in the UK, the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to fix it first.

12. California residents

If the CCPA applies to you: in the last 12 months we collected the categories described in section 3 (identifiers, commercial information, internet activity, and professional information for connected LinkedIn accounts) for the business purposes in section 6, from you, your company, AppSumo and Stripe. We do not sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer characteristics. You have the right to know what we collect, to delete it, to correct it and not to be discriminated against for exercising these rights; you can also use an authorised agent. Send requests to {{CONTACT_EMAIL}}. For data in a customer's workspace, we act as that customer's service provider and pass requests on to them.

13. Cookies and local storage

The website sets no tracking cookies. The console keeps your session in your browser's local storage, and the support chat uses its own cookies. Details are in the cookie policy.

14. Children

Outvoy is a business tool and is not intended for anyone under 18. We don't knowingly collect data about children, and customers must not use Outvoy to contact them.

15. Changes to this policy

If we make material changes, we will update the version and date above and notify customers by email or in the console before they take effect.