Data Processing Agreement

• Purpose and nature: providing the platform: storing and searching records, sending email, LinkedIn and Upwork messages, placing calls, generating text with AI, automating workflows and reporting.
• People concerned: your prospects, contacts and customers, the people who message or call you, and your own users.
• Data: contact and professional details, message content, call audio, recordings and transcripts, and activity history. Do not upload special-category data (such as health information); the platform is not built for it.
• Duration: for as long as your Organization uses the platform, until the data is deleted as described in section 08.

Outtricks processes your personal data only to provide the platform as you configure and use it, and as these terms describe, unless the law requires otherwise; we will tell you if we believe an instruction breaks the law. Anyone at Outtricks who can access your data must keep it confidential.

Staff access to customer data is limited to named staff accounts. Each request to an administration panel is logged, and when a staff member views the platform as your Organization, every request made in that session is written to your Organization’s audit log.

• Data between your browser and Outtricks is encrypted in transit with TLS 1.3 or TLS 1.2.
• Connected-account credentials (OAuth tokens, mailbox passwords, LinkedIn and Upwork sessions and webhook signing secrets) are encrypted at rest with AES-256-GCM.
• Passwords are hashed with Argon2. API keys and support-ticket access links are stored only as SHA-256 hashes; a ticket opened before that hashing was introduced keeps its link in plain form until the link is next opened, when it is replaced by its hash. Two-factor secrets are encrypted with AES-256-GCM; one set up before that encryption was introduced is encrypted the next time it is used to sign in.
• Every request is limited to your Organization’s records, and automated tests run as two separate Organizations check that one cannot read the other’s data.
• Actions are checked against the member’s role and its permissions, including custom roles you define. Two-factor authentication is available to every user.
• The audit log and the credit ledger are append-only: the database refuses edits, deletions and truncation of their entries. The one change made to an entry is removing personal details when a person’s data is erased, and that change is itself recorded.

Outtricks has no SOC 2 report or ISO 27001 certificate, and has not had an external penetration test. See our Security page and the Trust & Compliance page.

Outtricks uses these sub-processors to provide the platform:

Each receives only the data its function needs. Outtricks will update this list before a new sub-processor starts processing your data; you can object by writing to privacy@outtricks.com.

The platform is hosted in the Asia Pacific (Singapore) region, and sub-processors may process data in other countries, including the United States. Where personal data from the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, the transfer relies on the European Commission’s Standard Contractual Clauses, with the UK Addendum for UK data.

The platform gives you the tools for requests from the people in your data: export everything held about a Contact, erase a person across every module (“Erase personal data”), keep a suppression list that every channel checks, and export or delete your own account. We will also help with data protection impact assessments and questions from a supervisory authority, as far as they concern our processing.

Personal data breaches. If we become aware of a breach affecting your personal data, we will tell your Organization’s owners without undue delay, with what we know: what happened, the kinds and rough number of people and records affected, the likely consequences and what we are doing about it, and we will add to it as we learn more.

Your Organization’s Owner can delete the Organization at any time in Settings, Privacy & Data, after confirming with their password (and second factor, if set) and an emailed link. Export anything you want to keep first. Deleting the Organization:

• cancels its subscriptions;
• deletes call recordings and transcripts at the voice provider, and releases its phone numbers;
• deletes the Organization’s records from the platform;
• keeps the credit ledger, audit trail and invoices, which the law or our accounting require, with personal details removed, and keeps leads as empty records with nothing personal in them.

Cancelling a subscription does not by itself delete anything. Database backups are not changed by a deletion.

We will answer reasonable written questions about how your data is processed and the measures above. Write to security@outtricks.com for security questions and privacy@outtricks.com for anything else in this agreement.