Privacy Policy
Last updated 24 August 2026
This explains what personal data Outtricks holds, why, and what you can ask us to do with it.
01.Two Different Roles
Outtricks handles personal data in two distinct capacities, and your rights differ depending on which applies:
- As controller: for data about you as a customer, your name, work email, Organization details, billing records and how you use the product; and for the Outtricks Lead Database, our own database of business contact records, which customers search and unlock with credits (see Lead Database notice below).
- As processor: for the prospect and contact data your Organization loads into the Platform or creates there, including the Lead Database records it has unlocked into its own account. There, your Organization decides what is collected and why; we process it on your instructions, under our Data Processing Agreement. Requests from those individuals should reach the Organization that contacted them, and we will support that Organization in responding.
02.What We Collect As Controller
- Account data: name, email, hashed password or SSO identifier, Organization and role.
- Billing data: plan, invoices and credit transactions. Card and payment details are handled securely by Stripe, our payment provider; we never store full card numbers.
- Usage data: feature and API usage, request metadata and error reports, used to operate, secure and improve the service.
- Support data: messages you send us, including through the contact form on this site.
03.Why We Process It
To provide the service you signed up for (performance of a contract); to bill you and keep accounting records (legal obligation); to keep the Platform secure and detect abuse, and to improve it (legitimate interests); and for marketing where you have opted in (consent, withdrawable at any time).
04.Google User Data Policy & Limited Use Disclosure
When you connect your Google Workspace or Gmail account to Outtricks, our platform requests access to your Google account via OAuth 2.0 with minimal required scopes:
https://www.googleapis.com/auth/gmail.send— To send user-initiated business emails and customer communication sequences directly through your connected Gmail account.openidandemail: to authenticate and verify your connected email address.
Through Google sign-in, Outtricks requests no scope that reads messages, so it cannot read your Gmail mailbox, and it never requests write access to modify or delete your mailbox (never gmail.modify or full account access).
Mailboxes connected with an app password (SMTP/IMAP):
You can instead connect a mailbox — a Gmail or Google Workspace account included — with an app password or mailbox password over SMTP and IMAP. That connection does not use Google sign-in or any Google API scope. Outtricks then signs in to the mailbox over IMAP and reads each new message that arrives in its inbox, to detect replies, bounces and spam complaints to the emails you send through Outtricks. It stores a message only when it comes from a recipient of your campaigns in Outtricks (its sender, subject and text, so you can see and answer it), and such a reply may be classified by the AI features described in § 05 to sort it (for example, interested or not interested). A bounce or complaint is recorded only as its outcome on the email you sent. Other messages are read and not kept. The password is encrypted at rest (§ 06), and disconnecting the mailbox stops the reading.
Google API Limited Use Disclosure:
Outtricks’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically regarding Google user data:
- Sole Purpose: Google user data is accessed and used solely to provide the user-facing feature you connected it for: sending the emails you write or schedule from your Gmail account, and identifying which account you connected.
- No Generalized AI/ML Training: Google Workspace and Gmail user data is never used to develop, train, or fine-tune generalized or third-party artificial intelligence (AI) and/or machine learning (ML) models.
- No Sale or Advertising: Google user data is never sold to third parties, never used for personalized or targeted advertising, and never transferred to data brokers or external marketing entities.
- Human Access: Human access to Google user data is strictly prohibited, except with your explicit prior consent for troubleshooting, for security investigations, or as required by applicable law.
05.Third Parties We Rely On
We use sub-processors to run the service, including cloud hosting and databases, Stripe for payments, email and telephony providers for outreach you initiate, and AI model providers for generation features. Providers are engaged under data-processing terms and receive only the data needed for their function. Google user data is never shared with third parties for marketing or training purposes. Our Data Processing Agreement lists them.
The AI layer is intentionally pluggable across providers, which means the specific model provider handling a given generation depends on your configuration.
06.Security
- Data between your browser and Outtricks is encrypted in transit with TLS 1.3 or TLS 1.2. Connected-account credentials (OAuth tokens, mailbox passwords and webhook signing secrets) are encrypted at rest with AES-256.
- Automated tests, including HTTP tests run as two separate Organizations, check that one Organization’s data cannot be read through another’s account.
- Audit logs are append-only: the application does not allow an entry to be edited or deleted. The one change it makes to an entry is removing personal details when a person asks us to erase their data, and that change is recorded.
- Staff access to customer data is limited to named staff accounts. Each request to an administration panel is logged, and so is each start of a staff session on a customer’s account.
07.Retention
Account and business data are retained while your Organization exists. Cancelling a subscription does not by itself delete anything: the data is deleted when your Organization’s Owner deletes the Organization in Settings, Privacy & Data, where you can also delete your own account. That deletion keeps the credit ledger, audit trail and invoices, which the law or our accounting require, with personal details removed. Database backups are not changed by a deletion.
08.Your Rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive a portable copy, and to withdraw consent. Under GDPR and CCPA we treat these as first-class product operations rather than support exceptions.
We do not sell the personal data of our customers or their users, or the data customers put into the Platform. The Lead Database is different: access to its records is licensed to customers through unlock credits, which under some laws, such as the CCPA, can count as selling personal information. The Lead Database notice below explains how to opt out. We do not share personal data for cross-context behavioural advertising.
When we erase personal data at your request, we keep anonymised records, which no longer identify anyone, and a one-way suppression entry, from which your details cannot be read back, so that you are not contacted or imported again.
09.International Transfers
Where data moves between regions, we rely on an approved transfer mechanism such as Standard Contractual Clauses, together with technical measures including encryption in transit and at rest.
10.Lead Database Notice
Outtricks runs a Lead Database of business contact records: a person’s name, job title, company, business email address and, where available, phone number, LinkedIn profile address and location. Outtricks is the controller of it. Customers search it and pay with credits to unlock records; an unlocked record is copied into that customer’s account, and the customer is the controller of its copy. We hold these records on the basis of legitimate interests: helping businesses contact the right people at other businesses about their work.
To opt out, email privacy@outtricks.com naming the email addresses, phone numbers or LinkedIn profile addresses that are yours. We add each to a platform-wide suppression list, kept only as a one-way code. From then on no customer can unlock, import or add you through Outtricks, and Outtricks refuses any email, LinkedIn action or call to you from any customer’s account. This is also how you opt out of the sale of your personal information under the CCPA.
Lead Database records are not deleted: your record stays in the database, masked in search like every record, and can no longer be unlocked. Customers who unlocked it before your request keep their own copy and are responsible for it; you can also ask them directly.
11.The Outtricks Chrome Extensions
Outtricks for LinkedIn and Outtricks for Upwork let you connect your own LinkedIn or Upwork account without typing your password into Outtricks.
- What it collects. Only when you click Connect on a LinkedIn or Upwork tab, it reads the cookies your browser holds for that site, including the login session cookies (on LinkedIn,
li_atandJSESSIONID; on Upwork, its login session cookie), and your browser’s user-agent string, and sends them to Outtricks over an encrypted connection. It also keeps the Outtricks API key you paste into it. Apart from checking the address of the tab you are on, it does not read page content, your browsing history or any other site’s cookies. - Why. So that Outtricks can carry out the LinkedIn or Upwork actions you set up, as you, from your own account.
- How it is stored. On our side, the session is encrypted at rest with AES-256-GCM, and API keys are kept only as one-way hashes. In your browser, the extension keeps the API key in its own extension storage on your device, and sends it only to the Outtricks API.
- How to disconnect. In Outtricks, disconnect the account (its session is deleted and the account keeps its seat) or remove it (the session is deleted and the seat freed). Revoke the API key in Settings, API & Developer, and uninstall the extension to delete the key from your browser.
12.Cookies
The application uses only what it needs to keep you signed in and remember interface preferences such as your theme. This public site does not run advertising or cross-site tracking cookies. For details, see our Cookie Policy.
13.Changes & Contact
We will post material changes to this policy here and, where required, notify you directly.