The data controller for the personal data described in this policy is Outly. Contact: support@useoutly.com.

We collect the following categories of data:

• Account data: name and email address, from sign-up or Google sign-in.
• Configuration data: what you enter to set up your campaigns, such as your persona, targeting, website URL, message steps, and the documents and media you upload.
• Connected accounts: your LinkedIn account, connected through our LinkedIn connection provider, and your mailbox if you connect one. We do not store your LinkedIn password.
• Prospect data: public LinkedIn profile information (name, headline, role, company) of the people your campaigns target, and the email addresses found or verified for them.
• Conversation data: messages exchanged with prospects on LinkedIn and by email.
• Billing data: handled by our payment processor. We do not store card numbers.
• Technical data: request logs, IP address, device and browser information, and feature usage.

We process data to:

• Provide and personalize the service
• Generate personalized messages, replies, and personas with AI
• Manage your subscription and billing
• Improve the service and provide support
• Keep the service secure and prevent abuse

• Performance of the contract: the data needed to provide the service
• Legitimate interest: improving the service and preventing abuse
• Consent: optional advertising measurement

We do not sell your personal data. We share it only with the categories of service providers needed to run the features you use. Each one only accesses the data needed for its purpose:

• LinkedIn connection provider, to connect your LinkedIn account and send and receive messages
• Email providers, to connect your mailbox, send emails, and find and verify prospect email addresses
• AI model providers, to generate messages, replies, and personas
• Website analysis provider, to read the website you give us when generating a campaign persona
• Payment processor, for subscriptions and billing
• Sign-in provider, if you log in with Google
• Hosting, database, and file storage providers
• Error monitoring provider
• Advertising measurement provider, only if you accept it (see below)

• Account, configuration, and conversation data: kept while you use the service and up to 12 months after you delete your account. You can ask us to delete it immediately at any time.
• Prospect data: kept while your account is active, and deleted with your account data.
• Billing data: kept for the period required by accounting law.

You have the following rights over your personal data:

• Access: get a copy of your data
• Rectification: correct inaccurate data
• Erasure: delete your data
• Portability: receive your data in a structured format
• Objection: object to the processing of your data
• Restriction: limit processing in certain cases

You can delete your account yourself from your profile settings. To exercise any other right, write to support@useoutly.com. We reply within 30 days.

Optional advertising measurement is off until you accept it. It sends browsing events and identifiers to a trusted external advertising measurement provider. In the app, it is limited to signup and completion conversions on onboarding pages. Advertising personalization is disabled. Rejecting does not prevent use of the service.

Use Privacy / Do not sell or share on the website or during onboarding, or Settings > Legal Information in the app, to change your choice or withdraw consent. Global Privacy Control keeps optional advertising off. Your choice is stored for up to 180 days in this browser, separately on each site origin. Withdrawal stops future optional tracking; it does not undo information already sent. Advertising disclosures may qualify as sharing under applicable privacy laws.

We use appropriate technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), secure authentication, access limited to your own account and teams, and restricted access to our databases.

Outly uses AI models to write personalized messages, replies, and campaign personas. Your configuration data, the public LinkedIn profile data of your prospects, and your conversation messages are sent to AI model providers to generate this content. AI-generated content may be inaccurate; review it before use.

This section is for people contacted through Outly, not for Outly users.

Your public professional details (name, role, company) were collected from LinkedIn by the Outly user who contacted you, for B2B prospecting. That user decides who to contact and why, and is responsible for this data. Outly processes it only on their instructions.

As the party responsible for this data, the Outly user must:

• Have a valid legal basis for contacting you
• Inform you about the processing of your data
• Respect your right to object and give you a simple way to opt out
• Respect LinkedIn's terms and the anti-spam laws that apply

To access, object to, or delete your data, contact the user who wrote to you first. You can also write to support@useoutly.com, and we will forward your request to that user within 7 days.

We may update this policy. We will notify you of significant changes by email. The date of the last update is shown at the top of this page.

For any question about your personal data, write to support@useoutly.com.