Privacy Policy

1Your data and your prospects

You decide which people you add to your workspace. You are responsible for your contacts and how you message them; we process that data on your behalf to provide the service.

2Data we collect

Account: your email address, session, and language and theme preferences.

Workspace: campaigns, plans, messages, credit transactions, and the activity log.

Contacts: name, title, company, and a public business page link. We do not scrape social networks and we do not guess email addresses or phone numbers.

3How we use data

To provide the service you ask for: building outreach plans, drafting messages, and sending the messages you approve. To keep the service secure and prevent abuse. Contact records are stored with their source and consent basis, and used for B2B outreach on your instructions.

4Opt-out and blocklist

When someone opts out, they are added to your workspace's blocklist, their pending messages (draft, approved, or queued) are cancelled, and their consent record is revoked. Blocked contacts are excluded from future outreach.

5Sharing

We do not sell data. The providers that operate the product include Supabase (database and sign-in), Lovable (application platform), and Google (Gmail connection, fonts). This list is not exhaustive; server-side processing may use additional providers.

6Retention

We keep your data while your account is open. You can request deletion through Settings. The deletion flow is intended to remove your account and the data of workspaces that only you own (campaigns, contacts, messages, credits).

7Your controls

From Settings you can export your data (a JSON file of your workspace records), anonymize all contacts (name, role, company and link are removed; statistics are kept), or delete your account. You can also contact us for access, correction, deletion, or restriction requests.

8Security

Records are protected by row-level access rules limited to workspace members, roles are checked on the server, and connections are encrypted.

9Cookies

We use cookies and local storage only for your sign-in session and preferences such as language, theme, and workspace selection. No advertising cookies.

10Changes and contact

If this policy changes materially, we notify you in the app. For privacy requests, contact contact@outprism.com.

11Google Gmail connection

If you connect Gmail, Outprism uses Google's official API to view your primary email address, display which account is connected, and send email on your behalf. Outprism does not request or store your Google password. You sign in on Google's consent screen; OAuth tokens are handled by the Lovable connector gateway. Outprism stores an account-specific connection key encrypted with AES-256-GCM, with the encryption key held as a server-side secret outside the database.

Outprism does not read or list your mailbox contents. In the current version, Gmail messages are sent only when you click Send in the Queue, not automatically in the background. Autopilot drafts and schedules messages. If you enable automatic approval, it can mark drafts as approved or queued, but sending still requires the Send action.

Drafts and sent messages remain in your workspace as campaign records and are subject to this policy's retention and deletion terms. You can disconnect Gmail in Settings, which revokes the gateway connection and deletes the stored connection key, or revoke access through your Google account's permissions page.