Skip to content

Data Processing Agreement

Last updated 20 October 2026

On this page
  1. 1. Words we use
  2. 2. Our roles
  3. 3. Details of the processing
  4. 4. Your instructions
  5. 5. Confidentiality
  6. 6. Security
  7. 7. Sub-processors
  8. 8. International transfers
  9. 9. Helping you
  10. 10. Deleting or returning data
  11. 11. Information and audits
  12. 12. California
  13. 13. Liability and term
  14. 14. Contact

This Data Processing Agreement (“DPA”) is part of the Terms of Service between Outbind AI LLC (“Outbind”, “we” or “us”) and the customer that uses the Outbind app (“you”). It applies whenever we process personal data on your behalf while providing the Service, and it takes effect when you accept the Terms. You do not need to sign anything else.

If you need a signed copy for your records, write to legal@outbind.ai. Where this DPA and the Terms differ on the processing of personal data, this DPA applies.

1. Words we use

  • Data protection law means the EU and UK General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and any other privacy law that applies to the processing, such as the California Consumer Privacy Act.
  • Customer personal data means the personal data you or your team put into the Service, or that the Service processes for you, such as the contacts in your workspace, your messages and the replies you receive.
  • Sub-processor means a service provider we use that may process customer personal data.
  • Controller, processor, data subject and personal data breach have the meanings given in the GDPR.

2. Our roles

For customer personal data, you are the controller and we are your processor. You decide why the data is used, and we process it only to provide the Service to you.

We are a separate controller, not your processor, for your account and billing data, for keeping the Service secure, and for Outbind’s own business contact database, as our Privacy Policy describes. Business contact details you add can go into that database; the contents of your messages, your notes, your deal values and your private CRM fields never do.

3. Details of the processing

  • Subject and purpose: providing the Service: finding and researching business contacts, scoring how well they fit, writing and sending messages (on their own with Autopilot by default, or after you approve them), reading replies, booking meetings, and reporting results.
  • Nature: collecting, storing, organising, enriching, analysing, sending, receiving and deleting data, including with automated tools and AI.
  • Duration: for as long as you use the Service, and then until the data is deleted as section 10 describes.
  • Data subjects: your team members, and the business contacts you find, add, contact or meet through the Service.
  • Types of personal data: names, job titles, work email addresses and phone numbers, company details, public professional profile addresses, messages and replies, meeting details, link clicks and website visits recorded by the Service, and notes.
  • Special categories: none are needed. You agree not to put special category data (such as health or political opinions) or data about children into the Service.

4. Your instructions

We process customer personal data only on your documented instructions. The Terms, this DPA and the settings and actions you choose in the Service are your complete instructions, including when you turn on Autopilot. If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you first unless the law forbids it.

You are responsible for having a lawful basis for the messages you send and for the data you add, for giving any notices it needs, and for honouring opt-outs, as our Acceptable Use Policy describes.

5. Confidentiality

Only people who need access to provide or support the Service can reach customer personal data, and each of them is bound by a duty of confidentiality. People at Outbind do not read your messages unless you ask us to, it is needed for security, or the law requires it.

6. Security

We keep appropriate technical and organisational measures in place to protect customer personal data, taking into account the risks of the processing. They include:

  • Encryption of data in transit, and of mailbox access, social account access, LinkedIn sessions and phone numbers at rest.
  • Separation of each workspace’s data, checked on the server for every request.
  • Access limited to the people who need it, with company accounts and a second sign-in check for admin tools.
  • An audit log of what was sent, changed or decided in each workspace.
  • Backups, monitoring and alerts, and a process for handling incidents.
  • Collecting and keeping no more data than the Service needs.

We may update these measures over time, as long as the overall level of protection does not go down.

7. Sub-processors

You give us general permission to use sub-processors, such as hosting, email, AI, business data, payment, connection and error-monitoring providers. We describe them by role in our Privacy Policy and give the current list to any customer who asks at privacy@outbind.ai.

  • Same protections: each sub-processor is bound by a written agreement with data protection duties at least as strong as this DPA. We remain responsible to you for its work.
  • Changes: we will tell you by email at least 14 days before we add or replace a sub-processor. If you have a reasonable data protection reason to object, tell us within that time. We will try to find a solution, and if we cannot, you may end the affected part of the Service and we will refund any fees you paid in advance for it.

8. International transfers

We keep our main databases in the EU, and the app runs in the EU. Outbind AI LLC is a United States company, and some sub-processors work in the United States or elsewhere. Where customer personal data leaves the EU, the EEA or the UK, the EU Standard Contractual Clauses (module two or three, as applicable) and the UK addendum to them apply between you and us, and are made part of this DPA by this reference, or we rely on another lawful safeguard such as the EU-US Data Privacy Framework where a provider is certified.

9. Helping you

  • Requests from people: if someone asks us directly to use their rights over customer personal data, we will pass the request to you without undue delay, unless we can handle it as the controller of our own business contact database. The Service lets you find, export, correct and delete contacts, and we will help with anything the Service does not cover.
  • Assessments: we will give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority.
  • Breaches: if we become aware of a personal data breach affecting customer personal data, we will tell you without undue delay, and in any case within 48 hours, with what we know, and keep you updated as we learn more. We will take reasonable steps to contain it and limit the harm.

10. Deleting or returning data

You can download your workspace data as CSV files from the app at any time. When your account or workspace closes, we delete customer personal data within 30 days, and remove it from backups as they expire, unless the law requires us to keep it. We keep suppression entries (a one-way hash of an email address) so people who opted out are not contacted again, and activity records that show what was sent.

11. Information and audits

We will give you the information you reasonably need to show that we meet this DPA. If that is not enough, or a supervisory authority requires it, you may audit our compliance once a year, with at least 30 days’ written notice, during normal business hours, at your own cost, and under a duty of confidentiality. We will first try to answer through written questions and documents.

12. California

Where the California Consumer Privacy Act applies, we act as your service provider. We do not sell or share customer personal data, and we do not keep, use or disclose it for any purpose other than providing the Service, or outside our direct business relationship with you, except as the law allows.

13. Liability and term

Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it. This DPA lasts for as long as we process customer personal data for you.

14. Contact

For questions about this DPA, contact privacy@outbind.ai or legal@outbind.ai. Outbind AI LLC is a limited liability company formed in the State of Wyoming, United States.