1. Who we are

Outbind is a product operated by Outbind AI LLC (“Outbind AI LLC”, “we”, “us” or “our”), a limited liability company formed in the State of Wyoming, United States.

We are the controller for data about visitors to our website, people who write to us, the accounts of our customers, and Outbind’s own business contact database (section 4). That means we decide why and how this data is used, and we are responsible for it.
Our customers are the controller for data about the people they add to their workspace and contact through Outbind. For that data we act on our customer’s behalf and follow their instructions (we are their “processor”). The business contact details they add can also go into Outbind’s own business contact database, where we are the controller. Section 4 explains what this means for you if a business contacted you through Outbind.

We aim to follow applicable data protection law, including the EU and UK General Data Protection Regulation (GDPR) where it applies. If you have any questions about this policy or your data, write to privacy@outbind.ai.

2. Website visitors, the contact form and our Discord

The contact form

When you use the contact form, we collect your name, email address, the topic you pick, your message and your agreement that we may use these details to reply. The form sends your message to our team by email. It is not saved in a database.

What we do not collect

We do not store your raw IP address from these forms (a deliberate data-minimisation choice). We do not set analytics or recording cookies, and we do not run A/B tests on you, unless you agree in the cookie banner (see section 7).

Our Discord community

If you choose to join the Outbind community server on Discord (discord.gg/outbind), we and the other members can see what you share there: your Discord username, profile picture, the messages you post and when you joined. We use this only to answer your questions, run the community and keep it safe, for example by removing spam. We do not link your Discord account to your Outbind account unless you ask us to, and we never ask for passwords or account details there. Discord is a separate service, so its own terms and privacy policy apply to your use of it. You can leave the server at any time, and you can ask us to remove your messages by writing to privacy@outbind.ai.

3. Customers using the Outbind app

Anyone can create an account in the Outbind app. When you or your team use it, we process:

Account and team data: your name, email address, the workspace you belong to, your role in it, invitations, and sign-in records. You sign in with a code we email to you, a password (stored only as a one-way hash), a passkey or your Google account. Each signed-in session lasts up to 30 days and records the IP address and browser details of the device, for security. To stop the same person starting free trials over and over, the sign-in and sign-up pages also keep a scrambled code made from your browser’s settings (system, screen, language and time zone), never the settings themselves.
Business details: the business name and postal address you add, which appear in the footer of every email Outbind sends for you, and your acceptance of the lawful basis for your messages.
Your ideal client and plans: the description of who you want to reach, the plan you approve, messages written for you, and notes you add.
Billing: your plan, credit balance and usage, invoices and payment status. We ask for a card when you sign up for the 7-day free trial, and charge it on day 7 unless you cancel before then. Card details go straight to our payment provider; we never see or store them.
Connected email (Gmail, Outlook or another mailbox): when you connect a mailbox, we store its access token (or, for other mailboxes, its sign-in details), encrypted. We use it to send the emails you approve or that Autopilot sends for you, and to read the mail that arrives in that inbox so you can see and answer it in Outbind and we can match replies to the people you contacted. Section 8 lists exactly what we ask Google and Microsoft for.
Connected calendars: if you connect Google Calendar or Outlook Calendar, we read your events to show your meetings and keep booked times free, and we create events (with a video meeting link) for meetings booked with you.
Google Postmaster Tools: if a workspace admin connects it, we read the spam rate and authentication results Gmail reports for your sending domains, to show them on the Deliverability page. It contains no message content.
Other connected tools: if you connect a CRM, Slack or a scheduling tool, we exchange only the records needed for that connection to work, such as contacts, deals, meetings or notifications.
Connected social accounts: if you connect Instagram, X or a LinkedIn page, we use their official APIs to read and answer messages, comments and mentions. If you connect a personal LinkedIn account, this works with your signed-in LinkedIn session, through a service provider that keeps the connection for you, not through an official LinkedIn API. We store that session encrypted, and you agree to this in plain words before you connect. We only read one-to-one conversations. We send LinkedIn messages only when you or Autopilot tell us to, within the limits you set.
WhatsApp: you can use Outbind from WhatsApp as well as from the web dashboard. To do that, you link your own phone number with a code. We store the number encrypted and as a one-way hash, and we process the messages you send to and receive from Outbind there. Outbind only ever writes to numbers linked by their owner, never to anyone else.
Activity records: an audit log of what was sent, changed or decided in your workspace, and when. We keep it so you and we can show what happened and why.

The app uses only cookies that are strictly necessary: to keep you signed in, and to recognise a browser that has already started a free trial. It does not use analytics or advertising cookies.

To see where people get stuck while setting up and which plans they choose, our servers tell our analytics provider which set-up steps you saw and finished, your answers about your business (company name, website, industry, who you sell to and the result you want), which kinds of accounts you connected (for example “Gmail”, never the address), your plan and its changes, your role, and how you use Outbind: counts of searches, contacts, Flows, emails sent and replies, the kind of each reply (for example “interested”), and when you ask Obi something (never what you asked). This is filed under a random account number, never your email address or name, and never includes your emails, messages or contacts. If you agreed to Analytics on outbind.ai, your earlier visits are joined to it.

4. People our customers contact

Outbind helps founders, agencies and sales teams find and contact businesses that may need what they offer. If one of our customers contacted you, or is thinking about it, they may hold the following about you in Outbind:

Work details: your name, job title, work email address, work phone number, company, the public pages of your company website, and public posts and news about you or your company that help explain why you may be a good fit.
Where it comes from: business contact data providers, lists the customer adds themselves, your company’s public website and other public web pages. Our page checker identifies itself as OutbindBot and respects robots.txt.
Email checks: whether your email address looks valid, based on its format and the public mail (DNS) records of its domain. We do not send you anything to check it.
Messages: the emails and social messages the customer sent you, and your replies.
Link clicks: if you click a link in an email sent through Outbind, the customer can see that you clicked it.
Email opens: if you open an email sent through Outbind, a tiny image in it may tell the customer that it was opened.
Booking pages: if you book a meeting through a customer’s Outbind booking page, we collect your name, email address, the time you pick and any note you add, and pass them to that customer.
Website visits: if the customer’s own website uses the Outbind visit snippet and you arrived from a link in their email, they can also see which of their pages you viewed during that visit. The snippet sets no cookies. It keeps a short code in your browser tab’s session storage, which is removed when you close the tab. If your browser sends Do Not Track or Global Privacy Control, page views are still counted but never linked to you. Other visitors are only counted, not identified.

The customer who contacted you decides why your data is used and is the first place to go with a request. Every sales email sent through Outbind tells you that you can simply reply to stop hearing from them. Once you reply asking to stop, that customer cannot email you through Outbind again. You can also write to privacy@outbind.ai and we will pass your request to the customer or help you directly. When someone opts out or asks to be erased, we remove the details that identify them and keep only a one-way hash of their email address on a suppression list, so they are not contacted again.

Outbind’s business contact database

Outbind also keeps its own database of business contact details, stored in the EU. When one of our data partners, a public source or a customer adds a business contact, we keep that contact in a shared pool, so we can give the same details to other customers without buying them again and keep them current. For this database, Outbind is the controller.

What we keep: your name, job title, seniority and department, company and company website, work location, the address of your public professional profile, your work email address and the result of our check of that address, and your work phone number where our data partners allow us to keep it. For companies, we keep business facts such as industry, size, location, the technologies they use and public signals such as hiring. We note where and when each detail was found. We never keep the contents of emails or other messages, customers’ notes or deal values, or anything from a customer’s private CRM fields, and we do not record which customer a detail came from.
Where it comes from: business contact data providers we work with, public sources such as company websites and public professional profiles, and business contact details our customers add to Outbind or import from their own lists.
Why, and our legal basis: to help our customers find the right business contacts for business-to-business sales, and to keep those details accurate. We rely on our legitimate interests (Article 6(1)(f) GDPR) and those of our customers. Each customer still sees only the contacts in their own workspace.
How long: we delete a person’s details once they have not been confirmed for 24 months. We check an email address again before we reuse it if it was last checked more than 90 days ago, and we remove details that turn out to be wrong.
How to be removed: use our Remove my data page, or email privacy@outbind.ai and ask us to remove you from Outbind’s contact database. We delete your details and keep only a one-way hash of your email address, so you are not added back. You can also object to this processing at any time in the same way.

5. How we use data, including AI

Running your account: signing you in, billing, and sending you emails about your account and important changes to the product.
Answering you: replying to messages from the contact form or by email.
Providing the app: finding people who fit a customer’s ideal client, writing and sending messages on the customer’s behalf, reading replies, and reporting results on the dashboard and on WhatsApp.
Automated processing: our service providers process data to research prospects, score how well they fit, draft messages and sort replies. By default, Autopilot sends messages for the customer without asking each time, within the rules, limits and sending hours the workspace owner sets. The owner can turn on checking each email, so that a person on their team approves each one before it is sent. Scores and drafts come with the evidence they are based on, and a person can always review, change or stop them. We do not make decisions about you that have legal or similarly significant effects based only on automated processing.
Keeping things safe and working: stopping abuse and spam, finding and fixing errors, and keeping records that show consent and opt-outs.
Improving the website: analytics and A/B tests on outbind.ai, only if you agree (section 7).
Improving the app: learning where people get stuck while setting up and which plans they pick (section 3), without your email address or name.

We will not use data for a new or unrelated purpose without telling you first. We do not sell personal data, we do not build advertising profiles, and we do not share data for cross-context behavioural advertising.

6. Our legal bases

Where the GDPR or similar law applies, we rely on the following legal bases:

Consent (Article 6(1)(a) GDPR) for replying through the contact form, and for the Analytics and Recordings options in the cookie banner, including A/B tests. Each is off until you opt in, and you can withdraw at any time as easily as you gave it.
Contract (Article 6(1)(b) GDPR) for providing the app to our customers and their teams.
Legitimate interests (Article 6(1)(f) GDPR) for security, abuse prevention, error reports with no personal data, activity records, product analytics in the app (section 3), suppression lists, and Outbind’s business contact database (section 4). We keep this processing to the minimum needed and weigh it against your rights.
Our customers’ legal basis for data about the people they contact. Customers confirm the basis they rely on (usually legitimate interests for business-to-business sales) before they can send.

7. Cookies, analytics and A/B testing on outbind.ai

We ask before we use anything that is not strictly necessary. The cookie banner offers three groups, and only the first is on by default. The full list of cookies and storage keys, with their lifetimes, is in our Cookie Policy.

Necessary (always on): a cookieless bot check on our forms, and technical data sent to Sentry, our error-monitoring provider, to keep the site working: error reports, performance measurements, code-speed profiles, and counts and logs of what the server did (for example, that a signup succeeded). None of it contains personal data such as your IP address, cookies, form contents or email. We also keep a note on your device of the choice you make in the banner.
Analytics (off until you agree): PostHog, our analytics provider, hosted in the United States, may set a cookie and remember your device between visits, so we can see which pages lead people to sign up. If you then sign up, we link those visits to your new account using the random ID our analytics tool gives your browser, never your email address. We also keep a short profile of your visits: how often you come, where you first came from, and which features, plans, billing options and questions you looked at. Analytics also includes A/B tests (below). We also record which website sent you to us and any campaign tags in the link you clicked.
Recordings (off until you agree): session recordings by our analytics provider, and a short recording by our error-monitoring provider of the moments before an error. In every recording, all text, all form fields and all images are hidden, so we cannot see what you type or read. We use them to find parts of the site that confuse people or break.

A/B testing

What it is: to learn what is clearest, we sometimes show visitors one of two versions of some wording on the site, such as the main button or the main title. Our analytics tool picks a version for you at random.
Only with Analytics: A/B tests run only if you turn on Analytics in the cookie banner. If you do not, you always see the original version and nothing about tests is stored on your device.
What is stored: the version you were given is kept in the analytics cookie and browser storage on your device, so you see the same version when you come back. Our analytics provider also records which version you saw, with the random ID of your browser, and adds it to the other events from your visits.
Where and how long: in the analytics cookie for up to 1 year, and in browser storage until you clear it or turn off Analytics. Our analytics provider keeps the record in the United States for as long as its retention settings allow (section 10).
How to opt out: turn off Analytics in “Cookie settings” in the footer. We then stop the tests for you, show you the original version, and delete the analytics cookie and stored data on your device.

If you do not agree, the site works the same. Before you choose, and if you reject, PostHog, our analytics tool, runs in a cookieless, in-memory mode: it stores nothing on your device, does not record you, and forgets you when you close or reload the page. It still sends anonymous counts of the pages you view and what you click (for example, that the sign-up form was opened), without identifying you and without following you from one visit to the next. Error reports and performance measurements are sent to Sentry (Necessary, above) too. Recordings happen only if you switch them on yourself. When you follow a link from the site to create an account, the link carries the campaign tags, the website that sent you and the site page you started on, and we keep them with your new account. It carries nothing that identifies you.

Separately from the banner, to understand overall traffic (how many people visit, which pages they view, the broad country and device type, and how fast the site loads) we use cookieless web analytics and speed measurement from our hosting providers. They measure without cookies, without storing your IP address and without building a profile of you, so they need no consent.

We do not sell personal data, and we never will. We share it only with the service providers (processors) below, who process it on our instructions, for the purposes we set, and under a data processing agreement. Our analytics provider is PostHog and our error-monitoring provider is Sentry; we describe the others by what they do. Customers who need the full list of providers for their own compliance can ask us at privacy@outbind.ai.

For the website

Hosting providers host the website, and provide the cookieless bot check, web analytics and speed measurement.
An email provider sends our emails, including replies to the contact form.
PostHog (analytics, United States) provides analytics and A/B testing, and session recordings if you agree. Without your agreement it runs in memory only.
Sentry (error monitoring) finds and reports errors, and keeps a recording of the moments before an error if you agree.

For the Outbind app

Hosting providers host the app database, the web app and our background worker (which runs scheduled work and the WhatsApp connection) in the EU.
AI providers research prospects, score fit, draft messages and sort replies. They may not use your data to train their models.
Business data providers find business contacts and companies, with work emails, phone numbers and public signals such as hiring.
Connection providers keep a connected account, such as a personal LinkedIn account, working when you choose that option.
PostHog (product analytics, United States) records how the app is used, such as which set-up steps were finished, under a random account number (section 3).
Sentry and logging providers help us find and fix problems in the app. Some of these providers are in the United States.
A payment provider handles subscriptions, payments and invoices.
An email provider sends sign-in codes and account emails.

When a customer connects Gmail, Outlook, Instagram, X or LinkedIn, or uses WhatsApp, data also passes through that service (Google, Microsoft, Meta, X or LinkedIn). Those services act under their own terms and privacy policies.

Google and Microsoft data

Outbind’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We treat data from Microsoft the same way. When you connect, we ask only for what each feature needs:

Gmail: permission to send email as you (gmail.send), for the messages you approve or Autopilot sends, and to read your mail (gmail.readonly), so the messages in your inbox appear in Outbind for you to read and answer, and so we can match replies to the people you contacted.
Google Calendar: permission to see and edit events (calendar.events), to show your meetings, keep booked times free and add meetings booked with you.
Google Postmaster Tools: read-only access to your domains’ Gmail traffic statistics (postmaster.traffic.readonly), to show your spam rate.
Outlook: permission to send mail (Mail.Send) and read mail (Mail.Read) for the same reasons as Gmail, plus your basic profile (User.Read) and ongoing access (offline_access) so the connection keeps working.
Outlook Calendar: permission to read and write your calendars (Calendars.ReadWrite), for the same reasons as Google Calendar.
Signing in with Google: only your name, email address and profile picture.

In plain words: we only use data from a connected mailbox or calendar to provide these features to you. To do that, the text of messages may be sent to our AI providers (section 5) to sort them and suggest answers. We do not use it for advertising, we do not sell it, we do not use it to train AI models, and people at Outbind do not read it unless you ask us to, it is needed for security, or the law requires it.

9. International transfers

We keep our main databases in the EU, and the app runs in the EU. Outbind AI LLC is a United States company, and some providers process data in the United States or elsewhere, including our analytics, error-monitoring, business data and AI providers. Where personal data leaves the EU or UK, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses, the UK addendum to them, or the EU-US Data Privacy Framework where a provider is certified, so your data keeps an equivalent level of protection.

10. Data retention

Contact form messages: in our email for as long as we need to handle your enquiry and any follow-up, or until you ask us to delete them.
Our Discord community: your messages stay on the server until you delete them, leave and ask us to remove them, or we remove them as moderators.
App accounts and workspaces: while your workspace is active. You can delete your account or workspace, or ask us to, at any time. We then keep its data for 30 days, so it can be restored if it was a mistake, and then delete it for good, except for activity records and suppression entries we need to keep to show what was sent and to honour opt-outs, and anything the law requires us to keep.
People our customers contact: for as long as the customer decides, until the person asks to be erased. Erasure removes what identifies them; a one-way hash of their email stays on the suppression list so they are not contacted again.
Outbind’s business contact database: as described in section 4: until the details have not been confirmed for 24 months, or the person asks to be removed.
Short-lived technical records in the app: finished background tasks are deleted after 7 days, raw notices from social platforms after 14 days, WhatsApp messages waiting to be sent after 30 days (their content is removed as soon as they are sent), and daily email-check counters after 40 days.
Analytics and recordings: with our analytics and error-monitoring providers for as long as their retention settings allow, which we keep as short as is useful. If you withdraw your agreement, we stop collecting at once and delete what our analytics tool stored on your device. The note of your cookie choice stays on your device until you clear it or change it.

We may keep a minimal record that you withdrew consent or asked to be removed (a suppression entry), so that we can honour your choice and do not contact you again.

11. Your rights

You have the following rights over your personal data:

Access a copy of the data we hold about you.
Rectification of data that is inaccurate or incomplete.
Erasure of your data (the “right to be forgotten”).
Restriction of how we process your data.
Objection to our processing, including processing based on legitimate interests and any direct marketing.
Portability to receive your data in a structured, machine-readable format.
Withdraw consent at any time, as easily as you gave it: use the unsubscribe link or reply to any email we send, or change your choice in “Cookie settings”.

To use any of these rights, email privacy@outbind.ai. If a customer of ours contacted you, you can also go to them directly (section 4). If you are unhappy with how we handled your data, you can complain to the data protection authority that applies to you. We would appreciate the chance to address your concerns first.

We aim to respond within the time the law requires. We may need to confirm your identity first, for example by checking that you control the email address concerned, so that we do not share or change someone else’s data by mistake. Using your rights is free in the ordinary course.

12. Security

We take appropriate technical and organisational measures to protect data. Data is sent over encrypted connections, access is limited to the people who need it, staff access to admin tools needs a company account and a second sign-in check, and mailbox and social account access, LinkedIn sessions and WhatsApp numbers are stored encrypted. The app’s audit log records who did what and when. No method of storage or transmission is completely secure, so we also keep what we hold to a minimum. If a personal data breach affects you and the law requires it, we will tell you and the relevant authority.

13. Children

Outbind is for business and professional users and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact privacy@outbind.ai and we will remove it.

14. Changes to this policy

We may update this Privacy Policy as our product, our providers or the law change. When we do, we will update the “last updated” date at the top of this page. If the changes are significant, we will tell you by email or in the app.

15. How to contact us

For privacy questions or to use your rights, contact privacy@outbind.ai. For questions about our Terms of Service, contact legal@outbind.ai. For anything else, reach us at hello@outbind.ai. Outbind AI LLC is a limited liability company formed in the State of Wyoming, United States.