Privacy Policy

Last updated: October 02, 2026

1. Introduction

OutboundAI ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered GTM engineer platform (the "Service"). Please read this policy carefully. If you do not agree with its terms, do not use the Service.

This Privacy Policy applies to all users of the Service, including visitors, free users, and paid subscribers.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

  • Email address
  • Name (optional)
  • Company name (optional)
  • Billing address (for paid plans)

2.2 Payment Information

Payment card data is processed exclusively by our PCI-DSS compliant payment processor, Waffo Pancake. We do not store your full payment card number, CVV, or expiration date on our servers. What we receive and store:

  • Transaction ID from the payment processor
  • Last 4 digits of the card (for your records)
  • Card brand (Visa, Mastercard, etc.)
  • Transaction amount and date

2.3 Usage Data

We automatically collect usage information when you use the Service, including:

  • ICP descriptions you input
  • Leads generated and exported
  • Email templates created
  • API calls and integrations used
  • Device and browser information
  • IP address and approximate location
  • Session duration and feature usage

2.4 Third-Party Data

We may receive data about you from third parties, including:

  • Data enrichment providers (Apollo, ZoomInfo, Clearbit, Hunter)
  • Email verification services
  • Analytics providers

3. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Service
  • Process transactions and send related information
  • Generate leads and enrich contact data based on your ICP
  • Create personalized email content using AI
  • Send you technical notices, updates, and support messages
  • Respond to your comments, questions, and requests
  • Monitor and analyze trends, usage, and activities
  • Detect, investigate, and prevent fraudulent or unauthorized transactions
  • Personalize and improve your experience

AI-Specific Note: We use AI models to generate personalized content. Your ICP descriptions and any content you submit may be processed by AI models to provide these services. We do not use your data to train AI models that compete with our Service.

4. Data Sharing and Disclosure

4.1 We do NOT sell your personal data

We do not sell, trade, or rent your personal information to third parties for marketing purposes.

4.2 Service Providers

We share data with trusted service providers who assist us in operating the Service:

  • Waffo Pancake - Payment processing (PCI-DSS compliant)
  • Cloud infrastructure providers (hosting, data storage)
  • AI model providers (for AI content generation)
  • Email service providers
  • Analytics services

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business Transfers

If OutboundAI is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction.

5. Data Security

We implement industry-standard security measures to protect your data:

  • Encryption in transit (TLS/SSL)
  • Encryption at rest for sensitive data
  • Regular security assessments and penetration testing
  • Access controls and authentication requirements
  • PCI-DSS compliant payment processing via Waffo Pancake

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Data Retention

We retain your data for the following periods:

  • Account data: 90 days after account cancellation
  • Transaction records: 7 years (tax and accounting compliance)
  • Usage logs: 2 years (service improvement and troubleshooting)
  • AI-generated content: Deleted when you delete your account or upon request
  • Marketing preferences: Until you withdraw consent

After the retention period, data is securely deleted or anonymized. Some data may be retained longer if required by law.

7. Your Rights

7.1 Access and Portability

You may request a copy of your personal data in a portable format. Contact privacy@outboundai.com to request your data.

7.2 Deletion

You may request deletion of your account and personal data. We will process requests within 30 days, except where retention is required by law (e.g., transaction records for 7 years).

7.3 Correction

You may update or correct your account information at any time through your account settings or by contacting support.

7.4 Opt-Out

You may opt out of marketing emails by clicking the unsubscribe link in any email or contacting privacy@outboundai.com.

8. Cookies and Tracking

8.1 Essential Cookies

These are necessary for the Service to function and cannot be disabled. They include session cookies, authentication cookies, and security cookies.

8.2 Analytics Cookies

We use analytics services to understand how you use the Service. These cookies collect anonymized usage data and help us improve the Service.

8.3 Managing Cookies

Most web browsers allow you to control cookies through their settings. Disabling cookies may affect Service functionality.

9. Third-Party Services

The Service may contain links to or integrate with third-party services (e.g., Instantly, Apollo, ZoomInfo). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

AI Model Providers: Our Service uses third-party AI models (e.g., OpenAI, Anthropic, Google) to generate content. Data processed by these providers is subject to their respective privacy policies.

10. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will take steps to delete that information promptly.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

12. GDPR Compliance (EEA Users)

If you are located in the European Economic Area, you have additional rights under GDPR:

  • Right to access your personal data
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw consent

To exercise these rights, contact privacy@outboundai.com. We respond to GDPR requests within 30 days.

Data Controller: OutboundAI is the data controller for your personal data processed under GDPR.

Data Protection Officer: Contact privacy@outboundai.com for data protection inquiries.

13. CCPA Compliance (California Residents)

If you are a California resident, you have the right to:

  • Know what personal information is collected about you
  • Know how your information is used and shared
  • Request deletion of your information
  • Opt out of the sale of your information (we do not sell your data)
  • Non-discrimination for exercising your rights

To exercise your rights, contact privacy@outboundai.com. We verify requests within 10 days and respond within 45 days.

Categories of Information Collected: Identifiers, commercial information, internet activity, and professional information.

We Do Not Sell Personal Information. Per CCPA definition, we do not sell your personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 30 days before the change takes effect. The "Last updated" date at the top of this page reflects when the policy was last revised.

15. Contact

For privacy-related questions, data requests, or to exercise your rights: