Privacy policy
This explains what Sales Outreacher does with personal data. It is written to be read, not to be survived, so it says plainly what is collected and why rather than listing every category of thing a system could conceivably hold.
Who we are
Sales Outreacher is a product of Collaborative Business Development Limited, registered in Scotland, company number SC537302, at Provender House, Waterloo Quay, Aberdeen AB11 5BS. For the data described below as ours to decide about, we are the data controller. We are registered with the Information Commissioner’s Office under number ZC256316.
Everything here can be taken up with us at admin@salesoutreacher.com.
Two different kinds of people appear here
Our customers, the businesses and salespeople who sign in and use the product. For their data we are the controller: we decide what to collect and why.
Their prospects, the people our customers reach out to. For that data our customer is the controller and we are the processor. They choose who to contact and on what basis; we provide the software that does it. That distinction matters, and it is not a way of passing the buck: if you have been contacted through this product and want it to stop, the last section tells you how, and it works whether or not you know who contacted you.
What we collect about our customers
- Account: name, work email address, and a password, which is held hashed by our authentication provider and is never visible to us.
- Preferences: your timezone, your email signature, your reply-to address.
- Activity: a record of changes made in the product, who changed what and when. This is kept for 24 months.
- Billing: your company name, billing address, VAT number if you give one, and a history of what you were invoiced and paid. See Paying for it below.
- Sign-in cookies, which keep you signed in and remember which account you last opened. There is no advertising or analytics tracking in the product.
Why we are allowed to hold it
For our customers, almost all of it is performance of a contract: we cannot run an account for somebody without holding their name, their address and what they did in it. The billing records are a legal obligation, because UK company law requires us to keep accounting records. The activity log is our legitimate interest in being able to answer "who changed this", which is a question that protects the customer as often as it protects us.
We do not rely on consent for any of it, which means there is no consent to withdraw. If you want us to stop holding your account data, the answer is to close the account, and the retention section below says what happens then. There is no advertising, no profiling and no automated decision-making that produces a legal or similarly significant effect.
Reading and sending from your mailbox
If you connect a Microsoft 365 or Google mailbox, we ask for permission to do two things, and it is worth being precise about both.
- Send mail as you. Campaign emails leave your own mailbox, from your own address, so they authenticate under your own domain and replies arrive in your own inbox. We do not send from our infrastructure on your behalf.
- Read your mail. Solely to notice when somebody replies, so that a sequence stops rather than continuing to chase a person who has already answered. What the software asks for is deliberately narrow. Every few minutes it requests four details about messages that have arrived in your inbox since it last looked: who each one is from, when it arrived, and two identifiers. It does not request the subject and it does not request the body. Anything from somebody who is not currently in one of your campaigns is compared and discarded in the same instant, and nothing about it is written down or logged. For a message that does match, it reads that one message’s technical headers, to tell a person replying from an out-of-office responder. What we keep is that a reply arrived, from which address, and which campaign it relates to. We do not analyse, index, store or train on your messages.
The credentials that allow this are encrypted before they are stored, held in a part of our database that is not reachable from any web browser, and destroyed when you disconnect. Disconnecting from within Sales Outreacher removes our ability to use them; you can also withdraw the permission at your provider, and we would encourage you to do both.
Sales Outreacher’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train any model, and no human at Sales Outreacher reads your messages. The only exceptions are the ones that policy itself allows: with your explicit permission, where it is necessary for security or to comply with the law.
Data we receive from Google
The section above describes both mailbox providers. This one answers the same questions for Google specifically, in the order they are usually asked.
What we access
When you connect a Google mailbox, Sales Outreacher asks for these permissions and no others:
openid,userinfo.emailanduserinfo.profile— to know which account you connected and to show your name and address on the mailbox screen.gmail.send— to send your campaign emails from your own mailbox, as you.gmail.metadata— to detect replies to those campaigns. This permission returns labels and headers and cannot return the body of a message. That is why it was chosen over the broader read permission: it makes “we never read your email” a property of what Google grants us rather than a promise about our conduct.
We use these permissions only to send campaign emails from your own mailbox and to detect replies to those campaigns. They are used for nothing else.
What we store
- Your OAuth tokens, encrypted, so that sending can continue without asking you to sign in again.
- For each reply to one of your campaigns: the sender’s email address, the time it arrived, and which campaign and step it relates to.
Subjects and message bodies are never stored. Nothing is recorded about any message that is not a reply to one of your campaigns.
Where it goes
It is stored in our Supabase database in London. No data obtained from Google is passed to Resend, to Stripe, or to any other third party. None of it is used for advertising, none of it is sold, and none of it is used to train any AI model.
How it is protected
Everything is encrypted in transit using TLS and encrypted at rest. The OAuth tokens are encrypted again on top of that, with a key the database does not hold, and are kept in a part of the database that is not reachable from any web browser. Access to live customer data is restricted to the members of Collaborative Business Development Limited staff whose work requires it, and is not available to the company generally.
How long we keep it, and how to have it deleted
- Tokens are destroyed the moment you disconnect. On Google we also withdraw the permission at Google itself, so Sales Outreacher stops appearing in your account’s list of connected apps.
- Reply records last as long as the contact they belong to. Erasing a contact destroys the sender’s address on them. That happens as soon as you ask, automatically 90 days after a contact is deleted, and automatically 90 days after an account ends. What remains carries nothing identifying, and is removed altogether 12 months after an account ends.
- You can disconnect at any time, either in Settings inside Sales Outreacher or from the permissions page of your Google account. Doing it in either place is enough; doing both does no harm.
- To have everything we derived from Google deleted, write to admin@salesoutreacher.com and we will do it and confirm when it is done.
Paying for it
Payments are taken by Stripe, which acts as our payment processor. When you subscribe, Stripe collects your card details directly. They never pass through Sales Outreacher and we never see or hold them.
What we hold is what we need to bill you and to keep proper accounts: your company name, the billing address and VAT number you gave at checkout, an identifier for your Stripe customer record, how many seats you have, and the history of what you were invoiced and paid.
Stripe is an independent controller of the payment data it holds, under its own privacy policy. It is contracted through Stripe Payments Europe in Ireland, and may transfer data outside the European Economic Area under the safeguards set out in its own terms.
The browser extension
The extension never runs on a page by itself. It runs in one of two ways, and both require you to act:
- You highlight a name and right click, then choose to capture that person. Your browser grants access to that one page because you asked for it, for that visit only. Nothing is granted in advance and nothing persists.
- You enable a particular site, one at a time, through your browser’s own permission prompt. You can withdraw any of them at any time in your browser’s extension settings.
In both cases, what it does is the same: it looks at the part of the page immediately around the name for an email address, and shows you what it found, where on the page it read it from, and the email that would be sent. Nothing leaves your browser until you confirm, and what it found is yours to correct first. The name, address, company and job title are all editable, and what you send is what is on the screen, not what was detected.
What reaches your account is therefore the details you confirmed, together with the page’s address and title so there is a record of where the contact came from. The extension does not track your browsing, reads nothing on any page you have not acted on, and holds nothing locally except the token that connects it to your account.
Contacts our customers add
Our customers add people to their account: a name, an email address, usually a company and a job title, and the web page the details were found on. We store that page address deliberately, so there is always a record of where a contact came from.
Our customers are responsible for having a lawful basis to contact those people. We provide the tools that make that possible to honour: a one-click way for a recipient to stop all future contact, which applies across every campaign in that account and cannot be undone by deleting and re-adding them.
Where it is held, and who holds it
Two different questions, and it is worth separating them, because a policy that answers only the first is telling you less than it appears to. Where your data is stored is not the same as which company holds it, and the second one is what decides whose laws can reach it.
Your contacts, campaigns and account records are stored in London and the application is served from there. But three of our four suppliers are companies outside the UK and the European Economic Area, so their own staff can reach what they store for us, and those transfers rely on the standard legal safeguards rather than on the data never leaving.
- Database: Supabase. The database itself is in London, and that is where accounts, contacts and campaigns live. The company we contract with is Supabase Pte. Ltd, in Singapore, so transfers are covered by the Standard Contractual Clauses and the UK Addendum.
- Application: Vercel. Served from London. The company is Vercel, Inc., and its data processing addendum applies the Standard Contractual Clauses to anything transferred outside the UK or the EEA.
- Account email: Resend. Sign-in and password emails only. Campaign email never passes through it; that leaves your own mailbox. Resend stores its data in the United States and offers no European storage option. Sending is routed through its European region, but storage is not, so the record of an account email, which includes your email address, sits in the United States under the Standard Contractual Clauses, the UK Addendum and Resend’s certification under the EU-US Data Privacy Framework.
- Payments: Stripe. Two Stripe companies are involved, as they are for every UK business: Stripe Payments UK Ltd, authorised by the Financial Conduct Authority under number 900461, for the regulated payment services, and Stripe Payments Europe Ltd in Ireland for everything else. Stripe may transfer data outside the European Economic Area under the safeguards in its own terms.
We would rather write that plainly than claim everything stays in Europe, which is the easier sentence and is not true.
How long we keep it
- Deleted records go to a recycle bin for 90 days so a mistake can be undone, then expire.
- Erasing a contact is one-way. Their identifying details are overwritten rather than merely marked deleted, and the email address is destroyed rather than hashed. A hash that can be matched back is still personal data.
- The activity record is kept for 24 months.
- When an account ends, which means a subscription that stopped or a free trial that was never taken up, two different things happen at two different times, and the split is deliberate.
- After 90 days, every contact is erased. One way, the same routine as above, addresses destroyed rather than hashed. These are the details of people who never had any dealings with us, and we held them because our customer was paying us to. Once that has stopped, so does any reason for us to keep them.
- After 12 months, the account itself goes. Campaigns, sequences, signature, team and settings. Those are our customer’s own writing and hold nobody else’s personal data, so there is no harm in them surviving a year, and real use in somebody coming back and finding their own work where they left it.
- Billing records are the exception, and we are required to keep them. UK company law obliges us to retain accounting records for six years from the end of the financial year they relate to. That record holds your company name, an account identifier, and what you were invoiced and paid. It holds none of your contacts and none of your campaigns.
How we protect your data
Everything is encrypted in transit, using TLS, and encrypted at rest by our database and hosting providers. Mailbox credentials are encrypted a second time before they are stored, with a key held outside the database, and live in a part of the database that no web browser can reach at all.
Access to live customer data is restricted to the members of Collaborative Business Development Limited staff whose work requires it, and is not available to the company generally. No member of staff reads the contents of your mailbox, and the permissions we hold do not allow it.
Who else sees it
Nobody buys it, and nobody is sold it. The only companies that process it are the four above, our database, hosting, account-email and payment providers, and your own mailbox provider, which already holds your mail. We do not use any of it for advertising, and we do not train anything on it.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to how we use it. Write to admin@salesoutreacher.com and we will answer within one month.
If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk. We are registered with the ICO under number ZC256316.
If you have been contacted through this product
Every email sent through Sales Outreacher carries a link that stops all further contact from that sender. It cannot be removed by the person who sent it, and it applies to every one of their campaigns rather than only the one you received. Replying to say stop has the same effect.
If you would rather deal with us directly, write to admin@salesoutreacher.com. We will pass it to the customer concerned and confirm it has been actioned.
If something goes wrong
If personal data we hold is lost or exposed, and it is likely to put the people it concerns at risk, we will tell the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell the people affected without undue delay where the risk to them is high.
Where the data belongs to one of our customers’ contacts, the customer is the controller and the duty to notify is theirs. We will tell them promptly so they are able to meet it, with what we know and when we knew it, rather than leaving them to find out.
Changes
If this changes in a way that affects you, we will say so rather than quietly updating the date at the top. You will be notified 30 days before a change takes effect, and at least 90 days before one that reduces what you get or widens what we do with your data, which matches the notice periods in the terms.