Privacy Policy

Welcome to OutX.ai! This Privacy Policy explains how OutX.ai ("OutX," "we," "us," or "our") collects, uses, shares, and protects your personal data when you use our website, Chrome extension, and related services (collectively, the “Service”). The Service helps you extract publicly available LinkedIn data (e.g., names, job titles, emails), track keywords on LinkedIn, and automate outreach, all in compliance with applicable laws and LinkedIn’s Terms of Service (TOS).

We’re committed to safeguarding your privacy while providing a powerful tool for sales professionals, recruiters, and marketers. This policy complies with laws like the General Data Protection Regulation (GDPR) in the EU, the California Consumer Privacy Act (CCPA), India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and other jurisdictions’ regulations. Please read this carefully. By using the Service, you agree to this Privacy Policy and our Terms of Service.

1. Our Role and Your Responsibilities

• OutX as a Data Processor:We process personal data on your behalf to provide the Service (e.g., extracting LinkedIn data, tracking keywords). Under GDPR, we’re a data processor; under the DPDP Act, we’re a data processor (Sec. 2(j)); under CCPA, we’re a service provider. We don’t decide how or why data is used—that’s up to you.
• You as a Data Controller/Fiduciary: When you use the Service to extract or track data (e.g., emails for personalized outreach), you’re the data controller (GDPR), data fiduciary (DPDP Act, Sec. 2(i)), or the entity responsible under CCPA. You must ensure your use complies with all applicable laws, including obtaining consent where required.

2. Data We Collect

We collect minimal data to operate the Service effectively:

2.1 Data You Provide

• Account Data: When you create an Account, we collect your email address (including when you sign up via Google or Outlook) and payment information (processed via a third-party provider).
• Keyword Tracking Queries: Keywords you input to monitor LinkedIn content (e.g., brand names, topics).
• Dispute/Legal Data: Any information relevant to disputes or legal proceedings affecting us.

2.2 Data We Collect Automatically

• Usage Data: Interactions with the Service, like searches, exports, and keyword tracking frequency, to improve functionality.
• Device Data: IP address, browser type, operating system, and similar info collected via cookies (see Section 8).

2.3 LinkedIn Data We Process (Not Store)

• Extracted Data: Publicly available LinkedIn data you extract (e.g., names, job titles, company details, emails) and keyword tracking results (e.g., mentions in posts or profiles). We facilitate extraction and tracking but don’t store this data beyond your session unless you export it.
• No LinkedIn Credentials: We don’t collect or store your LinkedIn login details—you provide access via your own account.

3. How We Use Your Data

We use your data to:

• Provide the Service: Process your Account, extract LinkedIn data, track keywords, and enable exports or outreach automation.
• Improve the Service: Analyze usage (e.g., via analytics cookies) to optimize features like keyword tracking or data extraction.
• Communicate:Send Service updates, respond to support requests at [support@outx.ai], or, with your consent, share promotional offers.
• Comply with Laws: Retain data as required (e.g., tax records for 7 years under India’s DPDP Act Sec. 8(7)).
• Aggregate Data: Use non-personal, aggregated data (e.g., usage trends) to enhance the Service, excluding personal LinkedIn data.
• Defend Our Rights: Use dispute/legal data to protect our interests in proceedings (based on legitimate interest).

Legal Bases (GDPR, DPDP Act)

• Contract: To fulfill our agreement with you (GDPR Art. 6(1)(b), DPDP Act Sec. 4).
• Legitimate Interest: To improve the Service, ensure security, and defend our rights (GDPR Art. 6(1)(f)).
• Consent: For non-essential cookies or marketing emails (GDPR Art. 6(1)(a), DPDP Act Sec. 6).
• Legal Obligation: To meet regulatory requirements (GDPR Art. 6(1)(c)).

4. Your Use of Extracted or Tracked Data

You’re responsible for how you use data extracted or tracked via the Service (e.g., emails for personalized outreach, keyword tracking reports). This includes:

• Obtaining Consent: You must secure explicit consent from individuals before using their data (e.g., for email campaigns), unless another lawful basis applies (GDPR Art. 6, DPDP Act Sec. 6, CCPA).
• Compliance: Adhere to LinkedIn’s TOS and laws like CAN-SPAM, GDPR, CCPA, and India’s IT Rules, 2021. We don’t verify consent or compliance—that’s on you.
• Example: If you extract an email and send a personalized message, you must ensure it’s lawful (e.g., with consent or opt-out options).

5. Data Sharing

We share data only as necessary:

• (a) With trusted providers (e.g., payment processors, hosting services like Bubble or Heroku, analytics tools) under strict agreements compliant with GDPR Art. 28, CCPA, and DPDP Act Sec. 7. See our sub-processor list at outx.ai/subprocessors.
• (b) If required by law, court order, or to protect our rights, with any competent law enforcement body, regulatory agency, or court.
• (c) To auditors, advisors, or legal agents for business purposes, under confidentiality agreements.
• (d) To potential buyers during a merger or sale, restricted to purposes in this Policy.
• (e) With your prior consent to others.
• No Sales: We don’t sell your personal data under CCPA or any other definition.

6. Data Retention

• Account & Usage Data: Kept as long as your Account is active or needed for the Service (e.g., support). Post-deletion, destroyed within 30 days; if not deleted, retained for 3 years from last use, then destroyed, unless legally required (e.g., 7 years for tax records). If deletion is delayed (e.g., due to backup archives), we’ll securely store and isolate your data until deletion is possible.
• Extracted/Tracked LinkedIn Data: Deleted after your session unless exported. Exported data (e.g., CSV files) is stored on your device—we don’t retain it.
• Anonymized Data: We may keep aggregated, non-identifiable data indefinitely for Service improvement.

7. Data Transfers

• Server Location: Our servers are in the United States. Data (e.g., Account data, usage data, keyword queries) is transferred there.
• Safeguards:
  • EU Users: Transfers use Standard Contractual Clauses (SCCs) (Module Four: Processor-to-Controller, governed by California law, disputes in San Francisco courts) per GDPR Art. 46.
  • Indian Users: Transfers align with DPDP Act Sec. 16 (pending rules).
  • Other Jurisdictions: Compliant with local laws where applicable.
• Your Exports: You’re responsible for any onward transfers of exported data (e.g., emails, tracking reports).
• Further Details: Contact support@outx.ai for more information on transfer safeguards.

8. Cookies

8.1 What We Use

• Essential Cookies: For functionality (e.g., session management, keyword tracking settings). No consent needed (GDPR Art. 6(1)(b)).
• Analytics Cookies: To track usage (e.g., page visits, extraction frequency). Consent required for EU/Indian users (GDPR Art. 6(1)(a), DPDP Act Sec. 6).

8.2 Management

• EU/Indian Users: Opt-in via our cookie banner at outx.ai/cookies. Withdraw consent anytime there.
• California Users: No “sale” under CCPA; disable in your browser.
• Retention: Essential cookies expire at session end; analytics up to 12 months.

8.3 Third-Party Cookies

We may use tools like Google Analytics with IP anonymization for compliance.

9. Your Rights

9.1 GDPR (EU Users)

• Access, rectify, erase, restrict, or object to processing your data.
• Request data portability.
• Withdraw consent (e.g., for cookies).
• Opt out of marketing emails by clicking ‘unsubscribe’ in our emails or emailing support@outx.ai.
• Contact us at support@outx.ai; response within 30 days.

9.2 CCPA (California Residents)

• Know: We collect identifiers (e.g., email, IP), commercial info (e.g., payment data), usage data; sources: you, cookies; purpose: Service delivery.
• Delete: Request deletion of data we hold.
• Opt-Out: No data sales occur.
• Non-Discrimination: Exercising rights won’t affect Service access.
• Submit requests at support@outx.ai or call 1-800-XXX-XXXX; response within 45 days (extendable by 45).

9.3 DPDP Act (Indian Users)

• Access a summary of your data and processing activities.
• Correct or erase inaccurate/incomplete data.
• Withdraw consent for non-essential processing (e.g., marketing).
• Nominate someone to manage your data if incapacitated.
• File grievances with us or the Data Protection Board (once established).
• Contact support@outx.ai; response within 30 days or per DPDP rules.

9.4 Other Jurisdictions

Rights under local laws (e.g., PIPEDA in Canada) apply. Contact us to exercise them.

10. Security

• We use industry-standard measures (e.g., encryption, access controls) to protect your data from unauthorized access, loss, or alteration.
• You’re responsible for keeping your data accurate and current by notifying us of changes (e.g., new email) at support@outx.ai.
• If a breach occurs, we’ll notify you without undue delay and mitigate it, per GDPR Art. 33, DPDP Act Sec. 8, and CCPA.

11. Children’s Privacy

The Service is for users 18+ only. We don’t knowingly collect data from children under 18 (or the age of majority in your jurisdiction). If we learn of such data, we’ll delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy, notifying you via email or outx.ai/privacy. Changes take effect upon posting or as required by law (e.g., 30 days’ notice under DPDP Act Sec. 18). Continued use means acceptance.

13. Third-Party Links

Our site may link to third-party websites with their own privacy policies. We’re not responsible for their practices; use them at your own risk.

14. Contact Us

General Inquiries: support@outx.ai