1. Who is responsible
- Account data (your name, email, password hash, sign-in, billing and support records) and website data (early-access requests): Dynode LLC is the controller.
- Workspace data (campaigns, the companies and people you research and contact, emails and replies, call notes, deals): our customer is the controller and Dynode processes it on their behalf, only to provide the Service. Customers decide whom they contact and must have a lawful basis to do so, such as legitimate interest for relevant B2B outreach.
2. What we collect
- Account: name, email, hashed password, optional two-factor secret (encrypted), active sessions (device and IP address), and an activity log of actions in your workspace.
- Workspace: what you create, and what Outrio gathers for you from public sources: company websites, business directories and maps listings, company registries, news and press articles, the company's own public social media posts, and public professional profiles found through web search. Only business-related, professional information is used. Mailbox connection tokens and passwords (encrypted), and emails sent and received through connected mailboxes that belong to your campaigns.
- Outrio Worker: the device name you choose, operating system, app version and connection times. The worker runs AI tasks on your computer with your own Claude Code; it doesn't collect your files.
- Billing: plan, invoices and payment status from Stripe. We never see or store full card numbers.
- Website: the details you submit in the early-access form. We don't use advertising or analytics trackers on outrio.ai.
3. How we use it
To provide the Service (research, writing, sending from your mailbox, reply handling, calendars and reports), keep it secure and prevent abuse, bill you, provide support, and contact you about your account and important changes. Legal bases under the GDPR: performance of our contract with you, our legitimate interests in running and securing the Service, and legal obligations. We don't sell or share personal data for advertising, and we don't use workspace data to train AI models.
4. Google user data
If you connect a Google account, Outrio requests access to send email, read the messages in your mailbox that relate to your campaigns (to detect replies, bounces and opt-outs), and check your calendar's free/busy time and create meeting events. We use this data only to provide those features to you.
Outrio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, don't sell it, don't use it to train AI models, and don't let humans read it except with your permission, for security, or where the law requires. You can disconnect the account in Settings at any time, or revoke access in your Google account.
Microsoft 365 and IMAP mailboxes are handled the same way.
5. AI processing
Outrio uses Claude, by Anthropic, to research companies, write emails and draft replies. Depending on your workspace's choice, requests are sent to Anthropic's API from our servers (with our key or yours), or run on your own computer by the Outrio Worker through Claude Code under your own Anthropic account. Anthropic doesn't train models on API data by default. When the worker uses your Claude account, Anthropic's terms and privacy settings for that account apply.
6. Service providers
We share data with these providers only as needed to run the Service, under agreements that protect it:
- Hetzner Online (Germany): servers and database hosting.
- Cloudflare: network, security and content delivery.
- Anthropic: AI processing.
- Stripe: payments and invoices.
- Resend: account emails such as invitations and daily digests.
- Google, Microsoft and your email provider: your connected mailboxes and calendars, at your request.
- Hunter and Google Maps Platform: email finding, verification and business listings, when enabled in your workspace.
We may disclose data if required by law, to protect rights and safety, or as part of a merger or acquisition, in which case this policy continues to apply.
7. Cookies
- io_session (app.outrio.ai): keeps you signed in. Essential, HttpOnly, 30 days.
- outrio_signed_in (outrio.ai): holds only the value "1" so this website can show "Dashboard" instead of "Sign in". Removed when you sign out.
- Your browser may store your display preferences (for example light or dark mode) locally.
We don't use advertising or cross-site tracking cookies.
8. Where data is stored
Our servers and database are hosted by Hetzner in the European Union (Germany). Some providers above, and Dynode LLC, are in the United States; where personal data from the EEA, UK or Switzerland is transferred there, we rely on the EU Standard Contractual Clauses or other lawful transfer mechanisms.
9. Retention and deletion
Workspace data is kept while the workspace exists. Activity logs are kept for 180 days, backups for up to 14 days. When a lead is removed or a workspace is closed, we delete or anonymize its data within 30 days, except records we must keep for legal, tax or billing reasons. Opt-outs are kept on a do-not-contact list so those people aren't contacted again.
10. Security
Error reports are processed by our own self-hosted error tracker on the same servers; they exclude cookies, headers and credentials. Encryption in transit (TLS) and of stored secrets such as mailbox tokens and API keys, isolated workspaces with access checks on every request, two-factor sign-in, revocable sessions, a firewalled server with no database exposed to the internet, automatic security updates and nightly backups. No system is perfectly secure; we'll notify you without undue delay of a breach affecting your data.
11. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or California law), you can ask to access, correct, export or delete your personal data, restrict or object to processing, and withdraw consent. Write to privacy@outrio.ai; we'll answer within 30 days. You can also complain to your local data-protection authority. We don't sell personal information.
12. If an Outrio customer contacted you
The business that emailed you decided to contact you and is responsible for that choice. To stop further emails, reply "unsubscribe" to their message: Outrio adds you to their do-not-contact list automatically. You can also write to privacy@outrio.ai with the sender's name, and we'll pass your request to them and help them honor it.
13. Changes
We'll post updates here and change the effective date. For material changes we'll notify workspace owners by email or in the app before they take effect.
14. Contact
Dynode LLC · privacy@outrio.ai