In short
- We process your account details to run the service, and your leads and messages only on your instructions.
- We never see your LinkedIn password, and mailbox passwords and integration tokens are stored encrypted.
- We don't sell personal data, show ads or use your leads and messages to train AI models.
- A handful of providers help us, each listed on our sub-processors page.
- You can ask to access, export, correct or delete your data at hello@outember.io.
The summary helps you find your way; the full text below is what applies.
1. Who we are
Outember is operated by Pixelpk, 79 Block G2, Johar Town, Lahore 54000, Punjab, Pakistan ("we", "us"). This policy explains what personal data we process when you use the service or visit outember.io, why, who helps us, how long we keep it and what you can ask us to do.
For your own account details, we're the controller. For the leads you import and contact, and the messages you exchange with them, you (our customer) are the controller and we process that data on your behalf, as set out in our Data processing addendum.
2. What we process
- Your account: name, email address, password (stored only as a one-way scrypt hash), the organizations and workspaces you belong to, your role, language and settings, and when you accepted these terms and the LinkedIn-automation notice.
- Billing: your plan, number of seats, billing period and Stripe customer reference. Stripe collects your card, billing address and tax ID; we don't store card numbers.
- Connected LinkedIn accounts: the account's profile and status, and the activity we run for you (invitations, messages, visits and their results), accessed through our provider Unipile. You sign in on Unipile's hosted page; we never see or store your LinkedIn password.
- Mailboxes: the address, server settings and either an app password or a Google or Microsoft sign-in token, encrypted before it's stored and never shown again. We read replies and bounces to campaign emails over IMAP.
- Leads: what you import or ask us to fetch: names, job titles, companies, locations, profile links, recent public posts, tags, custom fields, notes, and email addresses you upload or the email finder returns.
- Conversations: LinkedIn messages and emails sent and received through campaigns and the inbox, including attachments, and your existing LinkedIn conversations when you connect an account.
- Integrations: CRM tokens, webhook signing secrets and Slack webhook URLs (all encrypted), and a log of webhook deliveries.
- Contact and support: what you write in the contact form or in a support request, with your name and email.
- Technical data: IP address, browser details and server logs, and error reports when something breaks, to keep the service secure and working.
3. LinkedIn data we process for customers
To run campaigns, the service reads LinkedIn data through the customer's own connected account: profiles and recent posts of the people in their lists, search results, people who reacted to or commented on a post, the account's followers, connections and received invitations, and the account's conversations.
We process this data only for the customer who connected the account, only to run their outreach, and never to build a database of our own or to sell. The customer decides whom to contact and must have a lawful basis to do so.
If you received a message from one of our customers and want to know what they hold about you, or want them to stop, please contact them directly: they control that data. You can also write to us and we'll pass your request on and help them respond.
4. AI
When AI writing is on for a campaign step, we send the lead's profile details and recent posts, the campaign's brief and the step's text to Anthropic, whose Claude models write the draft. When a reply arrives, its text is sent to classify its intent and suggest an answer.
We don't use your leads or messages to train AI models. Drafts and classifications are stored with the campaign so you can review them.
5. Email
We send account emails (email verification, password resets, team invitations and the reply alerts you turn on) through our transactional email provider.
Cold emails in your campaigns go out from your own mailbox, not from ours.
We don't send marketing newsletters unless you ask for them.
6. Why we process it
- To provide the service you signed up for, including billing (contract).
- To keep it secure, prevent abuse, fix problems and improve it (our legitimate interests).
- To answer you when you contact us (legitimate interests, or steps before a contract).
- To meet our legal, tax and accounting obligations (legal obligation).
8. International transfers
We're based in Pakistan, and some of our providers process data in other countries, including the United States and the European Union. Where the law requires it, transfers are covered by appropriate safeguards such as the European Commission's standard contractual clauses.
10. How long we keep it
- Account, campaign and inbox data: while your organization's account exists, including after a plan ends, so you can pick up where you left off.
- After you ask us to delete your account: removed from our live systems within 30 days, and from backups within 90 days.
- A removed mailbox: its saved password or sign-in token is deleted straight away.
- Billing records: as long as tax and accounting law requires.
- Contact form and support messages: as long as needed to answer you and keep a record of our correspondence.
- Server logs and error reports: up to 90 days.
11. How we protect it
Data travels over HTTPS. Mailbox passwords, CRM tokens and webhook secrets are encrypted with AES-256-GCM before they're stored. Passwords are hashed, API keys and session tokens are stored only as hashes, and every request is checked against your workspace and role. More on our security page. No system is perfectly secure: if a breach affects your data, we'll tell you as the law requires.
12. Your rights
Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, export it, restrict or object to how we process it, and you can complain to your data protection authority.
Email hello@outember.io from the address on your account (or tell us how to reach you). We may ask you to confirm your identity, and we answer within 30 days.
13. Children
The service is for businesses and isn't meant for anyone under 18. We don't knowingly process children's data.
14. Changes to this policy
We'll post changes here with a new "Last updated" date, and tell account owners about important changes by email or in the app.
15. Contact
Questions or requests about your data:
Pixelpk, the operator of Outember
- Address: 79 Block G2, Johar Town, Lahore 54000, Punjab, Pakistan
- Email: hello@outember.io
- Phone: +92 302 7215087
Questions?
Write to hello@outember.io, or use the contact form. Outember is operated by Pixelpk, Lahore, Pakistan.