Privacy Policy

What OutboundOS is

OutboundOS helps businesses find prospects, write outreach emails, and send them from the business’s own email inbox. By default, every email is reviewed and approved by a human before it sends. You can optionally turn on autonomous replies for an agent. Then only replies that pass automated safety checks send without per-email review. That setting is off by default and you can turn it off at any time.

What we collect

• Account information: your name, email address, and login credentials.
• Business information you provide: company details, what you sell, who your customers are, documents you upload, and email drafts you edit.
• Prospect data: contact and company information you import, or that the product finds from public sources at your direction.
• Email activity: emails sent through the product, delivery status, opens on emails that use tracking, and replies to your outreach.
• Usage data: how you use the product (features used, actions taken), for operating and improving it.

Google user data

If you connect a Gmail or Google Workspace inbox with “Sign in with Google,” we request only two things: permission to send email on your behalf (the gmail.send scope) and your basic profile (email address) to identify the connected account.

• How we use it: solely to send email from your own inbox at your direction: emails you approved individually, or, only if you have turned on autonomous replies for an agent, replies that pass automated safety checks under that standing instruction. Sending never happens outside those two paths.
• What we do not do: we do not read, browse, or store your mailbox through Google’s APIs. We do not use Google user data for advertising, and we never sell it.
• How it is stored: the connection token Google gives us is stored encrypted, on servers with restricted access, and is used only for the sending described above. Disconnecting your inbox in Settings asks Google to invalidate the token and permanently deletes our copy; you can also revoke access anytime at myaccount.google.com/permissions.
• Who it is shared with: no one, beyond the infrastructure that runs the product (listed below). No human at OutboundOS reads your Google data except with your permission to resolve a support issue you raise.

OutboundOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Reading replies

If you connect your inbox with an app password instead of Google sign-in, the product checks that inbox for replies to your outreach, so follow-ups stop automatically when someone answers, and a suggested response can be drafted for your review. Here is exactly what that means. We check your inbox, and on Gmail your All Mail folder, for replies and for bounce notices. To find them we read the sender, subject and date of recent messages, and we open the full message only for the ones that match your outreach. An app password gives us full access to that mailbox: we limit ourselves to the above by policy, not by a restriction Google enforces on us. You can revoke that app password at any time in your Google account.

Cookies and what we store on your device

We set no advertising or analytics cookies, and there is no tracking script of any kind on this site. Everything we store is needed to keep you signed in and to remember the choices you made, which is why there is no consent banner: there is nothing to consent to.

Cookies: your sign-in session, your second-factor check, a 30-day “remember this device” marker if you asked for one, a short-lived marker while you connect Google, and, for SETR staff only, a marker while viewing an account for support. Stored in your browser: your light or dark choice, whether the sidebar is collapsed, whether you have seen the tour, and a working copy of the page you last used so it opens instantly. Signing out clears the working copies and leaves only your display preferences.

Who we share data with

We use a small set of service providers to run the product: hosting (Vercel), database (Supabase), AI text generation (Anthropic), and email delivery infrastructure. They process data only to provide their service to us. We do not sell your data or share it for advertising. We may disclose data if the law requires it.

Retention and deletion

We keep your data while your account is active. Ask us at admin@getsetr.ai and we will delete your account data, including connected-inbox tokens and prospect data, within 30 days.

Security

Data is encrypted in transit and at rest. Inbox credentials and tokens are stored encrypted, access to production systems is restricted, and sending requires human approval by default (per-email review unless you explicitly enable autonomous replies for an agent).

Changes and contact

If this policy changes materially, we will note it here with a new effective date. Questions or requests: admin@getsetr.ai.