Who is responsible
Contact your Outrich workspace operator through the privacy request form in your workspace. If you are not a member, contact the person or organization that invited you or sent you the outreach message.
The workspace operator determines the purposes of member account processing. Members determine the purpose and audience of their outreach campaigns. Responsibilities and legal bases depend on the deployment and the applicable law.
Information the service handles
- Account information: phone number, name, email, invitation, sign-in records and preferences. Organization administrators can see member names, phone numbers, roles, teams and membership status to manage access.
- Work content: chat messages, briefs, contact records, drafts, sent messages, replies, summaries and saved memories. Organization acquisition work also stores targets, people, relationships, source references, research facts, interaction notes and opportunities.
- Connected accounts: mailbox identifiers, access tokens and encrypted refresh tokens. Optional provider keys are encrypted before storage.
- Operational information: job states, error records, activity records, model token usage and hosting security logs.
How information is used
Information is used to authenticate members, execute requested outreach, personalize drafts, process replies, prevent duplicate or unwanted messages, provide support, and operate and secure the service. Website-sourced contact data is used for the member’s campaign. A published email address does not by itself establish consent to receive outreach.
AI processing and service providers
Relevant account and work content may be sent to the configured inference provider. Long-context requests can include conversation history, profile, saved memories and campaign details. Mail providers process messages; messaging providers process chat delivery; hosting and database providers operate the application. Search receives research queries. Providers are configured by the workspace operator. Review their current terms before connecting sensitive data.
This codebase has no pipeline that trains a shared model on private member content. Voice learning is off by default and, when enabled, uses sent-mail samples to build a private writing-style summary. The open-model router requests providers that do not collect data, but availability and provider terms must be verified by the operator. See the AI and data policy.
Retention and deletion
Members can choose 30, 90, 180 or 365 days for chat history and AI usage records. Retention maintenance deletes eligible older records in batches. Personal campaigns, contact records and saved memories remain until deleted or the account is erased. Organization acquisition records may remain available to other authorized members after one member deletes their account. Suppression records remain while the account exists to avoid sending to recipients who opted out.
Account deletion immediately disables access and disconnects stored mailbox credentials. Erasure of user-private application data and organization memberships starts after a 20-minute grace period to let in-flight work finish, then runs in batches. An organization owner must transfer ownership first. Contact the operator about changing or deleting shared organization records. Messages already delivered to recipients or stored in external mailboxes are not recalled. Hosting backups, security logs and provider copies follow the operator’s and providers’ retention arrangements; the application cannot erase those copies directly.
Your choices and requests
Use Settings to export your work records, select retention, revoke sessions, request correction or deletion, and contact the operator. Where applicable law provides rights to access, correct, erase, restrict, object, transfer data or complain to a regulator, contact the operator to exercise them. Identity verification may be required. Cookie choices are separate from processing needed to provide the service.
International processing and sensitive data
Processing locations depend on the configured services. The operator must establish any required international-transfer safeguards. Do not upload sensitive health, financial-account, government-ID or children’s data without an appropriate agreement and approved configuration. Outrich is intended for adults using it for business purposes.
Changes
The version date identifies this notice. Material changes to how information is used should be communicated before those changes take effect. New training uses require a separate decision and appropriate permission; accepting this notice does not grant permission for shared model training.