Privacy Policy

This Privacy Policy describes how OutreachAI ("we", "our", "us"), operated by Rana Faraz Ahmed (ranafarazahmed@gmail.com), collects, uses, and protects information when you use the OutreachAI personal outreach CRM platform, available at crm.dexdevs.com and associated API endpoints (collectively, the "Service").

By using the Service, you agree to the practices described in this policy. If you do not agree, please discontinue use.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Your name and email address
• A hashed version of your password (we never store plaintext passwords)
• Optional profile information you provide

1.2 CRM Data You Enter

We store data you deliberately enter into the Service, including:

• Contacts — names, email addresses, phone numbers, job titles, LinkedIn URLs, notes
• Opportunities — opportunity titles, organizations, descriptions, deadlines, URLs, status, priority, notes
• Email drafts and messages — subject lines, body text, recipients
• Follow-up reminders — scheduled dates and notes
• Email account credentials — SMTP/IMAP settings stored in encrypted form

1.3 API Usage Data

When you or your AI integrations (GPT Actions, MCP clients, n8n) call our API, we log: request timestamps, endpoints accessed, response status codes, IP addresses, and field names only (never field values) for audit purposes.

1.4 Technical Data

• Server-side logs including IP addresses and User-Agent strings
• Error logs for debugging purposes
• Timestamps of account activity

1.5 No Tracking Cookies

We do not use third-party analytics, advertising cookies, or cross-site tracking. Session cookies are used solely to maintain your authenticated session.

2. How We Use Your Information

We use your information exclusively to:

• Provide and operate the Service
• Authenticate your identity and maintain your session
• Process your CRM data and display it back to you
• Send emails via your configured SMTP account (only when you explicitly trigger sending)
• Detect and prevent abuse, fraud, and unauthorized access
• Debug errors and improve service reliability
• Comply with legal obligations

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 4.

3. AI Features & Data Processing

OutreachAI integrates with external AI services (such as OpenAI's ChatGPT) via a GPT Actions schema and MCP protocol. When you use these integrations:

• Your AI client (e.g., ChatGPT) communicates with our API using your API key
• Data returned by our API (contact names, opportunity titles, etc.) is processed by the AI provider you have chosen
• We do not send your data to any AI provider ourselves — your client does, under your control
• Email drafts created via AI are never sent automatically — you must explicitly approve and send them from the CRM interface
• API audit logs record which actions were taken but not the full content of messages

Please review the privacy policy of any AI provider you connect (e.g., OpenAI Privacy Policy, Anthropic Privacy Policy).

4. Data Sharing

We do not sell, rent, or trade your personal information. We may share data only in these limited circumstances:

• Infrastructure providers: Our hosting provider (VPS server) processes data on our behalf. The server is located in North America/EU.
• Legal requirements: If required by applicable law, court order, or governmental authority.
• Safety: To protect the rights, property, or safety of OutreachAI, our users, or others.

5. Data Retention

Your CRM data is retained for as long as your account exists. You may delete individual records at any time within the application. To request deletion of your entire account and all associated data, contact us at ranafarazahmed@gmail.com. We will process deletion requests within 30 days.

Audit logs and server logs may be retained for up to 90 days for security and debugging purposes, after which they are permanently deleted.

6. Data Security

We implement industry-standard security measures:

• All data in transit is encrypted via TLS/HTTPS
• Passwords are hashed using bcrypt — plaintext passwords are never stored
• API keys are stored as SHA-256 hashes — raw tokens are shown only once
• Email account passwords are stored using AES-256 encryption
• API access is scoped — each token grants only the permissions you configure
• IP allowlists are supported for API clients

No system is 100% secure. In the event of a data breach that affects your personal information, we will notify you within 72 hours of becoming aware, in accordance with applicable law.

7. Your Rights (GDPR & Similar)

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request that we restrict processing of your data
• Objection: Object to processing based on legitimate interests
• Withdrawal of consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email ranafarazahmed@gmail.com. We will respond within 30 days.

8. Cookies

OutreachAI uses only essential cookies:

• Session cookie: Maintains your authenticated session. Deleted when you log out or close your browser.
• CSRF token cookie: Protects against cross-site request forgery attacks.

We do not use advertising cookies, analytics cookies, or any third-party tracking technologies.

9. Children's Privacy

OutreachAI is intended for users 16 years of age and older. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or via an in-app notice. The "Last updated" date at the top of this page will always reflect the most recent revision.

11. Contact Us

For privacy-related questions, data requests, or concerns, contact:

• Name: Rana Faraz Ahmed
• Email: ranafarazahmed@gmail.com
• Website: crm.dexdevs.com