OutboundOS Privacy Policy
Version 1.3
Effective Date: June 25, 2026
This Privacy Policy explains how XGenius LLC ("OutboundOS," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with the OutboundOS platform and related services (the "Service"). It applies to our website at outboundos.cc, the application, and related communications. This Privacy Policy is incorporated into our Terms of Service, available at https://outboundos.cc/terms.
By using the Service, you acknowledge the practices described in this Privacy Policy. If you do not agree with it, do not use the Service.
1. Two Roles: Controller and Processor
The Service handles two different categories of personal information, and our role differs for each.
For information about our customers and their users, such as the people who create accounts, sign in, and pay for the Service, we act as a controller. We decide how and why that information is processed, and this Privacy Policy governs it.
For the prospect, lead, and contact information that our customers upload, generate, enrich, or otherwise process through the Service in the course of running their own outbound campaigns, we act as a processor (or service provider) on behalf of that customer. The customer is the controller of that data and is responsible for having a lawful basis to process it, for providing any required notices to the individuals it concerns, and for honoring those individuals' rights. We process that data only to provide the Service and on the customer's instructions, as further described in our Terms of Service. If you are a prospect or contact and want to exercise rights over data a customer is processing about you, see Section 11.
For OutboundOS Leads, we may act as an independent controller when we source, license, access, select, verify, or maintain the lead data before a customer-directed campaign, and as a processor or service provider when we use that lead data to operate a managed campaign on a customer's behalf. OutboundOS Leads are not sold to customers and are not made available for export or download as raw lead data.
2. Information We Collect
Account and identity information. When you create an account, we collect your name, email address, login credentials, and organization details. If you sign up using a third-party identity provider, we receive basic profile information from that provider as permitted by your settings with them.
Payment information. Subscription payments are processed by Stripe. We do not store full payment card numbers on our systems. We receive limited billing details from Stripe, such as the last four digits of a card, billing contact, and transaction status, to manage your subscription.
Usage and device information. When you use the Service, we automatically collect information such as IP address, browser and device type, pages and features accessed, actions taken, and timestamps. We use this to operate, secure, and improve the Service.
Communications. When you contact us for support or other reasons, we collect the contents of your messages and our correspondence with you.
Customer data and prospect data. Through normal use of the Service, customers submit and generate data within their accounts, including prospect and lead records, enrichment results, campaign content, replies, pipeline information, suppression data, unsubscribe data, sending activity, bounce and complaint data, and delivery-related status information. As described in Section 1, we generally act as a processor for this category on the customer's behalf.
OutboundOS Leads and licensed prospect data. We may receive from data providers, access through licensed sources, collect from permitted sources, or generate business lead, contact, company, enrichment, verification, and fit data for use as OutboundOS Leads. We use OutboundOS Leads to build, personalize, send, route, respond to, analyze, report on, and maintain suppression for managed campaigns. We do not sell OutboundOS Leads to customers, and we do not provide OutboundOS Leads as downloadable or exportable raw lead lists.
Credentials, connected providers, and managed infrastructure data. Credit-billing customers use OutboundOS-managed AI, data, scraping, and verification infrastructure for supported platform operations. When you connect your own third-party provider credentials, such as sequencer, CRM, calendar, data, or other integration credentials, we store those credentials securely so the Service can call those providers on your behalf. If you use Managed Sending, we may process domain, DNS, mailbox, inbox, SMTP, sequencer, warmup, routing, reputation, bounce, complaint, suppression, unsubscribe, and delivery metadata needed to operate and monitor sending infrastructure. We do not use your credentials for any purpose other than operating the features you have configured.
3. How We Use Information
We use personal information to provide, operate, maintain, and secure the Service; to authenticate users and manage accounts and organizations; to process payments and administer subscriptions, starter credits, paid credits, and billing; to provide customer support; to communicate with you about the Service, including service, security, and billing notices; to monitor, analyze, and improve performance, reliability, and features; to detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms; and to comply with legal obligations and enforce our agreements.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. For OutboundOS Leads, we use lead data that we have rights to access to personalize, contact, and respond to prospects on behalf of customers in managed campaigns. We do not sell raw lead data to customers and do not provide OutboundOS Leads for export or download.
4. Automated and AI-Driven Processing
The Service uses automated and AI-driven systems to perform research, enrichment, classification, and content generation, including drafting outbound email copy and replies. These systems may process account data and customer data to produce their outputs. AI-generated outputs can contain errors or inaccurate statements, and customers are responsible for reviewing content before it is sent.
We do not use AI-driven processing to make decisions that produce legal or similarly significant effects about you without a lawful basis and, where required, human involvement.
5. How We Share Information
We share personal information in the following circumstances.
Service providers and sub-processors. We use third parties to provide infrastructure and functionality, and we share information with them only as needed to operate the Service. These include hosting and database infrastructure, payment processing, transactional email delivery, AI, data, enrichment, scraping, email sending, mailbox or SMTP infrastructure, sequencer providers, warmup and deliverability tooling, calendaring, CRM, analytics, and related providers. A current list of our sub-processors is available on request at [email protected].
Within your organization. Information is shared among users of the same organization and account according to the roles and permissions configured by the organization.
Legal and safety. We may disclose information where we believe in good faith that it is required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of OutboundOS, our users, or others, or to enforce our Terms.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy.
6. Cookies and Similar Technologies
We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand how the Service is used. Some cookies are essential for the Service to function. You can control non-essential cookies through your browser settings, though disabling certain cookies may affect functionality.
7. Data Retention
We retain personal information for as long as your account is active and as needed to provide the Service, and afterward for as long as necessary to comply with legal, tax, accounting, and billing obligations, resolve disputes, and enforce our agreements. Customer data is retained according to the customer's use of the Service and is deleted or returned in accordance with our Terms following account closure, subject to legal retention requirements and backup cycles. When information is no longer needed, we delete or de-identify it.
8. Security
We maintain administrative, technical, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include access controls, encryption in transit, tenant isolation, and secure storage of credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.
9. International Data Transfers
We are based in the United States and process information there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States and other jurisdictions that may have different data protection laws than your own. Where required, we rely on appropriate safeguards for such transfers.
10. Your Privacy Rights
Depending on where you live, you may have rights regarding your personal information, including the right to access the information we hold about you, to correct inaccurate information, to request deletion, to obtain a portable copy, to restrict or object to certain processing, and to withdraw consent where processing is based on consent.
If you are a California resident, you have rights under the California Consumer Privacy Act as amended, including the right to know what personal information we collect and how we use and disclose it, the right to delete, the right to correct, and the right not to be discriminated against for exercising your rights. As stated above, we do not sell personal information and do not share it for cross-context behavioral advertising.
If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR and UK GDPR, including those listed above, and the right to lodge a complaint with your local supervisory authority.
To exercise any of these rights with respect to information for which we are the controller, contact us at [email protected]. We will respond as required by applicable law and may need to verify your identity before acting on a request.
11. Prospect and Contact Rights
If you are a prospect or contact and a customer is processing information about you through the Service, that customer is the controller of your information and is responsible for handling your rights requests. We will refer your request to the relevant customer and assist them as a processor as required by law. If you do not know which customer holds your information, you can contact us at [email protected] and we will make reasonable efforts to direct your request appropriately.
If your request relates to OutboundOS Leads that we sourced, licensed, accessed, selected, verified, or maintained before a customer-directed campaign, we may handle the request directly, route it to the relevant customer when the request concerns that customer's campaign, record suppression or do-not-contact preferences, or take other steps required by applicable law.
12. Children
The Service is a business product intended for use by businesses and is not directed to children. We do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us personal information, contact us at [email protected] and we will take appropriate steps to delete it.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy at https://outboundos.cc/privacy, update the Effective Date above, and provide notice by reasonable means where required. Your continued use of the Service after the changes take effect constitutes acknowledgment of the updated policy.
14. Contact Us
If you have questions about this Privacy Policy or our handling of personal information, contact us at:
XGenius LLC
215 Legion Way SW
Olympia, WA 98501
[email protected]