Privacy notice
This notice tells you what OutDM stores about you, why we use it, how long we keep it, and the controls you have.
OutDM helps you find creators for your app and send them messages you approve, from your own accounts. To do that, we store the information below and nothing more than the service needs.
What we store
Your account and workspace
Your name, your email address, a salted hash of your password (never the password), your sign-in sessions, and the workspace you own. When you sign in with Google, we receive your verified email address and your name, nothing else.
Your campaigns
Your app link, the audience, countries, languages and offer you confirm, the creator profiles we research for you with their public sources, your shortlist, your draft messages, the messages you approve and send, and the replies we sync into your inbox.
Your connected accounts
When you connect an email account (SMTP and IMAP) or a supported Instagram account through Unipile, we encrypt the credentials with a server-side key and never return them through the app. We store the connection status and the delivery records needed to show you what left your account.
Billing
Stripe handles checkout, your card and your invoices. We store the Stripe customer and subscription identifiers, the subscription status, the renewal date and the webhook events needed to know whether your plan is active. We never see your full card number.
We keep your support conversations for up to 540 days to answer your questions and follow up by email.
Operational records
We keep a log of your account activity (sign-ins, billing steps, product actions, IP address, country and browser) for up to 540 days. It protects your account and documents the service you received when someone disputes a payment.
We keep bounded job, delivery, rate-limit, security and health records to run and protect the service. These records exclude your credentials and your message drafts.
How we use it
- Sign you in and protect your workspace from other clients.
- Research creators, draft your messages and send only the text you approve, from the account you choose.
- Sync replies into your inbox and show you the state of each conversation.
- Run your subscription, your trial and your invoices through Stripe.
- Send you account email: verification, password reset and invitations.
- Keep backups, investigate failures and stop abuse.
We do not sell your data. We do not use your campaigns, your creator research or your messages for advertising. We do not train models on your workspace.
Who processes data for us
We send data only when a feature needs it: Stripe for billing; DeepSeek for creator research, message drafting and factual payment dispute rebuttals; Unipile for Instagram sending and replies; your own SMTP and IMAP providers for email you send and receive; BytePlus or Alibaba Cloud when you ask for a generated image; Cloudflare Turnstile to block bots on sign-in; Google when you choose Google sign-in; and our account mailer for verification and reset email. Each provider processes data under its own terms.
Cookies
We set one essential session cookie when you sign in, plus a short-lived cookie during Google sign-in. This browser also remembers, in local storage, the app link you typed on the landing page until you open your first campaign. We set no advertising or analytics cookies.
How long we keep it
- Your account, your campaigns and your connections: as long as you keep your account.
- Sign-in sessions: 30 days, or until you sign out or reset your password.
- Email verification links: 24 hours. Password reset links: 30 minutes.
- Billing records: as long as invoicing and tax rules require.
- Encrypted backups: a bounded rolling window the operator configures.
Your controls
You edit your campaigns, remove a connected account, cancel your subscription from Billing (the Stripe portal), and reset your password from the sign-in page. To export or delete your account, write to [email protected] from the email on your account. We answer within 30 days and delete everything except the billing records the law requires.
Security
Every request checks the workspace it belongs to. Passwords are hashed, provider credentials are encrypted at rest, sessions are revoked on password reset, and the database is never exposed to the internet. No online service can promise absolute security: keep your password private and remove a connected account you no longer use.
Contact
For a privacy question or request, write to [email protected].