Who handles your data,where, and for how long

Version 2026-11-12, effective 2026-11-12. A signed order form or agreement prevails where it differs. Questions: [email protected].

Roles

For the people your campaigns reach (prospects), you are the controller and Outlevo is your processor: it handles their data only on your instructions and under the policies you approve. For your account, billing, sign-in and support data, and for visitors to outlevo.com, Outlevo is the controller.

For its own purposes as controller (running accounts and billing, keeping the service secure and preventing abuse, and measuring visits to outlevo.com) Outlevo relies on the contract with you, on its legitimate interests in security and abuse prevention, and on your consent where a cookie or a form asks for it; the privacy page says what each covers. The customer is responsible for having a lawful basis to contact the people in a campaign, as the terms say. What Outlevo does to help is on safety and controls and domain protection: suppression lists, only verified addresses, and the first emails reviewed by you.

Data processing addendum

The data processing addendum is part of the terms and applies from the day you accept them, to all personal data we process for you. It is on its own page. For a countersigned copy, write to [email protected] from your workspace owner's address and name the company and the workspace.

Read the data processing addendum Request a countersigned copy

It includes the EU standard contractual clauses (modules 2 and 3), the UK addendum and the Swiss terms.

Where data is stored

Outlevo's API and workers run on a DigitalOcean server in Frankfurt, Germany. The database, file storage and secret vault are Supabase in eu-west-1 (Ireland). Cloudflare sits in front of outlevo.com and the API.

Email addresses are encrypted at rest with AES-256-GCM and matched by a hash, and the secrets for connected services are kept in a vault.

Some vendors below process data outside the EEA, the UK and Switzerland, mostly in the United States. For each of them we rely on the vendor's own transfer terms (the EU-US Data Privacy Framework where it is certified, otherwise the EU standard contractual clauses with the UK and Swiss additions). Between you and us, the data processing addendum sets out the transfer terms.

Cold outreach and opt-outs

You are responsible for the lawfulness of your campaigns. For recipients in the United States that means CAN-SPAM: an accurate sender and subject, your postal address, and honouring every opt-out. For recipients in the EU and the UK you need a lawful basis, which for business-to-business outreach is normally legitimate interests (GDPR Article 6(1)(f)) where the national email rules allow it without consent; you must tell people who you are and why you write, and stop when someone objects. Some countries require prior consent even for business addresses, and you must not send there without it. Outlevo does not give legal advice.

Outlevo adds the sender's postal address and a one-click unsubscribe link under every email. An unsubscribe is recorded at once as a suppression and passed to the sending provider by a background job. A complaint, a hard bounce or an objection suppresses the address for every customer.

Breaches, audits and leaving

If we become aware of a personal data breach affecting your data, we tell the workspace owner by email without undue delay and in any case within 72 hours, with what we know: what happened, the data concerned, the likely consequences, the measures taken and who to contact. We send updates by email as we learn more.

We answer reasonable security questionnaires. Once a year, or after a personal data breach, you may audit the measures that protect your data: with 30 days' notice, in business hours, under confidentiality, limited to your data and at your cost, remotely where that is enough. We hold no third-party audit report today.

Before you close a workspace you can export your accounts, contacts and leads. When you close it you can ask, in the app, for its personal data to be deleted; after it is closed you can ask in writing, from the workspace owner's address. We delete it within 30 days of the request, after a wait of up to 7 days in which the owner can cancel. We keep what the law requires: invoices and billing records, the one-way hashes on the suppression list, and the log of who approved and changed what. Without a request it is not deleted on a timer. Deleted records can remain in database backups held by Supabase until they expire there under Supabase's own schedule.