Coldoutreach AI Privacy Policy

This policy explains what data Coldoutreach ("we", "us") collects when you visit coldoutreach.ai or use the Coldoutreach product, why we collect it, and the choices you have. We have tried to write it in plain English. If anything is unclear, email us at [email protected] and a person will answer.

Three commitments sit above everything else in this document: we never sell your data, we never use your prospect data or email content to train AI models, and opt-outs recorded anywhere in your workspace are honored everywhere, permanently.

1. Data we collect

Account data

When you create an account we collect your email address. We use a confirmation-code flow: we send a short code to your email to verify that you control the address. We store the email, the time you verified it, and the source of the signup (for example, which page the signup form was on). We do not require a name, phone number, or company name to open an account.

Contact form messages

If you write to us through the contact form or by email, we keep the message, your email address, and our reply so we can follow up and improve support. Contact messages are retained for up to 24 months unless you ask us to delete them sooner.

Usage analytics

When enabled, we use Microsoft Clarity and similar analytics to understand how visitors use the marketing site: which pages are viewed, how long visits last, approximate location at city level, device and browser type, and interaction patterns such as scrolling and clicks. These tools set cookies as described in the cookies section below. Analytics data is aggregated and is not used to identify you personally.

Server logs and IP addresses

Like almost every website, our servers automatically record standard request logs: IP address, requested URL, timestamp, referrer, and user agent. We use these logs for security, abuse prevention, and debugging. Raw logs are rotated and deleted on a rolling basis, typically within 30 days.

Attribution data

If you arrive from an ad or a link with UTM parameters, we store those parameters in a cookie or session so we can attribute signups to the campaign that brought you here. This tells us which marketing works; it does not tell us anything else about you.

2. Prospect data in your workspace

This is the part most customers care about, so we want to be precise.

• You are the controller of your prospect lists. When you import prospects into a workspace, you confirm you have a lawful basis to contact them. Coldoutreach processes that data only on your instructions, to research, draft and send your outreach.
• The demo on the marketing site sends nothing. The sequence composer on the homepage runs entirely in your browser against sample data. No email is sent, no prospect is contacted, nothing you pick is uploaded.
• Workspace data is encrypted. Prospect data and email content are encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Opt-outs are permanent and global. When a recipient unsubscribes or objects, the address is added to your workspace-wide suppression list and excluded from every current and future sequence. We do not allow suppression entries to be deleted or re-imported.
• Your data is never sold. Not to advertisers, not to data brokers, not to anyone. We do not sell or rent contact lists ourselves either.
• Your data is never used to train AI models. Neither ours nor any third party's. AI processing happens only to produce drafts and research for you, inside your workspace.
• Access is limited. Our staff do not look at your workspace data except when you explicitly ask for support on a specific issue, and access is logged.

3. Why we process data (lawful bases)

Where GDPR or similar laws apply, we rely on the following lawful bases:

• Contract: processing your account details and workspace data so we can provide the service you signed up for.
• Legitimate interests: security logging, fraud prevention, aggregate analytics, and improving the product.
• Consent: optional analytics and marketing cookies, and any marketing email. You can withdraw consent at any time.
• Legal obligation: retaining billing records where tax and accounting law requires it.

4. How long we keep data

• Account data: for as long as your account is active, and up to 30 days after deletion to allow recovery from mistakes.
• Workspace data (prospects, sequences, email content): until you delete it or close your account; deleted data is purged from backups within 35 days. Suppression lists are retained as long as legally required to keep honoring opt-outs.
• Billing records: as long as tax law requires, typically 7 years.
• Server logs: about 30 days.
• Analytics data: per the retention settings of each tool, typically 13 months or less.

5. Subprocessors

We use a small number of vendors to run the service. Each is bound by a data processing agreement and processes data only on our instructions.

Subprocessor	Purpose	Location
Amazon Web Services (AWS)	Application hosting, storage, backups	United States (us-east)
Cloudflare	CDN, DNS, DDoS protection	Global edge network
Microsoft Clarity	Website usage analytics (when enabled)	United States
Email delivery provider	Sending confirmation codes and transactional email	United States / EU

We will update this table if the list changes. Material changes are announced by email to account holders.

6. Your rights

Regardless of where you live, you can:

• Access the personal data we hold about you.
• Correct anything that is inaccurate.
• Delete your account and data. You can do this from account settings or by emailing us; deletion is completed within 30 days.
• Export your data in a machine-readable format, including your prospects and sequences.

If you are in the EU, UK, or another GDPR jurisdiction, you also have the right to restrict or object to processing and to lodge a complaint with your supervisory authority. If you are a California resident, the CCPA gives you the right to know, delete, and opt out of the sale of personal information. Since we do not sell personal information, there is nothing to opt out of, but the other rights apply and we honor them for all users, not only Californians. To exercise any right, email [email protected]. We respond within 30 days and never charge for a first request.

Recipients of outreach sent through Coldoutreach

If you received an email sent by one of our customers, the customer is the data controller for that message. Every email sent through Coldoutreach carries a working unsubscribe link; using it suppresses your address across that customer's workspace immediately. You can also email us at [email protected] and we will help route your request to the sender or suppress your address platform-wide.

7. Cookies

We use three kinds of cookies:

• Essential cookies: session and security cookies (including CSRF protection) needed for the site to work. These cannot be turned off.
• Analytics cookies: set by analytics tools when enabled, to measure how the site is used.
• Attribution cookies: short-lived cookies that remember UTM parameters so we can credit the campaign that brought you here.

You can block non-essential cookies in your browser settings, and the site will keep working.

8. Security

All traffic is served over HTTPS. Workspace data is encrypted at rest. Access to production systems is restricted to a small number of engineers with two-factor authentication, and access is logged. If we ever discover a breach affecting your personal data, we will notify you without undue delay and within any legally required timeframe.

9. Children

Coldoutreach is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to this policy

When we change this policy, we update the date at the top of this page. For material changes we will email account holders before the change takes effect. Continued use of the service after a change means you accept the updated policy.

11. Contact

Questions, requests, or complaints: [email protected]. We read everything.