Privacy Policy

Who we are

The data controller for account and platform data is ArtByBearded AB (org. nr 559558-0985), registered at Regementsgatan 44, 831 35 Östersund, Sweden. Contact: contact@outvori.com. The product is marketed as Outvori ("the Service"), at outvori.com.

This policy covers the Service and its website. It does not cover the websites or services of mailbox providers, sub-processors, or other third parties.

Roles: who controls what

Data protection law gives different duties depending on whose data it is and who decides why it is processed.

Prospect and contact data — your customer is the controller, we are the processor. If you are a prospect, lead, or contact of a business that uses the Service, that business decides why your data is used. We process your data for them, under their instructions. Contact that business to exercise your rights. We help them respond.
Account and platform data — we are the controller. This covers people who create and manage accounts, invited workspace members, billing contacts, website visitors, and technical and security logs.

What we process and why

As controller:

Data	Purpose	Legal basis
Account and workspace details: name, work email, role, workspace name, organisation number	Create and manage your account, verify your business, provide support	Performance of contract; legal obligations (company and tax records)
Billing data: plan, invoices, payment status (card details are held by our payment provider)	Billing, accounting, fraud prevention	Performance of contract; legal obligation; legitimate interests (fraud prevention)
Technical and usage data: feature use, device and log data, IP address, audit log entries	Operate and secure the Service, troubleshoot, improve features	Legitimate interests (security, service operation and improvement)
Support conversations	Answer questions, document agreements	Performance of contract; legitimate interests

As processor, we process Customer Lead Data for the customer who controls it: prospect and contact records (name, work email, work phone, role, company), campaign and email content, send and delivery events, bounce and unsubscribe events, reply content and classification, notes, tasks, activities, and deal information. Processing covers sending email through the customer's connected mailbox, scheduling sequences, the CRM functions, AI-assisted drafting and classification that the customer requests, deliverability monitoring, and reporting. We process this data only on the customer's documented instructions; the Customer Data Processing Addendum sets the terms.

AI features

Message drafts and suggested replies are generated by an external language model provider. Which provider, and where it processes data, is set out in the sub-processors section below. Unsubscribe footers and headers are fixed text and are never AI-generated.

Drafts are never sent automatically. A person must approve each message before it can send. We do not use your prospect data to train or fine-tune models beyond producing output for your own workspace.

You can connect your own social accounts (a Facebook Page, an Instagram business account linked to it, a LinkedIn company page or LinkedIn profile) and your own website (for example Shopify, WordPress, Webflow, Wix or Ghost) so Outvori can publish the posts and articles you approve.

What we receive: the access tokens the platform issues when you connect, and the basic details needed to pick where to publish (Page, account or site names and IDs, profile picture). We do not receive your passwords.
What we do with it: publish the posts and articles you approve, or that you schedule with auto-publish switched on for that account, and read back the post IDs, links, comments and basic engagement figures for those posts so you can see them in Outvori. We do not read or post anything else, and we never use this data for advertising or to train AI models.
Storage: tokens and site credentials are encrypted per workspace and stored in the EU. Comments and engagement figures follow the retention settings above.
Disconnecting: disconnect any account in Settings > Connected accounts, or remove Outvori in the platform's own settings. Tokens are deleted at once. Meta users can also request deletion of the data Outvori received from Facebook or Instagram through Meta's data deletion option; we delete it and give you a confirmation code and a status page.
Each platform processes your data under its own terms and privacy policy (Meta Platforms Ireland, LinkedIn Ireland, Shopify and your website host).

Intent radar

Intent radar looks for public posts, questions and forum threads from people who are asking for what your business sells, so you can decide whether to answer them.

What is read: public content only, through each platform’s official API or public feed (for example Hacker News, Stack Exchange, public forum feeds, and Reddit once you connect it), within the platform’s limits and rules. Nothing behind a login, and no private messages.
What is stored: the public text of a matching post, the public handle that wrote it, the link to it, when it was written, and the score and draft reply Outvori made for you. For companies: the company name, website and the public lines that mention it.
Retention: entries are deleted after the number of days you choose in Comment leads settings. You can delete everything from one handle at any time in Intent radar settings, and we do so when the person asks us.
No messages for you: Outvori never sends a reply or a DM on its own. You send every reply yourself, either by copying it to the platform or, on your own Instagram and Facebook posts, with one click.
No selling: we never sell or share this data, use it for advertising, or use it to train AI models.

Outvori Sidekick (Chrome extension)

Outvori Sidekick is an optional Chrome extension that saves a comment you choose to your Intent radar list.

What it reads: only the comments visible on the page you are viewing, on Instagram, Facebook, TikTok, LinkedIn, X, YouTube and Reddit, and only while you are signed in to it and have switched it on for that site. It checks them inside your browser to highlight likely buyers. It never reads private messages, inboxes or settings pages, other websites or your browsing history, and it never scrolls, clicks or types on the page.
What it sends: only the comments you click Save on (the public text, the handle and the link to the post), to your own Outvori workspace. Nothing else leaves your browser.
Linking: you link it by approving a code in Outvori. Its access is limited to saving comments and reading back their score and draft; it cannot read your CRM, send anything or change settings. Unlink it any time in Intent radar.
Saved comments are stored and deleted like other Intent radar entries (see above), and are never sold or shared.

EU hosting and international transfers

The Service is hosted in the European Union, and Customer Data, including prospect data and email content, is stored and processed there.

Data can still reach outside the EU/EEA in these ways:

Email travels over the public internet to the recipient's mail server, wherever that server is. The recipient's provider decides where it stores mail.
Email in a connected mailbox is processed by the customer's mailbox provider (Google, Microsoft, or the customer's SMTP/IMAP host) under that provider's own terms and locations.
A sub-processor may process data outside the EU/EEA. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses and a transfer assessment.

Retention

The Service stores per-workspace retention settings: contacts and their child records, email bodies, and activity records each have a configurable retention period (current defaults: 365 days for contacts, 365 days for email bodies, 730 days for activity records; you may set any period between 30 and 3650 days), plus a legal-hold switch that blocks deletion. Erasure requests run through a two-phase flow with a 7-day undo window before deletion is final.

Beyond the product's settings:

Account and billing records are kept after termination as long as accounting law requires (in Sweden, bookkeeping rules require several years).
Suppression entries (unsubscribes, hard bounces, complaints, and erasure hashes) are kept in minimal, hashed form so opt-outs stay honoured. The hash survives erasure so future imports still match.
Backups are kept for up to 30 days and then deleted.
Support correspondence and audit log entries are kept. The audit log is append-only and keeps identifiers and timestamps through erasure.
Auth and transactional email records are kept.

Sub-processors

We use sub-processors under written agreements with data protection duties equivalent to the Customer Data Processing Addendum. Categories today: EU hosting and database, the transactional email provider used for account emails (for example sign-in links), the language model provider behind AI drafting, and the customer's own mailbox provider for outreach email (chosen by the customer, not by us).

Named providers, their purposes and locations, and the change-notice period are listed here: Sub-processors. We notify customers before adding or replacing a sub-processor and you may object on reasonable data protection grounds.

Data subject rights

If your data is in the Service as a prospect or contact of one of our customers, that customer is your controller. Contact them directly. We help them respond, and we provide export and erasure tools they can run.

If we are the controller for your data (account holder, workspace member, website visitor), you can ask us to:

Give you access to your personal data and a copy of it.
Correct inaccurate data.
Erase data we no longer need, or that you withdrew consent for.
Restrict processing in the cases the law provides.
Port data you gave us under contract or consent.
Object to processing based on legitimate interests, including marketing; marketing objections are acted on immediately.
Withdraw consent at any time, without affecting earlier processing.

Write to contact@outvori.com. We respond within one month, extendable by two months for complex requests, and we may ask for identity verification first.

Complaints: you can complain to your supervisory authority. Ours is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). Please contact us first so we can address the concern.

Security

Measures in place today: hosting in the European Union; encrypted transport (HTTPS/TLS, and TLS for SMTP submission); the secret vault that holds mailbox credentials (OAuth refresh tokens, SMTP passwords) and data export artifacts is encrypted; database row-level security isolates workspaces from each other; workspace roles limit what members can do; an append-only audit log records key actions; data export runs are limited to named records and are logged; sending is gated by draft approval, suppression checks, deliverability record checks, daily caps, and the test-mode gate.

We hold no third-party security certification and claim none. Backups exist, but we publish no recovery-time or recovery-point objectives. Security contact: contact@outvori.com.

Breach handling

Where the law requires it, we notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it. Breaches affecting prospect data are handled under the Customer Data Processing Addendum.

Cookies and marketing

Our website uses strictly necessary cookies (for example, keeping you signed in and remembering your cookie choice). On our public website pages, analytics cookies (Google Analytics 4) and marketing cookies (Meta pixel) are set only if you accept them in the cookie banner; you can change your choice at any time under “Cookie settings”. We do not use analytics or advertising trackers in the signed-in Service. The full list of cookies, providers and durations is in our Cookie policy.

Children

The Service is for businesses and is not directed at children. We do not knowingly process personal data of children.

Changes to this policy

We will announce material changes by email or in-product notice at least 30 days before they take effect.

Contact

Controller: ArtByBearded AB (org. nr 559558-0985), Regementsgatan 44, 831 35 Östersund, Sweden. Privacy and data protection contact: contact@outvori.com. Security and abuse reports: contact@outvori.com.

Outvori is a tool from ArtByBearded AB (org. nr 559558-0985).