Privacy Policy – Outflow AI

1. Introduction

Outflow AI, operated by Individual Entrepreneur ULADZISLAU SHOLAKHAU, registered in Georgia ("we", "us", "our"), operates the Outflow AI platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service. By using the Service, you consent to the practices described here.

2. Information We Collect

a. Information you provide directly

Account data: name and email address at registration
Briefing data: product URL, answers to onboarding questions, company description, and target customer description
Integration credentials: your Instantly API key (stored encrypted) and Cal.com OAuth tokens (stored encrypted)
Reply edits and notes: any manual edits you make to AI-generated emails or notes on replies

b. Information generated by the Service on your behalf

Scraped content from your product website (processed to generate your ICP)
AI-synthesized ICP profiles, value propositions, and email sequences associated with your campaigns
Lead data sourced from Instantly SuperSearch (name, email, title, company, LinkedIn URL)
Inbound reply content and AI classification results
Booking details from Cal.com (attendee name, email, scheduled time)
Campaign metrics: send counts, bounce rates, reply rates, health scores

c. Information collected automatically

Usage data: features used, pages visited, actions taken, timestamps
Log data: IP address, browser type and version, operating system
Cookies and similar technologies for session management and authentication
Waitlist source and referral data (if you joined a waitlist)

d. Information from third parties

Paddle: subscription status, plan, and billing cycle (we do not store your full payment card details — those are held by Paddle)
Instantly: webhook events for email delivery, bounces, and replies
Cal.com: webhook events for booking confirmations and cancellations

3. How We Use Your Information

To provide, operate, and improve the Service
To generate ICP profiles, email sequences, and reply drafts using AI models
To process subscription payments through Paddle
To send transactional emails (account activation, billing notifications, security alerts)
To monitor deliverability health and enforce bounce-rate limits
To detect fraud, abuse, and security incidents
To provide customer support
To comply with legal obligations

We do not use your briefing content, campaign data, or email content to train AI models on behalf of any third party. Content is passed to LLM providers (Anthropic, OpenAI) solely to generate outputs for your campaigns, subject to those providers' data handling terms.

4. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

Service providers: Paddle (payments), Instantly (email sending), Cal.com (calendar), Anthropic/OpenAI (LLM inference), Firecrawl (web scraping), Langfuse (LLM observability), Sentry (error tracking), and hosting/infrastructure providers. These providers access data only to perform services on our behalf.
Legal requirements: We may disclose information if required by law, court order, or government authority, or to protect our rights or the safety of users.
Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

5. Data Security

We implement commercially reasonable security measures including encryption at rest for sensitive credentials (API keys, OAuth tokens), TLS in transit, and row-level access controls so each user can only access their own data. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law or for legitimate business purposes (e.g. billing records).

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your data ("right to be forgotten")
Object to or restrict certain processing
Receive your data in a portable format

To exercise any of these rights, email u.sholakhau@gmail.com. We will respond within 30 days.

8. Cookies

We use essential cookies for authentication and session management. We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings, but this may affect your ability to log in and use the Service.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date, or by emailing your registered address. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact

For privacy-related inquiries:

Email: u.sholakhau@gmail.com
Phone: +995555169986