Last updated: [effective date] — Version 1.0 (DRAFT)
This Privacy Policy describes how [Company Legal Name] ("Outbound", "we", "us") handles personal information when you use the Outbound Service.
[Company Legal Name], [address], [privacy contact email]. We do not currently maintain a Data Protection Officer; the contact above answers privacy requests. [COUNSEL REVIEW: add DPO/privacy officer designation if counsel requires it.]
When you create or use an account we collect: name, work email, password (stored as a salted hash), the IP address and approximate location of your device at sign-up, and session logs (login times, actions taken).
The Customer Organization uploads contact lists containing personal information about US consumers, which may include: names, phone numbers, email addresses, and metadata about interactions (call timestamps, duration, disposition, call recordings or transcripts where enabled). We process this Customer Data on behalf of the Customer Organization — the organization is the controller and we are the processor, as described in the Data Processing Agreement at /legal/dpa.
We collect service-usage telemetry (page views, API calls, error logs) to operate, secure, and improve the Service.
We do not sell personal information. We do not use Customer Data for our own marketing, profiling, or any purpose outside providing the Service to the Customer Organization. [COUNSEL REVIEW: confirm the "no sale/no share" statement matches actual vendor flow-downs (Twilio, Cloudflare, model providers) and the CCPA/CPRA definitions of "sell" and "share".]
For Customer Organization account users, we process on the basis of contract performance and legitimate interests (service operation and security).
For US consumers whose information appears in Customer Data, the Customer Organization — not Outbound — is the controller and is responsible for its own notices and consent. Where Outbound acts as a service provider/processor, we honor requests from the Customer Organization. [COUNSEL REVIEW: build the per-state matrix — CCPA/CPRA (CA), and as applicable CO, CT, VA, TX (TDPSA), OR, MT, etc. — with the service-provider contract terms each state requires; this is the single largest open item in this policy.]
Consumer rights (where applicable): access, deletion, correction, and opt-out of "sale"/"sharing", exercised through the Customer Organization, with us honoring them within the state's deadlines (typically 45 days, extendable once).
We do not disclose Customer Data to any other purpose.
We use industry-standard safeguards: encryption in transit (TLS), hashing of passwords, role-based access control, per-organization data isolation, and an append-only audit log of sensitive operations. No method of transmission is 100% secure; we will notify affected individuals and regulators of a confirmed breach as required by applicable law. [COUNSEL REVIEW: confirm the description matches implemented controls and add the state breach-notification mechanics.]
The Service is hosted in the United States. Customer Data is not currently transferred outside the US. If that changes, we will update this policy and implement appropriate safeguards. [COUNSEL REVIEW: confirm hosting regions (US) and any subprocessor locations.]
The Service is a B2B product not directed at children. We do not knowingly collect personal information from individuals under 16 (or under 13 where state law is stricter).
You may, through the Customer Organization: request access to your personal information; request deletion; request correction; and opt out of "sale" or "sharing" (neither of which we currently perform). We will not discriminate against you for exercising rights. [COUNSEL REVIEW: confirm the "no sale/share" statement and the non-discrimination language.]
We will post changes to this page and, where practicable, notify account admins. Each organization's accepted version and timestamp are recorded in the consent log. Material changes take effect no sooner than 30 days after posting.
Privacy questions: [privacy contact email].
---
[COUNSEL REVIEW — open items: §4 per-state privacy matrix (CCPA/CPRA + CO/CT/VA/TX/OR/MT) and the service-provider contract terms each state requires; §5 "no sale/share" statement vs. actual vendor flow-downs; §6 retention schedule; §7 breach-notification mechanics; §8 subprocessor locations.]