Outreach

GDPR overview

GDPR implementation is concrete and documented rather than declarative. Outreach certifies to the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. framework, and states that it falls under Federal Trade Commission enforcement. An Article 27 representative is named for the European Union, Rivacy GmbH in Hamburg, alongside a separate UK representative. A data processing agreement is incorporated by reference into the terms of service, a sub-processor list is published, and transfers rely on adequacy decisions, on the framework, or on standard contractual clauses. The privacy statement, last modified in February 2026, sets out lawful bases and lists rights of access, rectification, erasure, portability, withdrawal of consent, objection and restriction, plus post-mortem instructions for French residents. Requests go through a data subject rights portal or by email, unresolved framework complaints are referred to TrustArc, and the right to complain to a supervisory authority is stated.

Who owns the data?

Under the terms of service, the customer keeps full ownership of what it puts into the platform. Your Data covers address books, emails, calendars, social contacts, call history, call recordings and uploaded files, and Outreach states that it claims no ownership over any of it. Outreach retains the intellectual property in the platform itself. The company wears two hats: it is the controller of the personal data it handles for its own website and marketing purposes, and a processor for Client Data handled on a customer's instructions. Individuals whose data reaches Outreach through one of its customers must address that customer, which is the controller, rather than Outreach.

Reuse rights

Customers can use and take back their own data freely: it stays theirs and the vendor claims no ownership over it. On the vendor's side, the agreement lets Outreach collect and analyse customer data in aggregated form to improve the service and publish general statistics, provided no customer is identified and no personal data is disclosed. Personal data is otherwise used to run and administer the service, provide support, secure the platform against fraud and abuse, market to contacts according to their stated preferences, run events and meet legal obligations, on the basis of legitimate interest, contract or consent. Data received through Google APIs falls under Google's Limited Use rules, and Google Workspace data is explicitly not used to develop, improve or train AI or ML models. No equivalent general statement covers whether other customer data is used to train models, which is why the vendor's stance is recorded as unclear. Separately, under the California Consumer Privacy Act, Outreach reports having "sold" identifiers, online activity data and inferences to event sponsors, advertising networks and analytics providers, with an opt-out form provided.

Data retention & training

Hosting summary

Outreach is a United States company and states that its service providers are located in the United States and in other countries, so personal data may be transferred to and processed outside the user's own country. No hosting country or region is published on the pages reviewed, which is why the structured hosting fields are left empty. Transfers out of the European Economic Area, the United Kingdom and Switzerland rely on adequacy decisions, on the EU-U.S. Data Privacy Framework and its UK extension, on the Swiss-U.S. framework, or on standard contractual clauses signed with customers, providers and partners. On security, the company describes encryption of data in transit and at rest, single sign-on, role-based access controls, regular review of its collection, storage and processing practices including physical measures, and a risk assessment before engaging any third party. A DNS lookup of the domain resolves to an Amazon CloudFront edge node, which indicates the content delivery network in front of the site rather than where the application and its data actually reside.