Outread

GDPR overview

The privacy policy claims compliance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, adding that it also observes other international privacy regulations such as the European Union's GDPR where applicable. That qualifier matters: the commitment is conditional rather than unreserved. The rights listed do follow the GDPR closely, covering access, rectification, erasure, objection and restriction, portability, withdrawal of consent and complaint to a supervisory authority, and international transfers are said to rely on standard contractual clauses approved by the relevant authorities. Beyond that, implementation is thin. No EU representative under Article 27 is named, no data processing agreement is offered, no sub-processors are disclosed and no retention period is quantified. A single mailbox, admin@out-read.com, is the only route for exercising any of these rights.

Who owns the data?

According to the privacy policy dated 5 August 2024, the operator is Outread Pty Ltd, an Australian company. It collects identification data such as name, email address and account details, payment details for managing subscriptions, technical data including IP address, device and browser, usage data covering reading history and preferences, correspondence with support, and country of residence. The policy states plainly that Outread does not sell personal information to third parties. It may nonetheless disclose it to its employees and related entities, to third-party service providers that help operate the business worldwide, to professional advisers such as lawyers, accountants and insurers, and to regulators or law enforcement where the law requires. All requests go to a single address, admin@out-read.com.

Reuse rights

The terms grant only a non-exclusive, time-limited licence to use the platform's content personally, lasting no longer than the free account, subscription or trial that carries it. Every summary, along with the text, graphics, audio, software and compilations on the platform, remains the property of Outread or its licensors, and the trademarks, trade names, logos and domain names may not be used for commercial or non-commercial purposes alike. Nothing in the documents allows a reader to redistribute, republish or otherwise reuse the content without asking permission. Personal data, separately, is used to run and improve the service, manage subscriptions and accounts, personalise recommendations, analyse usage patterns and meet legal obligations. Neither document mentions the training of models in any form.

Data retention & training

Hosting summary

The documents name no hosting country and no region. The privacy policy states only that, as a global provider, Outread may transfer, process and store personal information in countries other than the user's own, relying on standard contractual clauses approved by the relevant authorities, on equivalent obligations imposed on its service providers, and on appropriate technical and organisational measures. Users are asked to consent to transfers into jurisdictions whose data protection rules may differ from those at home. No sub-processor is identified and no data processing agreement is offered. The company itself is Australian, registered in Adelaide, and the terms place the service under the law of South Australia, which indicates the governing jurisdiction rather than where the servers sit. Both domains were observed resolving to Vercel infrastructure on anycast addresses during this review, but that is an observation rather than a statement by the publisher, and an anycast address identifies the edge node that answered, not where the data rests.