Privacy Policy
Last updated: October 18, 2026
This Privacy Policy describes how Metis Information Technologies Ltd ("OutMass", "we", "us") collects, uses, and protects your personal data when you use the OutMass Chrome extension and related services. We are committed to protecting your privacy and complying with the UK GDPR, the EU General Data Protection Regulation (GDPR), and other applicable data protection laws.
1. Data Controller
Metis Information Technologies Ltd
Registered in England and Wales
Company number: 17114932
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: support@getoutmass.com
2. Data We Collect
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Name and email address (your account) | Account creation, communication | Contract performance |
| Microsoft OAuth tokens | Sending emails via Graph API | Contract performance |
| Campaign content you author (subject lines and body text) | Rendering and sending the campaign, merge-tag personalization, performance reports; preventing abuse of the Service (see Section 3) | Contract performance; legitimate interest (abuse prevention) |
| Recipient list you upload (email addresses, names, custom CSV columns) | Sending the campaign to the people you chose, merge-tag personalization, unsubscribe handling; suggesting how a CSV file is encoded (when the panel cannot tell, it sends the start of the file, up to 64 KB, to our server, which reads it in memory and keeps nothing) | Contract performance |
| Campaign metadata (send times, recipient counts, status) | Campaign management, analytics | Contract performance |
| Email open and click events | Tracking and reporting | Legitimate interest |
| Usage statistics (features used, session duration) | Product improvement | Legitimate interest |
| Payment information | Subscription billing (processed by Stripe — card details never touch our servers) | Contract performance |
| What you write when asking for help signing in and the email address you give (both optional; at least one of the two), with the answers you chose and technical details of your attempts (browser and version, which Outlook you use, language, extension version, the kinds of errors) | Understanding and fixing that sign-in problem, and replying to you if you gave an address | Your request, before any account exists (steps prior to a contract, GDPR Art. 6(1)(b)) |
3. Data We Do NOT Collect
- We do not read the content of your Outlook inbox or of any message you receive. Reply detection, if you turn it on, looks only at who wrote to you and when — never at what they wrote.
- We do not copy or store emails that other people have sent you.
- We do not store your Microsoft password — authentication is handled by Microsoft's own OAuth 2.0 flow.
- We do not store your payment card details — Stripe handles them directly.
- We do not sell your data, recipient lists, or campaign content to third parties.
- We do not use your campaign content to train AI models.
Note on campaign content: when you author an email campaign in OutMass, we do store the subject line, body, and recipient list so we can actually send the campaign on your behalf, apply merge-tag personalization, and report open/click performance back to you. This is distinct from "reading your inbox" — we only handle outbound content that you explicitly create inside the extension.
When we look at a campaign: we do not routinely read your campaigns' subject lines or body text. We read them only when you ask us for help with a campaign, when someone complains about it, or when unusual sending activity prompts a check — for example for phishing, or for mail written in another person's or brand's name. If we find a problem, we may stop that campaign and ask you about it.
4. Microsoft OAuth Data
When you sign in with Microsoft, we request the following permissions:
- Mail.Send — to send emails on your behalf via Microsoft Graph API
- User.Read — your name and email address, to set up your OutMass account
- offline_access — so scheduled emails and follow-ups can still be sent when Outlook is closed
- Mail.Read (optional) — requested when you turn on reply detection, so follow-ups stop for people who already replied. It reads only the sender, time and conversation of incoming mail. Versions of the extension older than 0.3.0 ask for it at sign-in.
- Files.Read.All / Files.ReadWrite (optional) — only requested if you opt into the OneDrive attachment feature. We use these scopes solely to read the metadata of files you explicitly select in the OneDrive picker and to generate anonymous "view" sharing links for those files. We never download, browse, modify, or read the contents of your OneDrive files. The sharing links live in your own OneDrive — they are not stored on OutMass servers.
OAuth access tokens are stored securely and are never shared with third parties. You can revoke access at any time, as described in Section 5. The OneDrive scopes are optional — if you never use the OneDrive attachment feature, they are never requested.
5. Your mailbox: what OutMass sends, and how to stop it
From your mailbox, OutMass sends only what you create. Every campaign email goes out from your own Outlook account: the campaigns you write, to the recipients you upload, when you press Send or at the time you schedule, plus the follow-ups and A/B tests you add to them. Scheduled, daily-paced and follow-up emails go out later without another click, because that is what you set them up to do. A campaign that stopped at your monthly limit continues after your reset, unless it has waited long enough that we email you to ask first.
You can see every one. Each email OutMass sends from your account, test sends included, is saved in your Outlook Sent Items.
You can stop it.
- One campaign: Reports → open the campaign → Stop campaign. If the campaign has finished and only its follow-up is waiting, use Stop follow-up there instead. Emails already sent cannot be un-sent.
- Everything: Account → Danger Zone → Delete my account. Your campaigns and your Microsoft authorization are deleted. On a paid plan, cancel your subscription first; to have your account deleted before the plan ends, email support@getoutmass.com.
- At Microsoft: remove OutMass at account.live.com/consent/Manage (Outlook.com and Hotmail) or myapplications.microsoft.com (work or school accounts). If your IT administrator approved OutMass for your organization, only they can remove that approval. Once Microsoft has applied it, OutMass can no longer send from your account; if you sign in to OutMass again, campaigns that were waiting to send can continue.
Signing out of OutMass or removing it from your browser does not cancel campaigns you have already scheduled. Stop them in Reports first.
6. How We Use Your Data
- To provide and operate the Service
- To send emails on your behalf through Microsoft Graph API
- To track campaign performance (opens, clicks)
- To manage your subscription and process payments
- To communicate with you about your account and the Service
- To improve and develop new features
- To prevent abuse of the Service and enforce our Terms of Service
7. Third-Party Services
We use the following third-party services that may process your data:
- Supabase — Database hosting (PostgreSQL)
- Stripe — Payment processing
- Upstash — Redis queue for email scheduling
- Microsoft Graph API — Email sending
- PostHog — Anonymous product analytics and error tracking
- MailerSend — Transactional email (for example the welcome email and notices about your account and campaigns)
- Telegram — Internal notifications to our team, such as feedback you send us from the extension (including the email address you give with it)
- Anthropic — The AI email writer (Pro plan): it receives the prompt you type and the sender name, position and company from your Settings
- Railway — Hosting for our application servers
- Cloudflare — Network and secure connection (TLS) for our API
Each service operates under their own privacy policies and data protection agreements.
If you ask for help signing in, what you write and the address you give are stored in our database. What you write — never your address — is also included in one daily summary email to our support inbox (MailerSend); any email address you type into the message itself is removed from that copy. Our team gets an instant internal notification (Telegram) that a request arrived, which contains neither what you wrote nor your address. If we reply, the conversation is kept in our support mailbox (see Section 8). We send nothing to your address automatically, and we never use what you write or your address for analytics or marketing.
We collect anonymous usage telemetry through our extension to understand how features are used and where users encounter friction. These events contain no personal information beyond the email address you signed in with (used to associate pre-signin and post-signin activity in our analytics) — only event names (e.g. sidebar_opened, send_completed) and technical metadata (extension version, browser, operating system, language). The anonymous ID linking these events is generated locally by your browser. Once you sign in, the anonymous ID is associated with your account email so we can measure end-to-end product usage. Telemetry is processed by our analytics provider (PostHog).
8. Data Retention
- Account data is retained while your account is active.
- Campaign metadata is retained for 12 months after creation.
- Tracking data (opens, clicks) is retained for 6 months.
- Upon account deletion, all personal data is removed within 30 days.
- Sign-in help requests are deleted from our database within 30 days of being sent, or as soon as you sign in with that address, whichever comes first. The copy of what you wrote in the daily summary email in our support inbox is kept like support email (below).
- Support email conversations are kept for up to 24 months after the last message, or deleted sooner on request.
- Audit log. For fraud prevention, legal defence, and compliance with the Turkish Tax Procedure Law (VUK) and equivalent UK/EU obligations, we retain a limited record of account activity for 5 years. These records contain: a one-way SHA-256 hash of your email address, the type of action (login, campaign creation, send trigger, account deletion, etc.), a timestamp, and the IP address from which the action originated. IP addresses are anonymised to /24 (IPv4) or /48 (IPv6) after 12 months as an additional data-minimisation measure. These records do not contain email content, recipient addresses, or campaign bodies. This processing is based on our legitimate interest (GDPR Art. 6(1)(f)) and legal obligations (GDPR Art. 6(1)(c)) and overrides the right to erasure under GDPR Art. 17(3).
9. Your Rights (GDPR)
If you are located in the United Kingdom, European Economic Area (EEA), or Turkey, you have the following rights:
- Access — Request a copy of your personal data
- Rectification — Request correction of inaccurate data
- Erasure — Request deletion of your data ("right to be forgotten"). You can delete your account yourself at any time from OutMass sidebar → Account tab → Danger Zone. Deletion removes all personal data and content immediately; only the anonymised audit record described in Section 8 is retained, for fraud prevention and legal compliance.
- Portability — Request your data in a portable format
- Restriction — Request restriction of processing
- Objection — Object to processing based on legitimate interest
To exercise any of these rights, email us at support@getoutmass.com. We will respond within 30 days.
10. Cookies
The OutMass extension sets no cookies of its own. When you sign in, OutMass sets one cookie on api.getoutmass.com that ties the Microsoft sign-in window to your browser. It lasts 24 hours, holds a random value and nothing about you, and is not used for tracking.
Our website (landing page) may use minimal cookies for:
- Essential cookies — Required for basic site functionality
- Analytics cookies — To understand how visitors use our site (optional, with consent)
You can disable cookies in your browser settings at any time.
11. Data Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encrypted data transmission (HTTPS/TLS)
- Secure OAuth token storage
- Access controls and authentication
- Regular security reviews
12. International Data Transfers
Your data may be processed in countries outside your country of residence. We ensure appropriate safeguards are in place for any international transfers in compliance with GDPR.
13. Children's Privacy
OutMass is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top reflects the most recent revision.
15. Contact Us
For any privacy-related questions or requests:
Email: support@getoutmass.com
Company: Metis Information Technologies Ltd