Short-form DPA for team customers. Last updated: September 2026.
Customer is Controller of workspace content and of outreach recipients. Outrovo is Processor, acting only on documented instructions (the service's normal operation plus support tickets).
B2B people-search, enrichment estimates, and outreach delivery for the subscription term + 30-day purge window.
Customer users (account identifiers); business contacts (public professional data: name, role, employer, work contact points); recipients (delivery metadata). No sensitive categories by design.
New sub-processors announced in-app 14 days in advance; object and we'll part ways cleanly with export + purge.
TLS in transit, encrypted secrets, OAuth-only auth, least-privilege keys, ephemeral minimal logging, 72-hour incident notice to affected customers.
Sub-processors engaged under equivalent terms; US transfers under SCCs 2021/914 (Module 2) plus processor DPAs.
We assist with data-subject requests (including suppression from results), DPIAs, and breach duties. One reasonable audit per year with 30 days' notice; reports shared under NDA.
Self-serve export anytime; full purge within 30 days of termination; backups within 90 days. Suppression entries for removal requests are kept (URLs only) to honor them.
Privacy and DPA questions: see contact & removal.