Legal
Data Processing Agreement
In one paragraph
Your company is the controller of the candidate marks your team creates. We are the processor: we store them and give them back to your team, and we do nothing else with them. This document is the Article 28 agreement that says so, and it applies automatically to every customer — you do not have to ask us to sign anything.
1. Parties and scope
Controller: the company that holds the licence. Processor: Renato Vieira Pimpão, Portugal. This agreement covers the personal data processed by Outreach Guard on the controller's instructions, and takes effect when the account is created.
2. Subject matter, duration, nature and purpose
- Subject matter: recording that a candidate has been contacted by the controller's staff, and showing that fact across the controller’s authorised Chrome installations.
- Duration: for as long as the account exists. Marks are deleted earlier, within 24 hours after the controller’s chosen visibility window ends (default 180 days).
- Nature and purpose: storage and retrieval. No profiling, no automated decisions, no enrichment, no analysis beyond counting.
3. Categories of data and data subjects
| Data subjects | Personal data |
|---|---|
| Candidates contacted by the controller's staff | A one-way HMAC-SHA256 hash of the profile reference, computed in the recruiter's browser with a key belonging to the controller. No name, no profile URL, no headline, no message content, no CV, no profile content of any kind. The hash is pseudonymous data: we cannot reverse it, and it only becomes linkable to a person by someone who holds the controller's key and the original reference. |
| The controller's staff (recruiters) | The team member’s name and email, installation label and version, random installation identifier, hashed installation credential, invitation and revocation status, contact timestamps and per-day contact counts. |
| The controller's administrator | Name of the company, email address, password hash, sign-in IP and user agent. |
Message content is processed transiently inside the user’s browser only to recognise a send. It is not stored or transmitted to our server. Candidate notes and special-category information must not be entered into team names, installation labels or diagnostic reports.
4. Our obligations as processor
- We process personal data only on the controller's documented instructions, which are these terms and the use of the product itself. If the law forces us to do otherwise, we tell the controller first, unless the law forbids that too.
- Everyone with access is bound by confidentiality.
- We keep the technical and organisational measures listed in section 7.
- We assist the controller with data subject requests, with security incidents, and with impact assessments, as far as the nature of the processing allows.
- On termination we delete the controller's data, including recovery backups, within 30 days, or return it first if the controller asks before account deletion. Operational records are removed when account deletion completes; restricted backup copies are removed within that 30-day period. This includes operator-managed deployment and offsite copies.
- We make available the information needed to demonstrate compliance, and accept audits by the controller or an auditor it appoints, once per year with reasonable notice, or after a security incident.
5. Sub-processors
The controller gives general authorisation for the sub-processors below. We impose the same obligations on them and stay responsible for what they do. If we add or replace one, we announce it on this page at least 30 days beforehand, and the controller may object and terminate if it disagrees.
| Sub-processor | Purpose | Location |
|---|---|---|
| Resend (Plus Five Five, Inc.) | Transactional account and password recovery emails | United States; transfers governed by Resend's Data Processing Addendum (resend.com/legal/dpa) |
| Hetzner Online GmbH | Server hosting and database storage | Falkenstein, Germany (EU) |
| Stripe Payments Europe, Ltd. | Subscription billing and payment data | Ireland (EU), with onward transfers to Stripe, Inc. (USA) under its own safeguards |
6. International transfers
The application and primary database run in Germany. Service providers may process account, billing, service-email or diagnostic data in other locations as described in the provider list and their applicable transfer safeguards. Candidate message content is not sent to these providers.
7. Technical and organisational measures (Art. 32)
- Data minimisation by design: the profile reference is hashed in the browser before transmission. Candidate names, profile URLs and message content are not stored. Hashes remain pseudonymous: matching a known reference is possible with the organisation’s key.
- Per-tenant key separation: each organisation hashes with its own key, so the same reference produces different values for different customers. Each customer can access only its own contact records.
- Encryption in transit: HTTPS everywhere, HSTS enabled.
- Access control: contact sync requires the organisation and installation credentials; access can be revoked without removing shared history. Contact queries are scoped to one organisation.
- Authentication: scrypt password hashing, signed HttpOnly session cookies, CSRF tokens on dashboard changes, rate limiting and lockout on repeated failures.
- Automatic deletion: expired marks are hidden at expiry and physically deleted from the operational database within 24 hours. Security logs are retained for 30 days and physically removed within the following 24 hours.
- Backups: verified daily recovery copies on the EU server are access-restricted and rotated automatically within a 30-day window. Deployment and offsite recovery copies are reviewed and removed by the operator under the same retention limit. Legacy copies without verification records require individual review; they are not deleted blindly by the automatic job. Backups are not used for ordinary product access.
8. Personal data breaches
We notify the controller without undue delay and at the latest within 48 hours of becoming aware of a breach affecting its data, with what we know: what happened, which data, the likely consequences, and what we are doing about it. Notifying the supervisory authority is the controller's call, since the controller is the one who holds the relationship with the data subjects.
9. Data subject requests
The controller handles candidate requests. On its documented instructions we assist with matching known references and handling the relevant records. Clearing every mark in the dashboard affects the whole team and is not required for a request concerning only one candidate. If a candidate contacts us directly, we direct the request to the appropriate controller.