Legal
Privacy Policy
The short version
- A candidate's profile link never leaves the browser. What reaches our server is a one-way HMAC-SHA256 hash of it, computed on the recruiter's own machine.
- We do not store candidate names, profile URLs, headlines, CVs or message content.
- Hashed references are pseudonymous data, not anonymous data. Matching a known reference is possible with the organisation’s key.
- Our application and database are hosted in Germany. Billing, service email and operational diagnostics also use the providers described below.
- No analytics scripts. Optional ad-measurement pixels (Meta, OpenAI) load only if you click Accept on the cookie bar, and never see account or contact data. We do not sell data or share it with advertisers.
1. Who we are
Outreach Guard is operated by Renato Vieira Pimpão, Rua Falcão Trigoso 6, 1D, 1600-065 Lisboa, Portugal (VAT PT223745162). For anything in this policy, write to hello@pimpao.com.
2. Our two roles
This is the part that matters for a data protection officer reading it:
- We are the controller for the account itself: the company name, the admin's email, the password hash, billing identifiers, and the security log of sign-ins.
- We are a processor for what the extension records on your team's behalf: the hashed candidate references, the name of the person who sent the message, and the timestamp. Your company decides why and how that data exists; we only store it and give it back to your team. The terms governing that are in the Data Processing Agreement.
3. What we actually store
| Data | Why | Kept for |
|---|---|---|
| Company name, admin email, password hash | To give you an account and let you log in | Until you delete the account |
| Licence key, random installation identifiers, hashed installation credentials, installation label, extension version, team member name and email, and personal invitation status | To authorise each Chrome installation, revoke access and show which teammate made a contact | Until account deletion; a removed installation retains a revocation record to prevent it reconnecting |
| Candidate marks: HMAC-SHA256 hash of the profile reference, sender name, timestamp | The product itself: to turn a name yellow on your team's screens | Visible for your chosen expiry window (default 180 days); expired records are physically removed from the operational database within 24 hours. Restricted recovery copies follow the backup period below. |
| Counters: contacts per day, and per day per person | The statistics in your dashboard, which must survive mark expiry | Until you delete the account |
Detection health signals: which internal check failed, the LinkedIn API
paths your browser called at that moment with every identifier stripped out
(/voyager/api/…/:id), the extension and rule versions, and the device
identifier. Never the text anyone wrote, never a candidate's identity, never a search term. |
LinkedIn changes its pages without notice. Without this the extension would quietly stop marking anyone, and nobody would find out until two people had contacted the same candidate | 14 days, then physically deleted within 24 hours |
| Sign-in log: IP address, browser user agent, outcome | Detecting brute-force attempts and abuse | 30 days, then physically deleted within 24 hours |
| Billing: Stripe customer and subscription identifiers | To run the subscription | As long as the subscription exists, plus the retention required by tax law |
Card numbers never touch our servers. Stripe handles payment data as its own controller.
Restricted recovery backups may retain deleted operational records for up to 30 days. Verified daily backups rotate automatically. Deployment, offsite and legacy copies are subject to operator review and removal under the same limit; automatic rotation does not silently delete unknown archives. After account deletion, this review also covers its recovery copies. Backups are used for recovery, not for ordinary access to the service.
4. What the extension sees, and what it keeps
The extension reads visible profile links and temporarily processes relevant LinkedIn request and response data, including message or note content, inside your browser to recognise a supported, confirmed send. This content is not retained or sent to YellowSync. Only the resulting contact record is queued locally for sync: hashed references, a send timestamp and an event identifier. Local storage also keeps your team identity, installation credentials and cached marks. These records are separated by organisation.
The candidate reference is hashed in the browser with a key specific to your organisation. The same reference produces different hashes for different organisations. We keep that key to support your installations, so this is pseudonymisation: a party with the key and a known profile reference can calculate the corresponding hash. It is not a guarantee of anonymity.
5. Legal bases
- Contract (Art. 6(1)(b) GDPR): running your account, the licence and billing.
- Legitimate interests (Art. 6(1)(f)): keeping the service secure and preventing abuse — the sign-in log, and the rate limits.
- Legal obligation (Art. 6(1)(c)): invoices and tax records.
For the candidate marks, the legal basis is your company's to determine as controller, and normally rests on your legitimate interest in not contacting the same person twice.
Consent (Art. 6(1)(a) and the ePrivacy rules): the optional ad-measurement pixels described in section 6. You can refuse without losing anything, and withdraw at any time with the Cookie settings link in the footer.
6. Who else touches the data
| Sub-processor | What for | Where |
|---|---|---|
| Resend (Plus Five Five, Inc.) | Transactional account and password recovery emails | United States; transfers governed by Resend's Data Processing Addendum (resend.com/legal/dpa) |
| Hetzner Online GmbH | Server hosting and database storage | Falkenstein, Germany (EU) |
| Stripe Payments Europe, Ltd. | Subscription billing and payment data | Ireland (EU), with onward transfers to Stripe, Inc. (USA) under its own safeguards |
We do not sell data, we do not share account or contact data with advertisers, and we do not use it to train any model. The current list lives in the DPA annex and changes are announced there before they take effect.
Ad measurement (consent only). If you click Accept on the cookie bar, our website loads the Meta Pixel (Meta Platforms Ireland Ltd) and the OpenAI Ads pixel (OpenAI), so that we can tell whether an ad led to a sign-up. They receive your browser identifiers, the pages you view and the conversion events "sign-up completed", "first PC registered" and "link requested", never your password, candidate data or message content. Meta and OpenAI act as independent controllers for their own use of that data and may process it outside the EU. If you click Reject, or do nothing, neither pixel loads. Details and how to withdraw: Cookies.
Link by email. If you ask us to email you the link to set up YellowSync on your computer, we use that address only to send that one email (legal basis: your request); the rate-limit record of the request is kept as for sign-ups.
7. Your rights
Under the GDPR you may ask for access, correction, deletion, restriction, portability, and you may object to processing. Write to hello@pimpao.com and we answer within 30 days. You can also complain to your national supervisory authority — in Portugal, the CNPD.
The dashboard lets you erase all contact marks after confirmation or request account deletion. If subscription cancellation cannot be confirmed, deletion is paused and your account is preserved so you can retry.
8. If a candidate asks about their data
Candidate requests should be directed to the recruiting organisation, which acts as controller. On its instructions, we can assist with matching a known profile reference to its organisation’s hash and handling the relevant record. Contact support for a request about one candidate; erasing every mark is a separate action that affects the whole team.
9. Security
- Everything travels over HTTPS; the database file is readable only by the service account.
- Passwords are stored with scrypt, never in plain text.
- Sessions are signed cookies, HttpOnly, Secure, SameSite=Lax, and expire after 12 hours.
- Sign-in attempts are rate limited per IP and per account, with lockout after repeated failures.
- Company access and installation credentials protect the shared contact API. Revoking an installation prevents further sync without deleting team history.
10. Changes
If this policy changes in a way that matters, we email the account admin before it takes effect. The date at the top always says when it last changed.