Legal
Privacy Policy
The short version
- A candidate's profile link never leaves the browser. What reaches our server is a one-way HMAC-SHA256 hash of it, computed on the recruiter's own machine.
- We never receive names, headlines, CVs, message text or anything else from a profile.
- We cannot reverse a hash. Even we cannot tell who your candidates are.
- Everything is hosted in the European Union (Germany). Billing runs through Stripe.
- No advertising, no tracking pixels, no analytics scripts, no data sold or shared.
1. Who we are
Outreach Guard is operated by Renato Vieira Pimpão, Rua Falcão Trigoso 6, 1D, 1600-065 Lisboa, Portugal (VAT PT223745162). For anything in this policy, write to hello@pimpao.com.
2. Our two roles
This is the part that matters for a data protection officer reading it:
- We are the controller for the account itself: the company name, the admin's email, the password hash, billing identifiers, and the security log of sign-ins.
- We are a processor for what the extension records on your team's behalf: the hashed candidate references, the name of the person who sent the message, and the timestamp. Your company decides why and how that data exists; we only store it and give it back to your team. The terms governing that are in the Data Processing Agreement.
3. What we actually store
| Data | Why | Kept for |
|---|---|---|
| Company name, admin email, password hash | To give you an account and let you log in | Until you delete the account |
| Licence key, device identifiers (random UUIDs), PC label, the name each person typed on installation | To know which PCs are licensed and to show who contacted whom | Until you remove the PC or delete the account |
| Candidate marks: HMAC-SHA256 hash of the profile reference, sender name, timestamp | The product itself: to turn a name yellow on your team's screens | Your chosen expiry window (default 180 days), then physically deleted |
| Counters: contacts per day, and per day per person | The statistics in your dashboard, which must survive mark expiry | Until you delete the account |
| Sign-in log: IP address, browser user agent, outcome | Detecting brute-force attempts and abuse | 30 days, then deleted automatically |
| Billing: Stripe customer and subscription identifiers | To run the subscription | As long as the subscription exists, plus the retention required by tax law |
Card numbers never touch our servers. Stripe handles payment data as its own controller.
4. What the extension sees, and what it keeps
To notice that a message was sent, the extension observes network calls made by the LinkedIn page in the tab where it runs. It reads them to answer one question — «was this a message or an invitation with a note?» — and keeps nothing: no URLs, no message text, no profile content. For invitations it derives a single true/false value («was there a note?») inside the page, and only that value travels onwards.
The candidate reference is hashed with a key that belongs to your organisation, before anything is sent. Two different companies hashing the same candidate produce different values, so no one can cross-reference between customers — including us.
5. Legal bases
- Contract (Art. 6(1)(b) GDPR): running your account, the licence and billing.
- Legitimate interests (Art. 6(1)(f)): keeping the service secure and preventing abuse — the sign-in log, and the rate limits.
- Legal obligation (Art. 6(1)(c)): invoices and tax records.
For the candidate marks, the legal basis is your company's to determine as controller, and normally rests on your legitimate interest in not contacting the same person twice.
6. Who else touches the data
| Sub-processor | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Server hosting and database storage | Falkenstein, Germany (EU) |
| Stripe Payments Europe, Ltd. | Subscription billing and payment data | Ireland (EU), with onward transfers to Stripe, Inc. (USA) under its own safeguards |
We do not sell data, we do not share it with advertisers, and we do not use it to train any model. The current list lives in the DPA annex and changes are announced there before they take effect.
7. Your rights
Under the GDPR you may ask for access, correction, deletion, restriction, portability, and you may object to processing. Write to hello@pimpao.com and we answer within 30 days. You can also complain to your national supervisory authority — in Portugal, the CNPD.
Two of these you can exercise yourself, immediately, from the dashboard: erase every mark your team has recorded, and delete the account with everything in it.
8. If a candidate asks about their data
This is the awkward one, and the honest answer matters: we hold a hash, not a person. Given a candidate's name or profile URL, we cannot search for them — the hash is one-way and the key is your organisation's. So a candidate request has to be handled by the company that recruits them, who can recompute the hash and clear the mark, or clear all marks at once. We help you do it; we cannot do it on our own.
9. Security
- Everything travels over HTTPS; the database file is readable only by the service account.
- Passwords are stored with scrypt, never in plain text.
- Sessions are signed cookies, HttpOnly, Secure, SameSite=Lax, and expire after 12 hours.
- Sign-in attempts are rate limited per IP and per account, with lockout after repeated failures.
- Each company reads only its own records; the licence key and device id are checked on every single request.
10. Changes
If this policy changes in a way that matters, we email the account admin before it takes effect. The date at the top always says when it last changed.