Privacy Policy

Last updated: April 3, 2026

Outpulse ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal information when you use the Outpulse platform and related services (the "Service"). It also describes your rights and how you can exercise them.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide Directly

  • Account data: Name, email address, and password (hashed) when you register with email.
  • ICP configuration: Your product description, target industries, keywords, and excluded terms used to configure monitoring.
  • Monitor settings: Keywords, hashtags, and accounts you configure for monitoring on X.
  • Payment information: Billing details are processed directly by our payment provider (Dodo Payments). We do not store your payment card information.

1.2 Information from X (Twitter) OAuth

When you connect your X account via OAuth, we receive and store:

  • Your X user ID, username, display name, and bio.
  • OAuth access and refresh tokens (encrypted at rest using AES-256).
  • Profile picture URL.
  • Follower/following count (used for ICP auto-detection).

We use your X bio and profile to automatically seed your ICP configuration. We access your X account only to perform actions you have authorized: searching posts, posting replies, and sending DMs on your behalf.

1.3 Information We Collect Automatically

  • Usage data: Pages visited, features used, actions taken (outreaches sent, monitors created), timestamps.
  • Log data: IP address, browser type, operating system, referring URLs, error logs.
  • Cookies and local storage: Session tokens and authentication state. We do not use advertising cookies or third-party trackers.

1.4 X Posts and Signal Data

To operate the Service, we fetch and store posts from X that match your monitor keywords. This data includes:

  • Post text, author username, post URL, and timestamp.
  • Computed intent and ICP-match scores.
  • AI-generated draft replies and messages created for those posts.

This data belongs in the context of your account and is used exclusively to provide the Service to you. We do not aggregate or resell it.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service.
  • Authenticate your identity and secure your account.
  • Monitor X on your behalf and surface high-intent signals matching your ICP.
  • Generate AI-drafted replies and DMs using Claude and Grok APIs.
  • Schedule and post content to X on your behalf as you authorize.
  • Process subscription payments and maintain your billing status.
  • Send transactional emails: signal digests, account alerts, billing receipts.
  • Detect, prevent, and respond to fraud, abuse, or violations of our Terms.
  • Comply with legal obligations.

2.1 AI Processing

To generate draft content, we send relevant post context (the monitored tweet text, your ICP configuration) to Anthropic's Claude API and/or xAI's Grok API. We do not send your personal account credentials or X tokens to these providers. Anthropic's and xAI's handling of this data is governed by their respective privacy policies. We recommend reviewing:

2.2 We Do Not Train AI on Your Data

We do not use your personal data, ICP configuration, or generated drafts to train any AI or machine learning models.

3. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We share your information only in the following limited circumstances:

3.1 Service Providers (Processors)

We share data with trusted third-party providers who process data on our behalf under contractual obligations to protect it:

  • Neon (Postgres): Primary database storage
  • Upstash: Redis caching and QStash job queues
  • Resend: Transactional email delivery
  • Dodo Payments: Billing and payment processing
  • Vercel: Application hosting and CDN
  • Anthropic / xAI: AI inference for draft generation
  • TwitterAPI.io (or equivalent): X data reads (search and post fetching)

3.2 X (Twitter)

When you authorize posting, your account tokens are used to authenticate API calls to X. X receives the content you post (replies, DMs) as authorized by you. X's use of this data is governed by their Privacy Policy.

3.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Outpulse, our users, or the public.

3.4 Business Transfers

If Outpulse is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. You will be notified via email and/or a prominent notice on the Service before your information is transferred and becomes subject to a different Privacy Policy.

4. Data Retention

  • Account data: Retained for as long as your account is active, or as needed to provide the Service.
  • X signal data (monitored posts): Retained for 90 days, then automatically purged.
  • Action logs (posts/DMs sent): Retained for 12 months for audit and billing purposes.
  • Billing records: Retained indefinitely for financial record-keeping.
  • X OAuth tokens: Deleted immediately upon account disconnection or account deletion.

Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

5. Data Security

We implement industry-standard security measures to protect your data:

  • X OAuth tokens are encrypted at rest using AES-256 before storage.
  • All data in transit is encrypted using TLS 1.2+.
  • Passwords are hashed using a one-way cryptographic function (bcrypt).
  • Database access is restricted to application-level connections via scoped credentials.
  • We do not store X passwords — only OAuth tokens which can be revoked at any time from X.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion:Request deletion of your personal data ("right to be forgotten").
  • Portability: Request your data in a structured, machine-readable format.
  • Restriction: Request restriction of processing in certain circumstances.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, email us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before acting on your request. You may also disconnect your X account at any time from the Settings page.

6.1 Email Communications

You will receive transactional emails (digest summaries, billing receipts, security alerts). You can manage email preferences from your Settings page. Note: critical security and billing emails cannot be opted out of.

7. California Residents — CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights regarding your personal information:

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the third parties we share it with.
  • Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
  • Right to Opt-Out of Sale: We do not sell your personal information and have not done so in the past 12 months.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
  • Right to Correct: You may request correction of inaccurate personal information we hold about you.

To exercise your CCPA rights, email [email protected]with "California Privacy Request" in the subject line. We will respond within 45 days. You may also designate an authorized agent to submit a request on your behalf.

Categories of personal information collected in the past 12 months: Identifiers (name, email, X username); internet or network activity (usage logs, pages visited); inferences drawn from your ICP configuration.

8. EU/EEA Residents — GDPR Rights

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) applies to our processing of your personal data.

8.1 Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you have signed up for — authentication, monitoring, posting, billing.
  • Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, and service improvement, where these interests are not overridden by your rights.
  • Legal obligation (Art. 6(1)(c)): Where we are required to process data to comply with applicable law.
  • Consent (Art. 6(1)(a)): For optional communications (e.g., marketing emails), where you have given explicit consent.

8.2 Your GDPR Rights

Under the GDPR, you have the following rights:

  • Right of Access (Art. 15): Obtain a copy of your personal data and information about how it is processed.
  • Right to Rectification (Art. 16): Have inaccurate personal data corrected without undue delay.
  • Right to Erasure (Art. 17): Request deletion of your personal data where there is no compelling reason for its continued processing.
  • Right to Restriction (Art. 18): Restrict processing of your personal data in certain circumstances.
  • Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
  • Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
  • Rights related to automated decision-making (Art. 22): Not be subject to solely automated decisions that produce significant legal or similarly significant effects.

To exercise any of these rights, email us at [email protected]with "GDPR Request" in the subject line. We will respond within 30 days (extendable to 90 days for complex requests, with notice).

8.3 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority (DPA) if you believe our processing of your personal data violates the GDPR. A list of EU DPAs is available at edpb.europa.eu.

8.4 Data Transfers Outside the EEA

We transfer personal data to our service providers located in the United States and other countries. Where required by the GDPR, we rely on approved transfer mechanisms — including Standard Contractual Clauses (SCCs) — to ensure your data receives adequate protection.

9. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such information, please contact us immediately at [email protected] and we will delete it promptly.

10. International Data Transfers

Outpulse operates globally and may transfer your data to servers located in the United States or other countries that may have different data protection laws than your country. By using the Service, you consent to such transfers. We ensure appropriate safeguards are in place for international transfers in compliance with applicable law.

11. Cookies & Tracking

We use the following types of cookies and storage mechanisms:

  • Session cookies: Required for authentication and maintaining your login state.
  • Preference storage: Local storage for UI preferences (e.g., dark mode).

We do not use advertising cookies, third-party tracking pixels, or behavioral analytics tools that share your data with advertising networks.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 14 days before the changes take effect and post a prominent notice on the Service. Your continued use of the Service after that date constitutes acceptance of the updated policy.

13. Contact & Data Controller

Outpulse is the data controller for the purposes of this Privacy Policy. If you have any questions, concerns, or requests regarding this policy or your personal data, please contact: