Privacy Policy

OutcomeOS (“we”, “us”) provides a hosted automation service at this website. The operating entity is [legal entity name and address — set by owner before launch]. For privacy questions, email hello@outcomeos.cloud. If you self-host the open-source software, you are the operator of your installation and this policy does not cover it.

We are the controller for account data (who you are, how you use the site, billing). We are a processor for customer data — the records, contacts and messages your workflows handle on your behalf. For customer data we act only on your instructions, as set out in the Terms and any data processing agreement we sign with you.

• Account data: name, email, password hash or Google account ID, organization and workspace names, roles.
• Customer data: workflow definitions, trigger payloads, step inputs and outputs, outcome events, and connection credentials you provide.
• Usage and technical data: IP address, user agent, request logs, and security events such as failed sign-ins, kept to run and protect the service.
• Billing data: plan, invoices and payment status. Card details are handled by our payment processor; we don't store card numbers.
• Messages to us: contact form and newsletter sign-ups (email and confirmation status).

• To provide the service: run workflows, verify outcomes, store logs and show analytics.
• To secure the service: authentication, rate limiting, abuse prevention (including Cloudflare Turnstile on public forms) and audit logs.
• To bill you and to send service and security notices.
• To send the newsletter, only after you confirm your subscription (double opt-in).
• We don't sell personal data, and we don't use customer data to train AI models.

Performance of a contract (providing the service), legitimate interests (security, product improvement using aggregated data), consent (newsletter), and legal obligations (tax and accounting records).

The service runs on Cloudflare (Workers, D1, Queues, Durable Objects, R2). Data may be processed in Cloudflare data centers worldwide. Other subprocessors:

• Cloudflare — hosting, storage, email delivery, Turnstile.
• Stripe — payments and billing (hosted plans only).
• Google — optional sign-in with Google.
• Providers you connect (e.g. messaging, CRM, payments) receive data when your workflows send it to them. They act under their own terms with you.
• [Any additional subprocessors — set by owner before launch.]

Where data leaves the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses offered by our subprocessors.

• Execution logs are kept for your plan's log retention period (for example 7, 30 or 90 days), then deleted.
• Account and customer data are kept while your account is active. After you close your account we delete it within [30] days, except where the law requires us to keep records.
• Backups roll off within [35] days.

Provider credentials are encrypted with AES-GCM before storage, sessions and API keys are stored as hashes, secrets are masked in logs, and every record is scoped to its organization. See Security for details. No system is perfectly secure; we'll notify affected customers of a personal data breach without undue delay.

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict processing, and withdraw consent. Email hello@outcomeos.cloud. If we process data for one of our customers, we'll pass your request to them. You can also complain to your local data protection authority.

We use a strictly necessary session cookie to keep you signed in, and Turnstile may set cookies to tell people from bots. We don't use advertising cookies or third-party analytics trackers on this site.

The service is for businesses and isn't directed at children under 16.

We'll post changes here and update the date above. For material changes we'll email account owners at least 30 days before they take effect.