Privacy policy

Last updated: 16 October 2026

1. Who is responsible

The controller for data processing on outboundleadpro.com and in the OutboundLeadPro app is:
Abdul Musah, OutboundLeadPro, Hutäcker 17, 91347 Aufseß, Germany
Phone: +49 151 68495881 · Email: support@outboundleadpro.com

For any question about your data, or to use your rights, write to support@outboundleadpro.com.

2. What we process and why

Visiting the website

When you open a page, our server receives technical data your browser sends automatically: IP address, date and time, page requested, referrer, browser and operating system. We use it to deliver the website, keep it secure and find errors (Art. 6 (1) (f) GDPR — legitimate interest in a secure, working website). Server logs are deleted after 14 days at the latest, unless we need a specific entry to investigate an attack.

Your account

When you register we store your name, email address, a securely hashed password, your plan and the settings you make. We need this to provide the service you signed up for (Art. 6 (1) (b) GDPR — contract). We send you the emails needed to run your account (confirmation, password reset, important service and billing notices).

Using the service

When you use OutboundLeadPro we process the data you put into it in order to provide the service (Art. 6 (1) (b) GDPR): the login details of the mailboxes you connect (SMTP/IMAP host, username and password or app password — stored encrypted and used only to send your campaigns, run warmup and read replies, bounces and unsubscribe requests); the contact and lead data you import, find with Lead Finder or add by hand (business contact data from public sources such as company websites, Google Maps, OpenStreetMap and business directories: name, role, business email, phone, company, website, address and where each detail was found); the content of your sequences, templates and replies; and the results of your campaigns, including delivery, bounce, open and click tracking (only when you switch tracking on for a campaign), replies and unsubscribes. Email addresses are checked with our free Smart check (DNS records, published source, bounce history); when you explicitly request a deep check, the recipient’s mail server is asked whether the mailbox exists — no email is sent. To protect every sender, hard-bounced addresses are kept in a shared bounce memory as a one-way hash (never as readable addresses) together with per-domain delivery statistics. For the lead lists and campaign recipients you manage, you are the controller and we process this data on your behalf as a processor under Art. 28 GDPR; our terms include the data processing agreement. You can export or delete this data at any time in the app.

Payments

Paid plans are billed through Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe receives your payment details directly — we never see or store your full card number. We receive and keep the plan, payment status, invoice data and a Stripe customer reference (Art. 6 (1) (b) and (c) GDPR; invoices are kept for the periods required by German tax and commercial law, usually 8–10 years). Stripe's privacy policy: stripe.com/privacy.

Contact form and email

If you contact us, we use your message and contact details only to answer your request (Art. 6 (1) (b) or (f) GDPR) and delete them when they are no longer needed, unless legal retention periods apply.

3. Service providers we use

• Hosting: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus — our server is located in the EU. Data processing agreement in place (Art. 28 GDPR).
• Payments: Stripe (see above).
• AI language model providers (processing in the EU/US under data processing agreements): AI requests — drafting emails, icebreakers, reply labels and reply drafts — go to the AI language model selected by us. Only the text needed for the task is sent (for example the lead’s company name and the reply you received). EU standard contractual clauses apply.
• Lead Finder data sources: web search data providers (search and map results), OpenStreetMap services (Nominatim, Overpass) and public business directories and websites. Only the search terms and locations you enter are sent; no personal data about you.
• Bot protection: We use our own self-hosted checks on the sign-up form (a hidden field and a timed, signed form token) to stop automated fake accounts (Art. 6 (1) (f) GDPR). No personal data is shared with any third party for this.
• Maps: map tiles in Lead Finder’s map view are loaded from CARTO’s CDN (basemaps.cartocdn.com), using OpenStreetMap data; CARTO receives your IP address when you open the map.
• Email delivery: campaign emails, warmup and replies are sent and received through the mailboxes you connect yourself (for example Google Workspace, Microsoft 365 or your own SMTP/IMAP server); those providers process the messages under their own terms. Account emails from us (confirmation, password reset, notices) are sent through our own mail server.
• Optional integrations you connect yourself: if you add your own API keys or accounts (for example Hunter, ZeroBounce, Twilio, Telegram, HubSpot or Pipedrive), the data needed for that feature is sent to that provider on your instruction.

Where a provider processes data outside the EU/EEA, this happens on the basis of an adequacy decision (such as the EU-U.S. Data Privacy Framework) or the EU standard contractual clauses.

4. Cookies and tracking

We only use cookies that are strictly necessary: a session cookie that keeps you logged in and a small setting that remembers your light/dark theme. We do not use advertising cookies and do not sell your data. We do not use analytics tools.

5. How long we keep data

Account data is kept while your account exists. When you delete your account or ask us to, we delete your data within 30 days, except where the law requires us to keep it (for example invoices). Backups are overwritten within 30 days.

6. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). If you gave consent, you can withdraw it at any time with effect for the future. Just email support@outboundleadpro.com.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany — www.lda.bayern.de.

7. Security

All connections use encrypted HTTPS. Passwords are stored only as secure hashes, and secrets such as API keys you add are stored encrypted.

8. Changes

We update this policy when our service or the law changes. The current version is always available on this page.