Privacy policy

Last updated : 2026-10-03

1. Who processes your data

outsend is a service published by LOCKLEAD, a French simplified joint-stock company (SAS) with a share capital of €500, registered with the Paris Trade and Companies Register under no. 995 260 130, whose registered office is at 53 rue du Cardinal Lemoine, 75005 Paris, France. LOCKLEAD is the controller of the processing described on this page.

For any question or to exercise your rights: contact@outsend.xyz.

2. What this policy covers

This policy describes the data LOCKLEAD processes on its own behalf: your account, the trial without an account, our correspondence, the security of the service, audience measurement and the messages we send to make outsend known.

The files a user produces with outsend are a separate case. They contain publicly accessible business information (name, address, phone, email, website). The user decides what to collect and how to use it: the user is the data controller, and LOCKLEAD acts as a processor on the user's behalf, under the Terms of service.

Are you listed in a file and wish to exercise your rights? Write to contact@outsend.xyz. We handle your request within one month. The data we hold ourselves is described in section 13.

3. Data, purposes and legal bases

Data	Purpose	Legal basis
Account: email address, password (stored as a hash, never in plain text), creation and last login dates, IP address and country of the last login	Create your account, authenticate you, secure access	Performance of the contract
Sign-up: answers to the welcome questionnaire (your business, your target), IP address, browser, referring page	Open access, prepare your workspace, limit abuse, know where sign-ups come from	Pre-contractual steps taken at your request; legitimate interest
Trial without an account and public tools: email address, trade, area, selected options, address of the analyzed website, IP address	Send you the file you asked for, limit the number of trials, then present outsend in three follow-ups at most	Pre-contractual steps taken at your request; legitimate interest for the follow-ups, which you can object to at any time
Account activity: extractions run and files produced, pipelines, monitoring, preferences, API keys (hashed), personal AI key (encrypted), AI usage	Provide the service	Performance of the contract
Correspondence: messages sent through the contact form, the built-in support or by email	Reply to you and follow up on your request	Legitimate interest
Security log: IP address, browser, action performed, email address typed during a failed attempt	Detect abuse, keep a record of sensitive actions	Legitimate interest (security of the service)
Web server logs: IP address, requested page, browser, date and time	Run the service, diagnose failures, protect it	Legitimate interest
Audience measurement: pages viewed, referrer, device, approximate city derived from the IP address, truncated IP address and, if you are logged in, the email address of your account	Understand how the service is used and improve it	Legitimate interest
outsend's own outreach: published professional email address (website, channel, directory), name, business	Present outsend to professionals the service may be relevant to	Legitimate interest; you can object at any time
Opt-out list: email address of people who asked not to be contacted again	Stop writing to you	Legal obligation

No payment is collected during the alpha phase: outsend processes no banking data.

The email address is required to open an account or receive a trial file.

4. Artificial intelligence

The "Talk to outsend" assistant and the preparation of your workspace from the welcome questionnaire use an artificial intelligence model provided by Anthropic (United States). The text you type is sent to Anthropic to produce the answer.

You can save your own AI key (Anthropic, OpenAI, Google, Mistral, DeepSeek, Groq or xAI). It is stored encrypted. The AI processing you run then goes through the provider you chose, under its own terms.

Connectors for AI assistants (MCP). An outsend account can be linked to a third-party AI assistant, such as Anthropic's Claude, through our MCP connector. The account holder authorizes it themselves, on an outsend consent page or with an API key. The assistant can then read the account's modules, jobs, results and events, and run extractions, enrichments, pipelines and monitors on its behalf. Data the assistant receives is processed by its provider under its own privacy policy; outsend does not receive the content of conversations with the assistant. Access tokens are stored as a hash, never in clear text, with their last-use date, and deleted 30 days after they expire or are revoked. Access can be revoked at any time in Settings, API keys, Connected apps.

5. Retention periods

Account and activity: for as long as the account exists.
Login session: 7 days. Confirmation link: 24 hours. Reset link: 1 hour.
Technical log of extractions: 14 days.
Security log: 12 months.
Web server logs: 90 days at most.
Trial without an account: 12 months.
Answers to the welcome questionnaire: until the account is deleted, or 12 months if no account was opened.
Correspondence: 3 years after the last message.
Outreach: 3 years after the last contact.
Opt-out list: 3 years.
Audience measurement: kept during the alpha phase. A limited period will apply at commercial launch.
Backups: 7 days.

Deleting the account erases the account, the extractions and their files, the pipelines, the monitoring, the keys, as well as the answers to the welcome questionnaire and the trials linked to your address. The security log, our correspondence and the audience measurements are kept for their own period. Backups that still contain your data disappear within 7 days.

6. Recipients

Your data is neither sold nor rented. It is accessible to LOCKLEAD and to the following providers, each for its own task only:

Hetzner Online GmbH (Germany): hosting of the server, the database, the backups and the audience measurement tool.
Brevo (France): sending and receiving email.
Anthropic (United States): artificial intelligence, for the features described in section 4.
TrulyInbox (India): email deliverability service. It accesses mailboxes that receive a copy of the messages sent to our contact addresses.
Esri (United States): base map shown on the page of an extraction. Your browser loads it directly from Esri, which receives your IP address.
Google (United States): website performance measurement. Only the address of the analyzed website is sent.
Third-party sites displaying a badge on the home page: your browser loads the image directly from them, they receive your IP address.
Technical verification services: only the number or domain being checked is sent to them.

Data may also be disclosed to an authority that requests it in the manner provided by law.

7. Transfers outside the European Union

The outsend server is located in Germany. The following recipients are established outside the European Union:

Anthropic (United States): transfer governed by the European Commission's standard contractual clauses.
Esri and Google (United States): companies certified under the EU-U.S. Data Privacy Framework.
TrulyInbox (India): transfer governed by the European Commission's standard contractual clauses.
Third-party sites displaying a badge: some may be established outside the European Union. They only receive the IP address sent by your browser.

8. Your rights

You have the following rights over your data:

Access: obtain a copy of your data.
Rectification: correct inaccurate data.
Erasure: delete your account from Settings, or ask us to erase a piece of data.
Restriction: ask for processing to be suspended.
Objection: refuse processing based on legitimate interest, including audience measurement and outreach. For outreach, simply reply "stop" to a message or use the link it contains.
Portability: retrieve your data in a reusable format.
Instructions after death: decide what happens to your data.

The export available in Settings contains your account, your extractions, your pipelines, your monitoring and your files. Other data is provided on request at contact@outsend.xyz. We reply within one month.

You can also lodge a complaint with the French data protection authority (CNIL): cnil.fr.

9. Security

Measures in place:

Passwords hashed with bcrypt, never stored in plain text.
Encrypted connection (HTTPS) across the whole site.
Session cookie out of reach of scripts and sent over encrypted connections only.
Data partitioned by account.
Limit on the number of login attempts.
Log of sensitive actions.
Daily backup of the database.

10. Cookies and local storage

outsend sets the following cookies:

outsend_session: keeps you logged in. 7 days.
outsend_lang: remembers the chosen language. 1 year.
os_ref: remembers the page or campaign you arrived from. 30 days.
_pk_id (13 months), _pk_ses (30 minutes), _pk_ref (6 months): audience measurement.

The browser's local storage keeps your display preferences. It stays on your device.

Audience measurement is carried out with Matomo, installed on the outsend server: no data is sent to an ad network. The IP address is truncated. If you are logged in, visits are associated with the email address of your account. To object, write to contact@outsend.xyz.

11. Data breach

If a data breach poses a risk to your rights, LOCKLEAD notifies the CNIL within 72 hours. If the risk is high, you are informed directly, without undue delay.

12. Changes

This policy evolves with the service. The date of the last update is shown at the top of the page. Account holders are notified of any significant change by email.

13. You are a professional listed in our data

To complete and check business records, LOCKLEAD maintains reference databases built from official public sources: the SIRENE register of INSEE (the French national statistics office), open data sets published by the French State and its agencies (including the directory of health professionals) and the Recherche d'entreprises API. They contain professional information: identity and address of the business, activity, published professional contact details, identity and role of company officers. For an officer who is a natural person, we keep only an age bracket (for example "40-49"): never their date of birth or nationality, which are deleted as soon as they are received. For businesses located in the United States, these databases come from official public registers of US states, counties, cities and federal agencies. We keep only business information (identity, activity, register status, reported headcount) and, for the declared owner or officer, only their name and title. For a company listed on a US stock exchange, we also carry the revenue and net income published in its annual accounts filed with the Securities and Exchange Commission. For a business located in Vermont, from 28 December 2026, we no longer provide personal email addresses or information derived from the phone number; only the information published by the business itself and official register data remain.

This data supports business-to-business prospecting carried out by our users, who receive it in their files, on the basis of legitimate interest. It follows its source: a business that asked INSEE not to disclose its information is not included, and the legal records we look up are kept for 30 days.

To access, correct or remove your data, or to object to its use, write to contact@outsend.xyz. We reply within one month. Your other rights and the right to lodge a complaint with the CNIL are described in section 8.

14. Contact

LOCKLEAD, 53 rue du Cardinal Lemoine, 75005 Paris, France. contact@outsend.xyz