Privacy Policy
How ContactReachout collects, uses, protects, and manages information when you use our platform and website.
Last Updated: September 23, 2026
1. Overview
This Privacy Policy describes how ContactReachout collects, uses, handles, and safeguards information when you visit our website, register for an account, or use our software platform.
ContactReachout is an enterprise platform designed for organizing bulk website contact-form outreach workflows, lead list management, AI-assisted personalization, and campaign analytics. We respect your privacy and process data responsibly to deliver our services.
2. Information We Collect
A. Account Information
When you register or manage an account on ContactReachout, we process information necessary to create and manage your account, including:
- Full name and email address
- Account authentication credentials (hashed password or OAuth tokens)
- User role (e.g., Super Admin, Admin, or User)
- Profile details and preferred preferences when provided
B. Campaign and Lead Information
To provide requested campaign execution features, the platform processes data provided by users during their outreach workflows, including:
- Uploaded lead lists, domain fields, and company names
- Target contact page URLs and contact-form fields
- Campaign configuration parameters and custom message text
- Generated draft content and submission processing logs
C. Usage and Technical Information
When you browse or interact with the platform, technical usage telemetry may be processed to measure reliability and performance, including:
- Pages viewed and navigation paths
- Approximate visit duration and engagement duration
- Traffic source and referring domain
- Device category (Desktop, Mobile, Tablet) and browser type (Chrome, Safari, Edge, Firefox)
- Country location when reliably provided by cloud environment headers
- Keyed visitor and session identifier hashes
Note: Technical telemetry does not track precise physical GPS coordinates.
D. Payment Information
Payment transactions are securely processed by our configured payment provider (e.g., Stripe). Payment card details are processed directly by our payment provider and are not stored as raw credit card numbers in ContactReachout's application database.
E. Communications
We process email addresses and message records for account notifications, transactional dispatches, security alerts, and support communications.
If you choose to connect a Gmail mailbox, we also process the connected mailbox address, Gmail message and thread identifiers, selected message headers, message participants, subjects, text content, granted scopes, and synchronization metadata needed to display and manage Inbox conversations.
3. How We Use Information
ContactReachout processes collected information solely for operational and service delivery purposes, including:
- Creating, provisioning, and maintaining your account
- Authenticating user logins and securing platform sessions
- Executing user-configured campaigns and contact-form discovery
- Processing uploaded lead lists and mapping contact fields
- Generating and personalizing approved outreach messages
- Tracking campaign outcomes and presenting performance reports
- Managing user credit balances, usage tracking, and billing
- Providing customer support and technical assistance
- When a user opts in to connect Gmail, synchronizing inbox conversations and sending replies from the selected connected mailbox at that user's request
- Monitoring platform reliability, error rates, and infrastructure performance
- Detecting and preventing abuse, rate-limit violations, and security threats
- Maintaining immutable administrative operational audit logs
4. ContactReachout Website Analytics
ContactReachout uses first-party website analytics to measure website engagement, page view counts, visit duration, traffic sources, device categories, and general country location. Visitor and session identifiers are recorded as keyed hashes rather than raw personal identifiers.
5. How We Use Campaign and Lead Data
Users retain full control over the lead lists and campaigns they create within ContactReachout. Information is processed strictly to execute requested platform functionality: storing lists, preparing campaigns, identifying contact forms, processing submissions, and displaying analytics.
6. AI Personalization
Where AI personalization features are enabled on your plan:
- Campaign context and lead variables may be submitted to configured third-party AI providers (e.g., OpenAI or Anthropic) for message drafting.
- Generated output requires manual review and approval by the user prior to dispatch.
- Users remain responsible for final outreach content sent to recipients.
- ContactReachout does not train proprietary AI foundation models on your uploaded private lead lists.
7. Cookies and Similar Technologies
ContactReachout uses essential session cookies (app_session) to maintain secure user login sessions, verify authorization, and prevent CSRF attacks.
- Essential authentication cookies are HTTP-only, secure, and configured with strict path limits.
- The platform does not deploy intrusive third-party cross-site advertising tracking cookies.
8. Data Sharing and Third-Party Services
ContactReachout does not sell, rent, or trade your personal information or lead lists to third parties. Information is shared only with configured service providers necessary to operate the platform, including:
- Payment Processors: Stripe for subscription checkout and payment verification.
- Email Delivery Infrastructure: Resend for system notifications and transactional emails.
- AI Model Providers: OpenAI or Anthropic for optional AI message personalization.
- Google: the Gmail API, only when a user elects to connect a Gmail mailbox. The current connection requests
gmail.readonlyto synchronize inbox replies andgmail.sendto send a reply from that connected mailbox. - Cloud Infrastructure & Database: Supabase / PostgreSQL for secure server-side storage.
Optional Gmail mailbox connections
Gmail access is optional. When the durable Inbox feature and its database schema are enabled, ContactReachout stores the information listed above to link conversations, prevent duplicate synchronization, retain member-specific read or archive state, and support replies. Gmail refresh tokens are encrypted before server-side storage and are not returned to the browser by the mailbox APIs.
Disconnecting a mailbox marks it disconnected in ContactReachout and stops the application from using that connection. You may also revoke ContactReachout's access from your Google Account's third-party access controls. We do not represent disconnecting in the app as revoking a Google authorization by itself.
Gmail Inbox persistence is not active until the corresponding feature flag and database migrations are deliberately enabled. Until then, a Gmail connection may be unavailable and legacy Inbox behavior remains in place.
9. Data Security
ContactReachout employs technical and organizational security controls designed to safeguard platform information, including:
- AES-256-GCM authenticated encryption for sensitive system integration credentials.
- Server-side environment configuration preventing raw secret exposure in client bundles.
- Server-side authorization guards (RBAC) restricting admin routes.
- Secure HTTPS/TLS encryption for all data in transit.
While we implement robust security safeguards, no internet transmission or electronic storage method can guarantee 100% absolute security.
10. Data Retention
We retain information for as long as reasonably necessary to provide the service, maintain account and transaction records, comply with applicable legal obligations, resolve disputes, enforce agreements, and maintain platform security, subject to applicable law.
11. Data Deletion and Account Closure
Users can manage or delete their uploaded lead lists and campaign records directly from their dashboard workspace. To request full account closure or data deletion, contact support at hello@contactreachout.com.
A connected Gmail mailbox can be disconnected from Profile > Profile & Contact Settings > Email Accounts. For a request concerning retained Gmail-derived Inbox data, contact support at the address above. Account deletion and data-retention requests remain subject to applicable legal, security, and record-retention obligations.
12. User Rights and Controls
Depending on your jurisdiction, you may have rights regarding your personal information, such as accessing account details, updating profile information, requesting corrections, or requesting account deletion. You may exercise available controls through your dashboard profile settings or by reaching out to support.
13. Account Security
Users are responsible for safeguarding login credentials and preventing unauthorized access to their accounts. ContactReachout reserves the right to revoke active sessions or restrict access if suspicious security events or credential compromises are detected.
14. Third-Party Websites
Because ContactReachout performs website contact-form outreach, the platform interacts with third-party external websites. ContactReachout does not control third-party website privacy practices, and users should review applicable terms and privacy policies of external target sites.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When material updates are made, the "Last Updated" date at the top of this page will be revised. Continued use of the platform after published revisions indicates acceptance of the updated policy.
16. Contact Us
If you have questions or inquiries regarding this Privacy Policy or data processing practices, please contact us: