Privacy Policy

Effective date: October 13, 2026

Powerbox, Inc. (“Powerbox”, “we”, “us”, “our”) operates OutSales (outsales.ai), a CRM with AI features that sends, reads and follows up on sales email for its users (the “Service”). This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and the choices you have.

1. Who we are

Powerbox, Inc., registered in the State of Delaware, USA.
Address: 2810 N Church St, PMB 829659, Wilmington, Delaware 19802-4447, US.
Email: privacy@outsales.ai

Two roles.

  • For the data about you as our customer (your account, billing, how you use the Service), we are the data controller.
  • For the data you put into the Service or connect to it about other people (your contacts, prospects and their emails), you are the controller and we are your data processor: we process that data only on your instructions, to provide the Service. A Data Processing Agreement is available on request at privacy@outsales.ai.

2. Data we collect

a. Account data. Name, email address, company, job title, and your password (stored only as a salted hash) or your sign-in with Google.

b. Data from the mailbox you connect.

  • Gmail and Google Calendar (through Google sign-in), Microsoft Outlook (through Microsoft sign-in), or any mailbox through SMTP and IMAP (with the credentials you enter).
  • What we access: email messages (headers, subject, body, attachments), the ability to send email, labels and the archive state of messages, and your calendar events (read-only).
  • SMTP and IMAP passwords are encrypted at the application level before they are stored.

c. Data from other tools you connect. Contacts, companies, deals, activities and notes from your CRM (Pipedrive, HubSpot, ActiveCampaign); subscription and payment status of your customers from Stripe; conversations from Intercom; the messages you exchange with our assistant.

d. Meeting data. When you enable the Meeting Notetaker, a recording bot joins the meetings you choose, and we store the recording, the transcript and a summary.

e. Contact data we add. When you ask for it, we look up public professional information about your contacts (name, title, company) from data providers.

f. Usage and tracking data. Log data (IP address, browser, pages used), and open and click events on the emails you send through the Service.

g. Billing data. Handled by Stripe. We never see or store full card numbers.

3. How we use data

  • To provide the Service: send your emails, read replies, stop sequences when a prospect answers, schedule follow-ups, keep your CRM up to date, record and summarise meetings you choose.
  • To run the AI features you use: write and personalise emails, classify replies, score buy intent, summarise conversations, and search your own emails and documents.
  • To secure the Service, prevent abuse, and comply with the law.
  • To bill you and to send you service messages about your account.

We do not sell personal data, and we do not use your data or your contacts’ data for advertising.

4. Google user data

This section applies to data we receive from Google APIs (Gmail and Google Calendar) when you connect your Google account.

What we access and why.

  • Read your email — to detect replies from your prospects, keep the conversation history on each contact, and give the AI features the context of the conversation.
  • Send email — to send the emails you write or approve, and the follow-ups you set up, from your own address and in the same thread.
  • Modify labels / archive — to archive a message when you ask our assistant to, or, if you turn it on, to archive messages our assistant marks as spam.
  • Read your calendar (read-only) — to find the meetings you choose to record.
  • Your email address and basic profile — to identify the connected account.

How we store it. In our database and search index hosted by DigitalOcean, encrypted in transit and at rest.

Who we share it with. Only with the service providers listed in section 6, only to run the features you use.

AI. To write emails and classify replies, parts of your email content are sent to AI providers (section 6) through their APIs. This happens only to provide features you use. We do not use Google user data to develop, improve or train generalized AI or machine-learning models, and we do not allow our AI providers to do so.

Limited Use. OutSales’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not:

  • transfer Google user data to others except to provide or improve user-facing features, for security, or to comply with the law;
  • use or transfer Google user data for advertising, including retargeting or personalised ads;
  • sell Google user data;
  • allow humans to read Google user data, except with your explicit consent for specific messages (for example, when you ask our support to look into a problem), for security reasons, to comply with the law, or when the data is aggregated and anonymised for internal operations.

Revoking access. You can disconnect your mailbox at any time in Settings → Integrations, or revoke OutSales’ access from your Google account at https://myaccount.google.com/permissions. Deleting your account removes the data we received from Google (section 7).

5. Legal bases (GDPR)

  • Contract: to provide the Service you signed up for.
  • Legitimate interest: to secure and improve the Service, and to prevent fraud.
  • Consent: to connect your mailbox and other tools; you can withdraw it at any time by disconnecting them.
  • Legal obligation: tax, accounting and other legal requirements.

6. Service providers (sub-processors)

DigitalOcean
Database, search index and file storage
USA (database, search index), EU – Germany (files)
Railway
Application servers
USA
Vercel
Web application hosting
USA
OpenAI
AI features and search indexing (via API)
USA
OpenRouter
Routing of AI requests, only to model providers based in the USA that neither retain nor train on the data (via API)
USA
Recall.ai
Meeting recording bot
EU (Germany)
Google
Gmail, Google Calendar, Google sign-in
USA
Microsoft
Outlook mailbox connection
USA
Stripe
Billing, and your customers’ subscription status if you connect Stripe
USA
SendGrid, Resend
Delivery of service emails and of emails you send through them
USA
Apollo.io
Professional data about your contacts, when you ask for it
USA
Serper
Web search for research features
USA
Pipedrive, HubSpot, ActiveCampaign
CRM sync, when you connect them
USA / EU
Intercom
Customer conversations, when you connect it
USA
Slack
Only if you connect our assistant to Slack
USA
Emailable
Checking that an email address exists
USA
Cal.com
Booking a call with us
USA

Providers outside the European Economic Area process data under the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

7. How long we keep data

  • While your account is active, we keep your data to provide the Service.
  • Deleting your account (Settings, or by writing to privacy@outsales.ai) permanently deletes your account, your contacts, your emails, your connected mailboxes and their tokens, and the related search data. Copies in our database backups are removed as backups rotate out, within 7 days.
  • Free plan: a free account with no sign-in for 30 days is deleted. We warn you by email at 15 and 28 days, and each warning contains a link to download your contacts. Signing in resets the count.
  • Billing records are kept as long as tax law requires.

8. Security

Encryption in transit (TLS) and at rest; mailbox passwords encrypted at the application level; access to production data restricted to authorised staff; each workspace’s data isolated from every other workspace.

9. Your rights

If you are in the EEA, the UK or another place that grants them, you can ask to access, correct, delete, restrict or port your personal data, object to processing, and withdraw consent. Write to privacy@outsales.ai. You can also complain to your local data protection authority.

If you are a contact or prospect of one of our customers, please write to that customer first — they decide how your data is used. We will help them answer you, and you can also write to us.

10. Children

The Service is not meant for anyone under 18, and we do not knowingly collect their data.

11. Changes

We will post changes on this page with a new effective date, and tell you by email or in the app when they are significant.

12. Contact

Powerbox, Inc. — privacy@outsales.ai — 2810 N Church St, PMB 829659, Wilmington, Delaware 19802-4447, US.