Privacy Policy

English translation provided for convenience. The French version is legally binding and prevails in case of discrepancy.

Last updated: 4 October 2026

1. Data controller

Noah Hepp, 385 Chemin Gibelin, Matoury, is the data controller for the processing described in this policy, in relation to your account and your subscription to Outrify.

Privacy contact: support@outrify.io — phone: +33 7 82 67 85 62.

2. Two clearly separate categories of data

Outrify is an application installed on your computer. It deliberately separates two categories of data:

(a) account and subscription data (identity, email, payment status) and the messages you send to support, which pass through our servers (Supabase) to allow sign-in, billing and handling of your requests;

(b) targeting settings, connected accounts, message templates, blocklists and sending history, which are stored only on your computer and are never kept on our servers (only what an analysis needs, such as the targeted countries, travels with the analysis request while it is processed — see the artificial intelligence section).

3. Data we collect (server side)

Email address and password (the password is stored encrypted by our authentication provider, never in plain text).

Subscription status, chosen plan, number of accounts included, Stripe billing identifiers (the Publisher never sees your full card number).

Minimal technical metadata needed to run the account (creation date, last sign-in).

For each bot run: a technical identifier of the account being run (generated by the app, unrelated to the Instagram account name), and the number of analyses and messages sent, to enforce the limits of your plan or free trial. It is only used during the session (24 hours at most) and is then deleted automatically.

Messages sent to support: when you write to us from Settings → Support, we record the subject and text of your message, your email address, your plan, the application version and the date sent. This message is forwarded by email to our team so that we can reply. Never include sensitive information (password, API access key, bank card number).

4. Legal bases for processing

Creating and managing your account, sign-in, providing the Service and your subscription: performance of the contract (Article 6(1)(b) GDPR).

Billing and keeping accounting records: legal obligation (Article 6(1)(c) GDPR).

Handling messages sent to support: performance of the contract (Article 6(1)(b) GDPR).

Audience and usage measurement (PostHog): your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

Security of the Service and abuse prevention (sign-in attempt limits, free-trial quota checks): the Publisher's legitimate interest (Article 6(1)(f) GDPR).

5. Data that stays on your device

The accounts you connect, your targeting criteria, your message templates, your blocklists and your sending statistics are stored in local files on your computer. The Publisher has no remote access to them.

This data includes information about third parties (the profiles visited or contacted as part of your prospecting activity). For this processing, you act as the data controller towards those people; the Publisher acts only as the provider of the local technical tool.

6. Processors and recipients

Account hosting and authentication: Supabase Inc. (database and authentication), 970 Toa Payoh North #07-04, Singapore — contact: privacy@supabase.io — infrastructure hosted on servers located outside the European Union (AWS us-west-2 region, United States).

Payments: Stripe, Inc. (payment and billing processing).

Sending support emails: Resend (Resend, Inc.), which forwards to our team the messages you send through the support form.

Artificial intelligence (mandatory): the visual analysis of profiles uses OpenAI's API with your own access key, entered in Settings and required to run the bot. The content analysed (screenshots of public profiles, public comments, and only the settings needed for the analysis, such as the targeted countries) is sent encrypted to the Publisher's server (functions hosted by Supabase), which checks your subscription rights, then relays it to OpenAI using your own key and returns the result. Neither this content nor your key is kept by the Publisher: they are only used for the duration of the request and are never stored or logged.

Audience and usage measurement: PostHog (PostHog Inc.), hosted on servers located in the European Union. On the website, only after your consent (see our cookie policy). In the application, only if you have accepted it (request shown after sign-in, can be changed in Settings > Privacy), and only structural events linked to your signed-in account (for example sign-in, starting the bot) — never your connected accounts, your targeting criteria, the content of your messages or any information about the people you contact, which remain exclusively local as described in section 5.

7. International data transfers

Account and subscription data is hosted on Supabase infrastructure located outside the European Union. This transfer is governed by the Data Processing Addendum concluded with Supabase, which incorporates the standard contractual clauses adopted by the European Commission (article 46 GDPR).

The provider used to send support emails (Resend) may process these messages from servers located outside the European Union, under the same safeguards.

8. Retention period

Account and subscription data is kept for as long as the account is active. When the account is deleted, it is erased immediately from our database, and from our host's technical backups within 30 days at most.

Invoices and accounting records related to your payments are kept for 10 years, as required by Article L123-22 of the French Commercial Code.

Support messages are kept on our servers for as long as your account is active, and deleted with it. Copies received by email by the Publisher are kept for as long as needed to handle your request.

Local data is kept on your device until you delete it yourself or through the application.

9. Your rights

Under the GDPR, you have a right of access, rectification, erasure, portability, restriction and objection over your account data.

You can directly exercise your rights of access, portability and erasure from Settings → Privacy (download my data / delete my account). For any other request: support@outrify.io.

You also have the right to lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr.

10. Security

Your account password is stored encrypted by our authentication provider. The local session token is encrypted on your device where the operating system allows it (Keychain/DPAPI).

Communications between the application and our servers are encrypted (HTTPS/TLS).

11. Changes

This policy may be updated; the date of the last update is shown at the top of this document in the application.