Privacy Policy

Introduction

Outcomify ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

By using Outcomify, you agree to the collection and use of information in accordance with this policy.

Who We Are

Outcomify operates the Service and is the controller of the personal data described in this policy (for example, your account and usage data).

Where you are a business customer and you upload content that contains personal data about other people (such as customers, interviewees, or survey respondents), you are the controller of that data and we act as your processor under our Data Processing Agreement. You are responsible for having a lawful basis and the necessary notices and consents for that data.

Information We Collect

Personal Information

When you register for an account, we collect:

Name and email address
Profile information (optional)
Organization name and details
Payment information (processed by our payment provider)

Usage Data

We automatically collect certain information when you use our service:

Device and browser information
IP address and approximate location
Pages visited and features used
Sign-in, session, and security events

Content Data

We store the content you create or upload in Outcomify, including trees, nodes, comments, evidence, and attachments. This content is yours. It may include personal data about other people that you choose to upload (see "Who We Are"), and some of it is processed by AI features as described below.

How We Use Your Information

We use the information we collect to:

Provide, maintain, secure, and improve the Service
Process transactions and send related information
Send you technical notices, updates, and support messages
Respond to your comments, questions, and requests
Provide AI-assisted features (see below)
Monitor and analyze trends, usage, and activities
Detect, investigate, and prevent fraud, abuse, and security incidents
Comply with legal obligations

Legal Basis for Processing

Where the GDPR or similar laws apply, we rely on the following legal bases:

Performance of a contract: to create your account, provide the Service, and handle billing.
Legitimate interests: to secure the Service, prevent fraud and abuse, understand and improve our products, and produce aggregated insights—balanced against your rights.
Consent: for optional analytics cookies and certain optional communications, which you can withdraw at any time.
Legal obligation: for tax, accounting, and responding to lawful requests.

AI Features and Automated Processing

Some features—such as Canopy (our AI assistant) and our evidence analysis—process your content using AI models to generate suggestions, drafts, summaries, and insights.

For these features, the relevant content is sent to our AI sub-processor, the Microsoft Azure OpenAI Service, under contractual terms that prohibit the provider from using your content to train its models. We do not use your content to train foundation or general-purpose AI models.

You can exclude an individual evidence source from AI processing using the per-source "exclude from AI" setting. These features do not make legal or similarly significant decisions about you automatically.

Data Sharing and Sub-processors

We do not sell your personal information. We share it with the sub-processors and third parties that help us run the Service, each under contractual data-protection obligations:

Microsoft Azure — cloud hosting, database, and file storage
Microsoft Azure OpenAI Service — AI-assisted features (see above)
Microsoft Azure Communication Services — transactional email
Microsoft Azure Application Insights — reliability and performance monitoring
Google Analytics (GA4) — optional product analytics
Our payment processor — subscription billing

We may also disclose information:

Legal requirements: when required by law or to protect our rights and users
Business transfers: in connection with a merger, acquisition, or sale of assets
With your consent: when you have given us permission to share

A current list of sub-processors is available on request; where required, business customers can enter into our Data Processing Agreement, which includes sub-processor change notification.

Aggregated and De-identified Data

We may create and use data that is aggregated across a sufficient number of customers and de-identified, so that it does not identify you, your organization, or any individual and does not reveal your confidential content. We use it to operate, improve, and develop our products and to produce benchmarks, templates, and best-practice materials. Once data is aggregated and de-identified in this way, it is no longer personal data.

Access by Our Staff

Our authorized personnel may access your account and content only where necessary to provide support, operate and secure the Service, comply with the law, or investigate suspected abuse or security issues. Such access is subject to access controls, logging, and confidentiality obligations.

Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. This includes encryption in transit and at rest, access controls, and monitoring. However, no method of transmission over the Internet is 100% secure.

Data Retention

We retain your account and content while your account is active or as needed to provide the Service. If you delete your account, we will delete your content within 30 days, except where we are required to retain it for legal purposes.

Operational records—such as sign-in, IP and session logs, product-usage events, and AI-interaction logs—are retained for a limited period for security, abuse prevention, and analytics. Aggregated or de-identified data may be retained indefinitely.

International Transfers

Your data may be processed outside your country, including within the European Union and, for some sub-processors, in other regions. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

Your Rights

Subject to applicable law, you have the right to access, rectify, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise these rights, contact us using the details below. If we process personal data as a processor on a business customer's behalf, we will refer your request to that customer.

Access and receive a copy of your data
Rectify inaccurate data
Request deletion of your data
Restrict or object to processing of your data
Data portability
Withdraw consent at any time
Lodge a complaint with your data protection authority

Cookies

We use cookies and similar technologies to maintain sessions, remember preferences, and analyze usage. Essential cookies required for the service to function cannot be disabled. Analytics cookies are optional and can be enabled or disabled in our cookie preference dialog. We use Google Analytics (GA4) and Azure Application Insights. If analytics cookies are declined, we still collect anonymous, non-cookie service metrics for reliability and performance monitoring. We also store campaign attribution parameters (for example utm_source and utm_campaign) in a first-party cookie so we can measure campaign performance without storing personal identifiers.

Children's Privacy

Outcomify is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page, update the "Last updated" date, and keep prior versions available. Material changes will be communicated via email or in-app notification.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

Email: privacy@outcomify.com