Privacy Policy

1. Who we are

NuMail Inc., a Delaware corporation ("we", "us"), operates OutboundPass: the OutboundPass membership program and the underlying products bundled into it. For the purposes of GDPR and similar laws, NuMail Inc. is the data controller for membership data and for the details you give on our register-interest page (section 2.3), and a data processor for the data you upload into the products (e.g., contact lists, mailbox content).

2. What we collect

2.1 Membership data

• Name, email address, billing address, and payment method (the latter handled by Stripe).
• Company name, role, and other professional details you provide at signup.
• Your plan and billing history, and, if you join the affiliate program, your referral link, referrals, commissions and payout details.
• Login activity, IP address, device type, and basic analytics on how you use the member dashboard.

2.2 Product data

• ColdRelay: the email content you send, recipient addresses, and SMTP/sending logs.
• NuMail: your campaigns and the email content you send, recipient lists and addresses, replies, and sending logs.
• Handshake: LinkedIn account credentials (encrypted), connection lists, message templates and content.
• ZenVerifier: email addresses you submit for verification.
• LeadCart (when launched): search queries, lead lists you build, and signal subscriptions.
• InboxSlash (when launched): connected mailbox and LinkedIn account metadata, plus the message threads synced into your unified inbox.
• Outbound Community: profile information, posts, comments, and engagement.

2.3 Register-interest form for a possible investment round

If you register interest in a possible Regulation Crowdfunding round on our register-interest page, we collect your name, email address, country, the rough amount you indicate, an optional note, the country derived from your IP address, your browser's user agent, the version of the page you saw, and your confirmation that you understand registering is non-binding. We use them only for that round: to email you about it, to help us size it, and to keep a record of the communications we must file with an offering statement if we go ahead. Each new registration is also emailed to our team, through our email provider (Resend). We don't sell them or share them with affiliates. Registering is free and non-binding. To update or delete your details, email founders@outboundpass.com.

2.4 What we don't collect

We don't sell your data. We don't run third-party advertising trackers in the member dashboard or product apps (only privacy-preserving product analytics). We don't read or scan the personal content of your emails or LinkedIn messages outside of what's required to operate the products and protect against abuse.

3. Why we collect it (legal bases under GDPR)

Purpose	Lawful basis
Provide and operate the Pass and its products	Performance of contract
Process payments and renewals	Performance of contract
Send service communications (e.g., outage notices)	Legitimate interest
Send product marketing emails	Consent (you can opt out at any time)
Analytics & product improvement	Legitimate interest
Affiliate-program tracking and payouts	Performance of contract
Register-interest form: emails about a possible investment round	Consent, which you give by registering (you can withdraw it at any time)
Detect and prevent fraud, abuse, and spam	Legitimate interest, legal obligation
Comply with legal obligations	Legal obligation

4. Sub-processors

We use the following third parties to operate the Pass and this site.

Sub-processor	Purpose	Region
Stripe	Payment processing	USA / EU
Vercel	Website and app hosting	USA
Neon (via Vercel Postgres)	Database hosting	USA
Clerk	Member sign-in and authentication	USA
Amazon Web Services	Cloud infrastructure	USA / EU
MillionVerifier	Email verification (ZenVerifier)	USA
Blitz API	Lead data (LeadCart)	USA
Resend	Transactional email	USA
Vercel (BotID)	Bot protection on our public forms: an invisible check that runs in your browser when you send one of our forms, so automated sign-ups can be told apart from people. No CAPTCHA, and it adds nothing to your account	USA
Vercel (Web Analytics)	Cookieless analytics: page views and anonymous funnel events; we don't add names, emails or account IDs to them	USA
OpenAI (Ads pixel)	Ad measurement on outboundpass.com: whether a visit from a ChatGPT ad led to a checkout or a purchase, matched with hashed contact details. In the EU, the EEA and the UK only after you accept cookies; never if you decline	USA
Telegram	Members' channel hosting	UAE / DE

Payments. Charges are currently made through the Stripe account of ColdRelay LLC, a Wyoming limited liability company, and appear on your card statement from it (see section 3 of the Terms). As the holder of that Stripe account, ColdRelay LLC also receives the billing details of your payments: your name, email address, billing address, plan, amounts and payment history, and your card's brand and last four digits. Full card numbers stay with Stripe.

A current list of sub-processors is maintained on this page.

5. International transfers

If you are located outside the United States, your personal data may be transferred to and processed in the US, where most of our sub-processors are based, and in the other regions listed in section 4. Data-protection law there may differ from the law where you live. Questions about these transfers: founders@outboundpass.com.

6. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires us to keep it.

Data type	Retention
Active membership data	For the duration of your membership
Membership data after cancellation	As long as tax, accounting and other legal rules require
Product data (lists, mailbox content)	Until you delete it, or ask us to delete it
Affiliate program data	As long as tax and accounting rules require for commission and payout records
Server logs	As long as our hosting provider's log retention keeps them
Marketing email subscribers	Until you ask us to delete them (unsubscribing stops the emails)
Register-interest details	As long as we need them for that possible round and the records the law requires about it. Ask us to delete them anytime

7. Your rights

Depending on your jurisdiction, you have rights including:

• Access: get a copy of the personal data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion (subject to legal retention obligations).
• Portability: receive your data in a structured, machine-readable format.
• Restriction / objection: ask us to limit certain uses (e.g., direct marketing).
• Withdraw consent: for any processing based on consent, at any time.
• Lodge a complaint with your local supervisory authority.

To exercise any of these rights, email founders@outboundpass.com with the subject line "Privacy request". We respond within 30 days.

8. Security

We use reasonable technical and organizational measures to protect personal data, including: encryption in transit (TLS 1.2+) and at rest; access controls and logging; isolated tenant environments; vetted sub-processors; periodic security reviews. No system is 100% secure, and we will notify affected members of any confirmed security incident involving their personal data within the timeframes required by applicable law.

9. Cookies & tracking

The marketing site (outboundpass.com) and member dashboard use a small number of cookies and similar technologies:

• Strictly necessary: session cookies to keep you logged in, and op_analytics, which we set when you click Decline. It only tells our servers not to count you. It is sent to this site only (host-only), lasts up to 1 year and is refreshed when you visit. When you click Accept we set op_ads instead, which only tells our servers that you accepted, with the same scope and lifetime; Cookie settings clears both.
• Affiliate attribution: outbound_ref, a 60-day cookie set when you arrive through an affiliate link (a ?ref= link). It holds the affiliate's referral code. It is used to credit the referring affiliate if you buy here or on one of our product sites (our links to those sites carry the code), and, unless you decline analytics, to count whether a visit or a checkout came from a referral (as yes or no, never the code). It is set when you arrive, before you make a cookie choice, and Decline doesn't remove it (Decline is about analytics). It is never set on our register-interest page for a possible investment round.
• Analytics: Vercel Web Analytics: cookieless, with no individual fingerprinting. It records page views and anonymous funnel events (for example checkout started, purchase, renewal, refund, affiliate application, member sign-in and onboarding). Some of these events are sent from our servers. We don't add names, emails or account IDs to these events.
• Advertising measurement: the OpenAI Ads pixel, on the marketing site only (never in the member dashboard or the product apps). It tells OpenAI which pages you viewed, when you start a checkout and, after you pay, the plan and amount, so we can measure our ads in ChatGPT. It stores its own identifiers in cookies and local storage on your device (such as __oaiq_consent, __obref and __oppref). When you buy, our server also reports that purchase (plan and amount) to OpenAI with the same pixel identifiers, so it is counted even if the success page doesn't load; our server doesn't send your name, email or account ID. The pixel uses OpenAI's automatic advanced matching: when you type contact details into a form on this site (such as your email, phone number or name), it hashes them in your browser (SHA-256) and sends only the hashes, so OpenAI can match your visit to a ChatGPT account. OpenAI never receives the readable values. The pixel runs only if you clicked Accept in the banner, or if you haven't chosen and you are outside the EU, the EEA and the UK. To check that, your browser's time zone is read locally and, if needed, our server answers yes or no from your IP country without storing either. Until then it doesn't load at all, and clicking Decline stops it straight away. Our server reports your purchase under the same rule, judged when you start checkout: only if you had accepted, or had not chosen and are outside the EU, the EEA and the UK.

Decline applies to this site (the member dashboard has no cookie banner). It stops page views and the events sent for your visit, including those our servers send, such as checkout started. Events derived from Stripe webhooks (for example purchase, renewal, refund or an abandoned checkout) and affiliate account activations carry no visitor device or IP: we count them as anonymous business totals whether or not you declined.

Apart from the OpenAI Ads pixel above, we do not run third-party ad-network trackers. You make your cookie choice in the banner on your first visit, and you can change it at any time here: Cookie settings clears your choice and shows the banner again.

10. Children

The Pass is intended for business operators 18+ and is not directed at minors. We do not knowingly collect personal data from anyone under 18. If you believe a minor has signed up, please contact us so we can delete their data.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date and the version at the top show when it last changed.

12. Contact

Privacy questions, data subject requests, or DPA requests: founders@outboundpass.com (subject line "Privacy"), or by post to NuMail Inc., 651 N Broad St, Suite 201, Middletown, DE 19709, USA.