Privacy Policy

Outreach Studio is operated by Sako Dev. For data you give us about yourself (your account), we are the data controller. For contact data you upload to run campaigns, you are the controller and we process it on your behalf. Contact: support@sakodev.com.

• Account data — your name, email address, and a salted hash of your password (we can never read the password itself).
• Workspace data — contacts you import or discover, campaigns, generated messages, replies, and campaign statistics.
• Connection credentials — SMTP/IMAP passwords and API keys you choose to store. These are encrypted at rest (AES-256-GCM) and never returned to the browser once saved.
• Engagement signals — opens, link clicks, replies, bounces, and unsubscribes for emails you send, so you can see campaign results.
• Technical basics — IP addresses in server logs and rate-limit records, kept briefly for security.

We do not sell data or run third-party advertising or analytics trackers.

• to operate the product: send your campaigns, poll your inbox for replies, show statistics;
• to generate message drafts via the AI provider configured for your account;
• to send transactional email (welcome, email verification, password reset);
• to protect the Service: rate limiting, abuse prevention, enforcing sending limits;
• to respond when you contact support.

• AI providers (Anthropic, Groq) — receive campaign briefs and contact business details to draft messages. With your own API key, your provider relationship applies; with the included AI, requests go through our key.
• Your email provider — messages are sent through the SMTP server you connect; replies are read from the IMAP inbox you connect.
• Paddle — our merchant of record for paid plans. Paddle processes payment details; we never see your full card number.
• Hosting — the application and database run on servers we rent in the EU.

If you received an email sent with Outreach Studio: the sender chose and controls your contact information — we process it for them. Every campaign email carries an unsubscribe link; opting out is enforced permanently and automatically. To raise a concern about a sender, contact us at support@sakodev.com and we will investigate.

We use one strictly necessary cookie: your session (an HMAC-signed token that keeps you logged in for 30 days). No advertising or cross-site tracking cookies.

Your data is kept while your account is active. Deleting your account removes your contacts, campaigns, messages, settings, and credentials from the live database. Server backups age out on a rolling schedule. To request deletion or a copy of your data, email support@sakodev.com.

Passwords are hashed with scrypt; stored credentials are encrypted with AES-256-GCM; the Service runs over HTTPS; access to production systems is limited to the operator. No internet service can promise perfect security, but security decisions in Outreach Studio err on the conservative side.

Depending on where you live (e.g. GDPR, UK GDPR, CCPA), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict processing. Email us and we will honor these requests for the data we control. For contact data uploaded by one of our users, we will refer the request to that user, as they are the controller.

We will post updates here and, for material changes, notify you by email or in-app. See also our Terms of Service.