Effective Date:29 September 2026

Privacy Policy

1. Introduction

GROCK FOUNDATION PTE. LTD. ("Company," "we," "our," or "us") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in compliance with Singapore's Personal Data Protection Act 2012 (PDPA), the European Union’s General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA), among other relevant data privacy laws.

By accessing or using our website (https://outreach2day.com/) or engaging our services, you accept and consent to the terms of this Privacy Policy.

 

2. Legal Framework

2.1 PDPA (Singapore)

We comply with Singapore's PDPA, which governs the collection, use, disclosure, and protection of personal data of individuals. Under PDPA, we ensure that your personal data is managed with transparency and in accordance with applicable legal obligations.

 

2.2 GDPR (European Union)

If you are located in the European Economic Area (EEA), the GDPR applies to the collection, processing, and storage of your personal data. Under the GDPR, we recognize your rights to access, correct, erase, restrict processing, object to processing, and request data portability of your personal data. The legal basis for processing your personal data includes the performance of a contract, compliance with legal obligations, consent, and legitimate interests.

 

2.3 CCPA (California, USA)

For residents of California, the CCPA grants additional rights concerning the collection and use of personal information. You have the right to know what personal information we collect, the right to request deletion of your personal information, and the right to opt out of the sale of your personal information. We do not sell personal data as defined by the CCPA.

 

3. Personal Data We Collect

We may collect and process various types of personal data, including:

  • Contact Information: Name, email address, phone number, mailing address

  • Usage Information: IP address, browser type, operating system, and website interaction data

  • Financial Data: Payment details when applicable for transactions

  • Communication Data: Feedback, inquiries, and information provided through forms

  • Cookies and Tracking Data: Information gathered from cookies, pixels, and similar tracking technologies

 

4. Purposes of Processing Personal Data

We collect and process personal data for the following purposes:

  • To Provide Services: Processing necessary to fulfill contracts and provide services you request

  • Marketing Communications: Sending promotional materials or updates (with your consent or where legally permitted)

  • Improving Services: Enhancing our website, products, and services based on user data and analytics

  • Compliance: Complying with legal obligations and responding to lawful requests from regulatory authorities

  • Security and Fraud Prevention: Detecting, investigating, and preventing fraud and security breaches

 

5. Legal Bases for Processing (GDPR)

Under the GDPR, our legal bases for processing your personal data include:

  • Consent: Where you have provided explicit consent for specific purposes

  • Contractual Necessity: Where processing is necessary for the performance of a contract

  • Legal Obligations: Where we are required to comply with a legal obligation

  • Legitimate Interests: Where processing is in our legitimate interest and not overridden by your data protection rights

 

6. Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) to oversee our data privacy compliance. The DPO is the director of GROCK FOUNDATION PTE. LTD. You may contact the DPO at any time regarding questions or concerns about your personal data:

 

Data Protection Officer (DPO)

Max Korolev

Email: support@outreach2day.com

Mailing Address: 68 Circular Road, #02-01, 049422, Singapore

 

7. Your Rights (GDPR, CCPA, PDPA)

7.1 GDPR (For EU/EEA residents)

Under the GDPR, you have the following rights:

  • Right of Access: To request a copy of the personal data we hold about you

  • Right to Rectification: To request correction of inaccurate or incomplete data

  • Right to Erasure (Right to Be Forgotten): To request the deletion of your personal data

  • Right to Restrict Processing: To request the restriction of processing under certain conditions

  • Right to Data Portability: To receive your personal data in a structured, commonly used format

  • Right to Object: To object to the processing of your personal data for direct marketing or legitimate interests

 

7.2 CCPA (For California residents)

Under the CCPA, you have the following rights:

  • Right to Know: To request disclosure of the categories of personal information collected and the purposes for which it is used

  • Right to Delete: To request the deletion of personal information

  • Right to Opt-Out: To opt-out of the sale of your personal information (we do not sell personal information)

  • Right to Non-Discrimination: To be free from discrimination for exercising your rights under the CCPA

 

Non-Sale of Personal Data under CCPA

In compliance with the California Consumer Privacy Act (CCPA), we do not sell personal data, including the personal data of minors under the age of 16. If you are a California resident, you have the right to opt out of the sale of your personal data, although we do not engage in such activities.

 

7.3 PDPA (For Singapore residents)

Under the PDPA, you have the following rights:

  • Access and Correction: To request access to or correction of your personal data

  • Withdrawal of Consent: To withdraw consent at any time for the collection, use, or disclosure of your personal data

To exercise any of these rights, please contact our DPO.

 

8. Sharing of Personal Data

8.1 Third-Party Service Providers

We may disclose personal data to third-party service providers who perform services on our behalf, such as:

  • Payment processors

  • Web hosting and IT service providers

  • Marketing and advertising partners These third parties are required to comply with data protection regulations and safeguard your data.

 

8.2 Legal Obligations

We may disclose personal data if required to do so by law or in response to valid requests from public authorities (e.g., regulatory bodies or law enforcement agencies).

 

8.3 International Transfers

If your personal data is transferred outside of Singapore, the EEA, or California, we will take steps to ensure that your data is transferred with adequate safeguards in accordance with applicable laws, including standard contractual clauses approved by the European Commission for GDPR-compliant transfers.

 

9. Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected or as required by applicable laws. We regularly review retention periods and securely dispose of data that is no longer needed.

 

10. Security of Personal Data

We implement appropriate technical and organizational measures to ensure the security of personal data and to protect it against unauthorized access, alteration, disclosure, or destruction. However, we cannot guarantee the absolute security of personal data transmitted over the Internet.

 

11. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your experience on our website. Cookies help us analyze web traffic and understand user behavior. You can modify your browser settings to reject cookies, although this may limit some functionalities of the site.

 

12. Children's Privacy

Our services are not intended for individuals under the legal age of consent in their respective jurisdictions. The age of consent may vary depending on where you are located:

·       In Singapore, the minimum age for providing personal data without parental consent is 13 years.

·       Under the General Data Protection Regulation (GDPR), the minimum age is 16 years. If a child is under 16, consent must be provided by the parent or guardian.

·       Under the California Consumer Privacy Act (CCPA), the minimum age for consent is 13 years, and parental consent is required for individuals between 13 and 16 if the data is to be sold.

 

We do not knowingly collect personal data from individuals below the relevant legal age. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact our Data Protection Officer (DPO). We will take immediate steps to delete such information.

 

13. AI Assistants, API and MCP

This section applies when you connect an AI assistant (for example Claude, ChatGPT, Cursor, Grok or Gemini) to Outreach2day through our MCP server at https://public.outreach2day.com/mcp, or when you use our REST API.

 

13.1 Data That Passes Through the MCP Server and API

When you or your AI assistant call a tool or an API endpoint, we receive the request and return the result. Depending on the tool, this includes:

  • Workspace data: workspace names and ids, account status, orders and quotes

  • Domains: domain names you check, buy or connect, their DNS status, and the registrant contact details for domain orders, which we pass to the domain registrar

  • Mailboxes: mailbox addresses, sender names, warmup status and per-mailbox statistics. Mailbox passwords, SMTP/IMAP settings, API keys and payment card data are removed from every tool result before it is returned.

  • Campaigns: campaign names, sequence steps and email copy, sending statistics and replies

  • Leads: contacts you import into campaigns and replies you receive. This can include personal data of your recipients, such as names, email addresses, job titles and company names.

For this data you act as the controller and we act as your processor, as for data you enter in the app. Tool results contain only data from the workspace your key has access to.

 

13.2 What We Log

For each tool call we write one log record with: the tool name, workspace id, user id, the AI client name and version as sent by the client, the response time, the outcome and an error code if the call failed. This record does not contain the arguments passed to the tool, the tool result or your conversation with the assistant. We also keep aggregated counters (tool, client type, outcome) to monitor the service. Our web servers log the IP address of each request, which we use for rate limits and security.

Tools that work without a key (checking domain availability, checking email copy for spam words, pricing) use your input only to answer the request. Domain names you check are sent to a domain availability service to answer the request. Email copy you check is not stored.

 

13.3 Your AI Assistant Provider

We do not receive or store your conversation with the AI assistant. The provider of your AI client (for example Anthropic, OpenAI, xAI, Google or Cursor) receives the tool results that its assistant requests and processes them under its own terms and privacy policy, not under this Privacy Policy. Before you connect an assistant to a workspace with recipient data, check how that provider stores and uses conversation content.

 

13.4 API Keys and OAuth Connections

  • API keys are shown once when you create them. We store new keys only as a SHA-256 hash, with a short prefix and the last four characters for display.

  • A key can be limited to read, write or billing scopes and to one workspace.

  • You can revoke a key at any time on the API keys page (https://app.outreach2day.com/api-keys). A revoked key stops working on the next request.

  • AI clients that support MCP sign-in (OAuth) connect without an API key: you sign in on an Outreach2day page, choose one workspace and the permissions (read, write, and billing if offered). The connection can act only in that workspace and only within those permissions.

  • OAuth access tokens expire after 1 hour. Refresh tokens change on every use and expire after 30 days without use and 90 days after the connection was approved at the latest. We store only SHA-256 hashes of tokens and authorization codes, never the tokens themselves.

  • We record connection events (client registration, consent, token issue, refresh and revocation) with the client id, user id, workspace id and IP address, for security.

  • To end a connection, remove it from the connected apps list in the app when that list is available, or ask support@outreach2day.com. Disconnecting Outreach2day in your AI client stops the client from using it; tokens the client already holds expire as described above. Revoking one token ends the whole connection. Removing a person from a workspace ends their access to it at once.

  • The MCP server does not charge a card. Orders are paid by you on a Stripe-hosted page after you confirm the quote.

 

13.5 Retention

Tool-call log records are deleted automatically after a short retention period. Data created through the MCP server or API (domains, mailboxes, campaigns, leads, quotes and orders) is account data and is kept under Section 9 until you delete it or close your account. Revoked API keys are deleted.

 

13.6 Contact

Questions about AI assistants, the API or the MCP server: support@outreach2day.com. The data controller for account data is GROCK FOUNDATION PTE. LTD., 68 Circular Road, #02-01, 049422, Singapore.

 

14. Updates and Amendments to this Privacy Policy

We reserve the right to update, modify, or amend this Privacy Policy at any time to reflect changes in our business practices, legal obligations, or regulatory requirements. Any changes to this Privacy Policy will be posted on our website and, where required by law, we will provide notice to you via email or other communication methods.

The updated Privacy Policy will include the "Effective Date" to indicate when the changes take effect. Your continued use of our website or services after any changes to this Privacy Policy constitutes your acknowledgment and acceptance of the updated terms.

In the event of significant changes that affect your rights or how we process your personal data, we will take reasonable steps to notify you and, where legally required, seek your consent before implementing such changes.

We encourage you to review this Privacy Policy periodically to stay informed of how we are protecting your personal data.

 

15. Contact Us

If you have any questions or concerns about this Privacy Policy or the handling of your personal data, please contact:

 

Data Protection Officer (DPO)

Max Korolev

Email: support@outreach2day.com

Mailing Address: 68 Circular Road, #02-01, 049422, Singapore