Privacy Policy
Version 2026-10 · 10 October 2026 · subject to legal review
Effective from 10 October 2026.
This policy explains which personal data we process, why, on which legal basis, for how long and which rights you have under the General Data Protection Regulation (GDPR).
1. Who we are and our role
- Controller for account, billing, support and website data: NoLogTech, Lda., NIPC 516379801, Rua do Souto 14, Bragança, Portugal. Privacy contact: privacy@out-do.app.
- Processor for the data your organization enters in its workspaces. Your organization is the controller of that data and we process it only on its instructions, under the Data Processing Addendum.
2. Data we process
- Account: name, email and password (stored only as a hash). With Google or Microsoft sign-in, the email and name supplied by that provider.
- Organization and billing: company name, tax number, address, plan and payment history. Card data is handled by Stripe; we do not store it.
- Usage and security: change log of workspace rows, API request log (no IP address or user agent), error reports and product usage statistics with a pseudonymous account identifier.
- Audio recordings: the microphone is used only when a user presses Record in an audio field. The recording is stored with the other attachments of the workspace. If the organization turns on transcription, the audio is sent to Mistral to be transcribed and the text is saved in the record.
- Support: the messages you send us by email or through the support chat.
- Website: aggregated visit statistics without cookies, plus the campaign or page you came from when you sign up.
3. Purposes and legal bases
- Providing the service (account, workspaces, sync, AI features you request): performance of the contract.
- Billing and tax obligations: legal obligation and performance of the contract.
- Security, error diagnosis and abuse prevention: legitimate interest in keeping the service safe and working.
- Product statistics and sign-up attribution: legitimate interest in improving the product, with pseudonymous data and no cookies on the website.
- Service communications (changes to terms, prices, incidents): performance of the contract.
- Support chat on the website: consent, given when you open the chat. You can withdraw it by clearing the site data in your browser.
4. Subprocessors and international transfers
Production data is stored on our own servers at OVH in Gravelines, France, with backups in the same region. Analytics, support and monitoring tools run on our own infrastructure in Portugal. The list of subprocessors, with country, purpose and data, is on the subprocessors page.
When a subprocessor is in the United States or another country without an adequacy decision, the transfer is protected by the European Commission's standard contractual clauses.
5. Retention
| Data | Retention |
|---|---|
| Account data | While the account exists; you delete it yourself in the portal |
| Workspace data | While the organization exists; deleted when the owner deletes the organization |
| Row change log (audit) | 365 days |
| API request log (no IP or user agent) | 90 days |
| Database backups | Point-in-time recovery for 30 days, plus daily full backups |
| Virtual machine snapshots | The latest 60 on site, plus off-site copies |
| Support chats | While the account exists |
| Billing records | The period required by tax law |
6. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent where processing is based on it.
- In the portal you can delete your account yourself. Workspace data can be exported as CSV or through the API.
- For any other request, write to privacy@out-do.app. We reply within one month.
- For workspace data, requests should go to the organization that controls it; we help it answer them.
- You can complain to the Portuguese supervisory authority, the CNPD (cnpd.pt).
7. Security
We encrypt data in transit, isolate each organization's data in the database, keep audit logs and back up continuously. The details are on the security page.
8. Analytics and cookies
The website measures visits with Umami, hosted on our own infrastructure, without cookies. In the product, usage statistics use a pseudonymous account identifier and are not used for advertising. We do not use advertising or third-party tracking cookies. The full list is in the cookie policy.
9. Changes
We publish the current version on this page, with its version and effective date. For material changes, we notify account holders by email.
