Privacy Policy

We collect the following categories of data:

• Account data — your email address and authentication credentials, handled by our authentication provider (Supabase Auth). If you sign in with Google, we receive your name, email address, and profile photo from Google; we never receive your Google password.
• Connected mailbox credentials — when you connect a mailbox to send from, we store either an OAuth refresh token (Gmail, Microsoft) or SMTP credentials, encrypted at rest with AES-256-GCM. These are never returned to your browser or exposed through the API once saved.
• Lead and prospect data — contact information you upload for outreach (name, email address, company, and any custom fields you provide) is stored to run your campaigns. This data belongs to your organization; we process it on your behalf, not for our own purposes.
• Message content and engagement data — the emails your campaigns send and receive, and open/click tracking events, so you can see delivery, reply, and engagement history.
• Usage and diagnostic data — error reports and performance data via Sentry, so we can find and fix bugs. Sentry does not receive your mailbox credentials or message content by design (see our redaction approach below).

• To operate the product — sending your campaigns, tracking replies, and showing you your data.
• To personalize outreach — when you use AI personalization, the lead's company information and your campaign context are sent to Google's Gemini API to generate a draft message. We do not use your data to train any AI model.
• To detect and prevent abuse of the sending infrastructure (rate limiting, bounce/suppression handling).
• To provide support when you contact us.

We use the following subprocessors to operate Oxeyo. None of them are permitted to use your data for their own purposes.

• Supabase — database hosting and authentication.
• Google (Gemini API) — AI-generated message personalization, when that feature is used.
• Upstash — job scheduling (sending cadence) and rate limiting.
• Sentry — error monitoring and diagnostics.
• Vercel — application hosting.
• Your own connected mailbox provider (Gmail, Microsoft/Outlook, or your SMTP host) — messages are sent through your own mailbox, so your provider processes them the same as any email you send manually.

We do not sell your data, or your leads' data, to anyone.

We use a small number of strictly necessary cookies to keep you signed in and remember your active workspace. See our Cookie Policy for the full list.

We retain your account and campaign data for as long as your account is active.

When an organization's account is closed, we keep its data for 30 days and then delete it permanently. The 30-day window exists so that an accidental closure, or one made by a compromised account, can be reversed. After it elapses, deletion is automatic and irreversible: the organization and everything belonging to it — campaigns, leads, sent and received messages, mailbox settings, suppression lists, notes, and deliverability history — is removed, along with any user account that belonged to no other organization.

Depending on where you're located, you may have rights to access, correct, export, or delete your personal data. Two of those are self-service:

Export. An owner or admin can download the organization's complete data at any time from Settings → Your data: one JSON file covering every table, or any single table as CSV. Mailbox passwords and OAuth tokens are never included in an export.

Deletion. An owner can close the organization from Settings → Close this account. Closing revokes access for every member immediately, stops all scheduled sending, and cancels any subscription; the data is then deleted after the 30-day retention period described above. Export your data before closing — once closed, nobody can sign in, including you. To reverse a closure within the 30 days, contact us using the details below.

For anything outside those two — correcting specific records, or a deletion request that needs to happen sooner than the 30-day window — contact us using the details below and we'll action it.

If your organization has uploaded a third party's contact information as a lead, that individual (or you, on their behalf) can request removal by using the unsubscribe link in any email they received, or by contacting us directly. An organization can also delete individual leads, or many at once, from its own campaign lead list.

Mailbox credentials are encrypted at rest. Data belonging to different organizations is isolated at the database layer, not only in application logic. We do not consider any system perfectly secure and encourage you to use a strong, unique password and enable any additional account protections your identity provider offers.

We may update this policy as the product changes. Material changes will be reflected by updating the "Last updated" date above.

Questions about this policy or a data request can be sent to privacy@oxeyo.com.