Terms of Service · Privacy · Cookie policy

1. Scope and data-protection roles

This policy applies to Outborn websites and products that reference it. Outborn is a controller when we decide why and how personal information is processed, such as for website inquiries, our own account administration, security, and business operations.

When an organization decides how information in its workspace is used and Outborn processes that information on the organization's documented instructions, the organization is the controller and Outborn acts as its processor or service provider. The customer's privacy notice and applicable service agreement also apply.

Customers that use Outborn for employee, customer, applicant, supplier, or other third-party information are responsible for their legal basis, required notices, appropriate permissions, minimization, retention settings, and applicable data-subject rights. Outborn assists as described in the service agreement and DPA.

2. Products and services covered

• Outborn Account, Organization Administration, and Platform Administration — identity, authentication, memberships, roles, permissions, administration, and platform controls.
• Outborn AppKit — application infrastructure, authentication, APIs, integrations, developer tools, shared services, and operational capabilities.
• Outborn AI — assistants, intelligent search, agents, automation, recommendations, and AI-powered workflows.
• Outborn Agent Connect — secure connections between agents, applications, tools, external systems, and user-permitted browser context.
• Outborn Governance — policy, privacy, security, audit, evidence, compliance, and organizational controls.
• Outborn Communication — email, in-app notifications, webhooks, templates, application events, delivery tracking, usage metering, and related communication infrastructure.
• OBSI Drive, Calendar, Chat, Wiki, Task, CRM, People, Asset, and Carbon — connected business data, files, collaboration, workforce, customer, asset, task, calendar, knowledge, and sustainability workflows.
• OBSI Finance — financial and accounting information when the product becomes available; product-specific controls and notices apply before processing begins.
• Outborn websites, contact and booking experiences, support, recruitment, customer-authorized integrations, and future services that reference this policy.

3. Information we collect

We collect information needed to provide, secure, administer, support, and improve the services, plus information you, your organization, or an authorized integration chooses to provide.

• Website and inquiry data: name, email, organization, inquiry type, message, language, source, submission time, booking details, recruitment information, résumé/CV, portfolio links, and request IP/technical data used to reduce abuse.
• Account and organization data: profile, authentication information, security settings, memberships, roles, permissions, application access, workspace configuration, administrative settings, and audit activity.
• Workspace data: files, documents, tasks, calendars, messages, knowledge, customer/contact records, employee/applicant records, asset records, financial information, sustainability data, attachments, comments, approvals, and workflow history.
• AI data: prompts, conversations, uploaded files, retrieved context, agent instructions, tool/model selections, workflow settings, outputs, and interaction history.
• Communication data: sender/recipient details, message and notification content, subjects, templates, event payloads, webhook destinations, delivery attempts/status, bounces/failures, preferences, identifiers, usage, and audit metadata.
• Sources can include you directly, your organization's administrators or users, connected services you authorize, and technical/security information produced while operating the service.

Cookie settings·Cookie Policy·Google Privacy Policy

4. Sensitive and special-category information

Some products, especially OBSI People, CRM, Drive, AI, Governance, and future Finance capabilities, can be configured by customers to process information that may be sensitive under applicable law. Depending on customer use, this can include compensation, government identifiers, financial details, health or leave information, disability/accommodation information, background or disciplinary records, authentication factors, and information revealing protected characteristics.

Do not place sensitive information into a general inquiry, AI prompt, browser-context request, or integration unless it is necessary for the requested function. Customers should minimize sensitive data, restrict access, configure retention, and ensure any required consent or other legal condition is in place.

When Outborn acts as processor, sensitive customer data is processed to provide the configured service on documented customer instructions, except where applicable law requires otherwise.

5. How we use information and legal bases

• Provide, operate, maintain, support, and secure requested Outborn services.
• Authenticate users and manage accounts, organizations, permissions, integrations, and service access.
• Process customer workflows, files, communications, AI requests, browser-context requests, and connected-service actions.
• Send requested or necessary service communications and maintain delivery/operational records.
• Monitor reliability, prevent abuse, investigate security incidents, debug failures, and protect users and services.
• Administer contracts, support, service limits, billing where applicable, and business relationships.
• Meet legal obligations, enforce agreements, establish or defend legal claims, and respond to lawful requests.
• Where a legal basis is required, we may rely on contract or requested pre-contract steps, legitimate interests where permitted, legal obligations, consent, or another lawful condition applicable to the processing. When Outborn is processor, the customer determines the legal basis and any condition needed for sensitive data.

6. Artificial intelligence and automated processing

Outborn AI and AI-enabled features may process prompts, files, records, retrieved context, connected-tool results, and permitted workspace information to provide assistants, search, summaries, recommendations, automation, agents, and business insights.

Organizations control whether AI features are enabled, what sources or tools may be accessed, and which users have permission. We do not use customer private data to train public AI models without permission.

If a configured feature uses an external AI provider, the applicable provider/data-flow settings apply and Outborn limits the information sent to what is needed for the requested function where technically possible.

AI output can be incomplete or inaccurate and should be reviewed before decisions about people. Where applicable law provides rights for solely automated decisions with legal or similarly significant effects, affected people may exercise those rights through the relevant controller.

7. Agent Connect and browser data

Agent Connect can pair an authorized agent with a browser extension or other local tool. Browser features are permission-based and intended to access only context needed for a user-requested action.

When enabled, browser context can include the active/open tab URL, page title and metadata, selected text, a limited text excerpt, and related context. If screenshot access is separately enabled, the visible active-tab screenshot may be processed; browser permission needed for screenshots can be broader than the content requested in a particular workflow.

Pairing credentials and browser permissions are security-sensitive. Users and administrators should enable only the permissions they need and disable them when no longer required.

Browser context and screenshots are used to complete the requested action, provide context/evidence if the user deliberately saves it, maintain security, and troubleshoot the service. Content that is saved into a workspace follows the retention and access controls of that destination.

8. Outborn Communication

Outborn Communication provides shared infrastructure for email, in-app notifications, webhooks, templates, application events, delivery tracking, retries, usage metering, and audit history.

It may process sender/recipient details, message or template content, subject lines, notification content, event payloads, destination URLs, timestamps, provider responses, delivery status, bounce/failure information, identifiers, and security/usage metadata.

Communication data is processed to queue, render, route, deliver, retry, troubleshoot, secure, meter, and report on the requested communication. Private communication content is not used for unrelated advertising or public-model training.

Depending on configuration, delivery may use Outborn infrastructure, a customer-configured SMTP/webhook destination, Resend, or another configured provider. Relevant providers are described in the service configuration and Subprocessors page.

9. Recipients, integrations, and subprocessors

We disclose personal information only as needed to provide the service, follow customer instructions, operate our business, protect the services, or comply with law. We do not sell personal information.

When you connect an external service, you authorize the relevant data exchange. The third party's own privacy notice may apply where it acts independently. Outborn limits access to the data and permissions needed for the configured integration.

Our public Subprocessors page identifies material centrally managed providers. Where a customer agreement or applicable law requires notice of a material subprocessor addition or replacement, Outborn will provide notice through the agreed channel.

• Authorized workspace users and administrators according to roles, permissions, and sharing settings.
• Cloud hosting, database, network, monitoring, communication, support, and optional analytics providers that process data for Outborn under applicable contractual terms.
• Customer-authorized identity, storage, communication, developer, business, AI, SMTP, and webhook integrations.
• Professional advisers, auditors, insurers, transaction counterparties, regulators, law enforcement, or other recipients where disclosure is lawful and necessary.

SubprocessorsData Processing Addendum

10. Data security and incident response

Outborn uses technical and organizational measures designed to protect personal information from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Depending on the service and risk, measures can include encryption in transit and at rest where applicable, authentication safeguards, least-privilege access, role-based permissions, tenant separation, secret protection, audit logging, monitoring, backups, secure development practices, and incident response procedures.

No internet service can guarantee absolute security. We review controls as products and threats evolve.

If Outborn becomes aware of a personal-data breach affecting customer data for which we act as processor, we will investigate, mitigate, preserve appropriate evidence, and notify the affected customer without undue delay as required by applicable law and contract. Where Outborn is controller, we will make required notifications to affected people and authorities in accordance with applicable law.

11. Data retention, deletion, and backups

We keep personal information only as long as reasonably necessary for the purpose, customer instructions, service operation, legal obligations, disputes, security, or agreement enforcement. Retention varies by product, workspace configuration, record type, customer agreement, and applicable law.

When retention ends, information is deleted, anonymized, or isolated from ordinary use unless continued retention is required or permitted. Backup deletion follows the applicable backup rotation rather than immediate in-place deletion from every backup copy.

12. Your privacy rights

Depending on your location, Outborn's role, and applicable law, you may have rights to access, correct, delete, restrict, object, receive or port data, withdraw consent, obtain information about automated processing, and exercise other rights provided by law.

You may object to direct marketing and, where applicable, to processing based on legitimate interests. Withdrawing consent does not affect processing that was lawful before withdrawal.

Email [email protected] and identify the relevant product, account, or workspace. Do not send passwords or unnecessary identity documents in your first message. We may request proportionate information to verify identity or authority.

If an organization controls the information, contact its administrator/privacy contact as well. Outborn assists the controller where required by law or agreement. You may also complain to the competent data-protection authority, including Thailand's Office of the Personal Data Protection Committee where applicable.

13. International processing and transfers

Outborn's primary application and database hosting for services described by this policy is located in Singapore unless a product or customer configuration states otherwise. External providers, customer-authorized integrations, support, communication delivery, analytics, and AI services may involve processing in other countries.

Where applicable law requires safeguards for an international transfer, Outborn uses an appropriate mechanism for the relevant transfer. Depending on the jurisdiction and recipient, this can include contractual safeguards, recognized standard contractual clauses, adequacy decisions, approved frameworks, or another mechanism permitted by law.

Contact the Privacy Team for product-specific countries, subprocessors, and transfer safeguards, including information about applicable contractual safeguards where required.

14. Data Processing Addendum and processor obligations

For business customers where Outborn processes personal data on the customer's behalf, the Outborn DPA forms or can form part of the service agreement. It addresses instructions, confidentiality, security, subprocessors, rights assistance, incident assistance, deletion/return, international transfers, and audit/information obligations as applicable.

If the DPA and this policy conflict regarding customer data processed by Outborn as processor, the applicable DPA and service agreement govern to the extent stated in those documents. Contact [email protected] for an executed or customer-specific DPA.

SubprocessorsData Processing Addendum

15. Children's privacy

Outborn business services are not directed to children. We do not knowingly collect children's personal information through a consumer service without the authorization or other legal condition required by applicable law.

Customers may process information about minors in a business product only where they are authorized to do so and configure the service appropriately. If you believe a child provided information without required authorization, contact the Privacy Team.

16. Changes to this policy

We may update this policy as products, providers, data practices, and legal requirements evolve. The effective date identifies the current version. When a material change affects personal-information processing, we will provide appropriate notice through the website, product, account, email, or another suitable channel as required.

17. Contact us

For privacy questions, rights requests, DPA requests, subprocessor questions, or concerns about personal information, contact Outborn Group Co., Ltd.'s Privacy Team.