How Outgriid collects, uses and protects personal data, and the rights you have under LGPD, GDPR, UK GDPR and US state laws.
1. Who is responsible for your data
The controller of your personal data is Jessica Praxedes Julio, trading as Outgriid, CPF 408.455.668-81, Av. João Batista Raia, 346, Araraquara, SP, 14807-080, Brazil. For anything related to privacy, including the role of data protection officer (encarregado) under the Brazilian General Data Protection Law (LGPD), contact privacy@outgriid.com.
2. What this policy covers
This policy explains how we handle personal data when you visit outgriid.com, contact us, buy a package and take part in our calls. It does not cover third-party websites or services you reach through links on the Site, such as Stripe's checkout page, which have their own policies.
3. The data we collect
Data you give us.
- Contact form: your name, email, website (optional), topic and message.
- Purchases: your name, email, billing address and country, and the website you enter at checkout. Card details are collected and processed by Stripe. We only see limited information such as the card brand, the last four digits and the payment status.
- Delivering the service: answers to our questionnaire, information about your business and marketing, view-only access you choose to give us, call notes, summaries and emails we exchange.
- Call recordings, only if everyone on the call agrees.
Data collected automatically. Our hosting provider processes technical data such as IP address, browser type and request times in server logs, to deliver and secure the Site. We store your cookie choices in your browser. We do not currently use analytics or advertising cookies. If we add them, they will only run after you opt in. See our Cookie Policy.
Data from third parties. Stripe tells us whether a payment succeeded and may share fraud-prevention signals.
We do not ask for sensitive data (such as health, religion or political opinions), and we ask you not to share it with us.
4. How we use your data and why we are allowed to
| Purpose | Legal basis (GDPR / UK GDPR) | Legal basis (LGPD) |
|---|---|---|
| Scheduling and delivering your calls, summaries and other materials | Performance of a contract (art. 6(1)(b)) | Performance of a contract (art. 7, V) |
| Taking payments, issuing receipts, keeping accounting and tax records | Contract and legal obligation (art. 6(1)(b) and (c)) | Contract and legal obligation (art. 7, II and V) |
| Answering messages sent through the Site or by email | Steps before a contract or legitimate interests (art. 6(1)(b) and (f)) | Preliminary procedures or legitimate interest (art. 7, V and IX) |
| Keeping the Site and our systems secure, preventing fraud | Legitimate interests (art. 6(1)(f)) | Legitimate interest and fraud prevention (art. 7, IX) |
| Handling refunds, complaints and legal claims | Legitimate interests and legal obligation (art. 6(1)(c) and (f)) | Regular exercise of rights (art. 7, VI) |
| Recording a call, analytics or marketing cookies, if ever used | Consent (art. 6(1)(a)) | Consent (art. 7, I) |
We do not send marketing newsletters. If we ever offer one, we will only send it if you sign up. We do not sell your personal data and we do not use it for automated decisions with legal or similarly significant effects.
5. Who we share data with
We share personal data only with service providers that help us run the business, under contracts that require them to protect it and use it only on our instructions:
- Stripe, for payment processing and fraud prevention.
- Vercel, which hosts the Site.
- Email providers, which host our mailboxes and send transactional emails such as order confirmations.
- Video conferencing providers (Google Meet or Zoom), used to hold the calls.
- Productivity tools, such as online documents and calendars, used to prepare and share your materials and book calls.
We may also disclose data when required by law, by a court order or by a competent authority, or to protect our rights in a dispute. We do not sell personal information and we do not share it for cross-context behavioural advertising.
6. International transfers
We are based in Brazil and some of our providers process data in other countries, including the United States. When data is transferred internationally, we rely on safeguards recognised by law, such as adequacy decisions, standard contractual clauses approved by the European Commission, the UK addendum to those clauses, or the standard clauses and other mechanisms provided for in article 33 of the LGPD.
7. How long we keep data
- Purchase, payment and accounting records: 5 years after the end of the year of purchase, to meet tax obligations and the limitation periods of Brazilian consumer law.
- Questionnaires, call notes and summaries: up to 2 years after your last call, so we can help you if you come back. You can ask us to delete them earlier.
- Call recordings: 30 days.
- Messages that do not lead to a purchase: 12 months.
- Server logs: kept by our hosting provider for a short period, usually no longer than 30 days.
- Your cookie choices: 12 months, after which we ask again.
8. Your rights
Everyone. You can ask us for a copy of your data, to correct it, or to delete it, and you can withdraw any consent you have given at any time. Write to privacy@outgriid.com. We may need to confirm your identity before acting on a request. We reply as soon as possible and in any case within the deadlines set by the law that applies to you (15 days for a complete answer under the LGPD, one month under the GDPR).
Brazil (LGPD, art. 18). You have the right to confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with your consent, information about who we share data with, information about the consequences of refusing consent, and revocation of consent. You may also file a complaint with the National Data Protection Authority (ANPD).
European Economic Area and United Kingdom. You have the rights of access, rectification, erasure, restriction, portability and objection, including the right to object to processing based on legitimate interests. You may complain to your local data protection authority or, in the UK, to the Information Commissioner's Office.
United States. Depending on your state, you may have the right to know what personal information we collect, to access, correct and delete it, and to opt out of its sale or sharing. We do not sell or share personal information, and we honour Global Privacy Control signals. We will not discriminate against you for exercising your rights. You may use an authorised agent, in which case we may ask for proof of authorisation.
9. Security
The Site is served only over HTTPS. Payments are handled by Stripe, which is certified to PCI DSS Level 1. We limit access to personal data to what is needed to serve you, use strong passwords and two-factor authentication on our accounts, and delete data we no longer need. No system is completely secure, but we will tell you and the competent authority without undue delay if a breach is likely to put you at risk.
10. Children
Our services are for adults and businesses. We do not knowingly collect personal data from anyone under 18. If you believe a minor has sent us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you by email before it applies.
12. Contact
Privacy requests and questions: privacy@outgriid.com
Postal address: Jessica Praxedes Julio (Outgriid), Av. João Batista Raia, 346, Araraquara, SP, 14807-080, Brazil