Privacy Policy

Galactic Outreach is run by Joan Gumban, a sole trader in Davao City 8000, Philippines (we, us or our). This Privacy Policy describes how we process personal information through galacticoutreach.com and the dashboard behind it (the Service).

It covers two kinds of personal information, with different rules for each: information about you, our customer, for which we are the controller; and information about the people your campaigns contact, for which you are the controller and we process it for you (Section 2). If you are in Europe or the UK, Section 11 has more for you. Write to hello@galacticoutreach.com about anything on this page.

1. Information we collect about you

1.1 Information you give us.

• Account data: your email address and name, from signing up with Google, GitHub, X or a password.
• Campaign details: the sending name and address you send from, your postal address, your website and, if you give it, what your business sells. The postal address is required because CAN-SPAM requires one in the messages you send.
• Content you create: your templates, schedules, settings and the files you import.
• Communications: what you write to us, such as a support request or a bug report.

1.2 Information from others.

• Sign-in providers: if you sign in with Google, GitHub or X, your name and email address from that account.
• PayPal: the order identifier and the outcome of each payment, so we can add the credits it bought. We never see or store your card details; PayPal handles those.
• Your email provider: delivery events for the messages you send, such as a bounce or a complaint, so the software can act on them.

1.3 Information collected automatically.

• Usage counts: emails sent and lead searches run, so your balance and plan limits can be applied.
• Request data: your IP address and the pages you load pass through the network in front of the site, and password attempts are counted by IP address to stop abuse.
• Analytics, where a deployment turns it on: page views only, with template and receipt identifiers stripped from the address. No session recording, no recording of what you click, and no profile for a visitor who has not signed in.

2. Information about the people you contact

When you run a lead search, the software collects business contact details from public sources: businesses' own websites and public business listings. That can include a business email address, a website, a phone number, a city and country, and sometimes a named owner and their role.

These are people who have not asked to hear from you, so it matters who is responsible for them. You are. You decide what to search for, who stays on the list and who is contacted; we store that list for you and apply the rules you configure. Under the GDPR you are the controller of that data and we act as your processor, under the Data Processing Agreement. We use it only to provide the Service to you, we do not use it for our own purposes, and we do not share it with other customers. Each account's list is isolated from every other.

Where the GDPR applies, Article 14 requires that a person whose data was not collected from them be told, by your first message at the latest, who you are, why you hold their data, where it came from and that they can object. That notice is yours to give. The software can add a source line to your messages, which covers where the data came from but not the rest. Leads in countries that require opt-in before a first email (Germany, Spain, Poland, the Netherlands and Singapore, and any country the product has no rule for) are held when the list is built and never sent to. Country rules lists every country and the rule applied to it.

If you turn on automation suggestions, text from a lead's public website is sent to an AI provider (Google Gemini or Anthropic Claude) to write one sentence about that business. It goes under the API key you saved in Settings, to your own account with that provider, or, where we have turned the feature on for your campaign, under ours.

If someone asks you to delete their data, you can remove them from the dashboard, and adding them to the do-not-contact list stops them being collected again.

3. Cookies and similar technologies

The Service sets a small number of cookies, each for one job:

• Sign-in: keeps you signed in, and remembers where to take you after signing in.
• Preferences: your chosen language, and which sign-in method you used last, so the login page can suggest it.
• Security: a short-lived value that protects the step where you connect a Microsoft 365 or Google Workspace mailbox.
• Analytics, where a deployment turns it on: an identifier that lets page views be counted, as in Section 1.3.

There are no advertising cookies and no tracking pixels. You can block or delete cookies in your browser, but signing in needs the first kind. Some browsers send a “Do Not Track” signal; the Service does not change its behaviour in response, because it does no tracking across other sites to switch off.

4. How we use your information

• To provide the Service: to run your account and campaign, apply your balance and limits, and respond to your requests.
• To communicate with you: replies to your messages, notices about your account or these policies, and the run reports the software sends about your campaign.
• To bill you: to record what you bought and keep the records tax law requires.
• To keep it secure: to prevent abuse, fraud and unauthorised access.
• To improve it: to understand which pages are used, from the page-view counts above.
• To comply with the law: to meet legal obligations, respond to lawful requests, and establish or defend legal claims.

We do not sell your information, we do not use it for advertising, and we do not use it to train AI models.

5. Who we share it with

5.1 Service providers. A few providers help us run the Service, each under data protection terms. By what they do:

• Hosting: the server the application runs on, in Germany.
• Database and sign-in: a hosted PostgreSQL service, in Frankfurt.
• Network: the network in front of the site. Every request passes through it, so it sees visitors' IP addresses and the pages they load.
• Abuse protection: password attempts and calls to the public webhook addresses are counted by IP address, and each count is deleted after a minute.
• Product analytics, where a deployment turns it on: the page views described in Section 1.3.
• Email delivery: the email we send you ourselves, such as a reply to a bug report you filed, or a campaign's run report when the campaign has no email provider of its own ready.
• AI provider, where we have turned automation suggestions on for your campaign under our key: the website text described in Section 2.

For the current list of providers by name, write to hello@galacticoutreach.com.

5.2 Services you choose. PayPal is the controller of your payment data, under its own privacy policy. Your email provider (Resend, Amazon SES, Mailgun or SendGrid under credentials you supply, or your Microsoft 365 or Google Workspace mailbox, connected by signing in) and any AI provider whose key you save act for you, under your own account with them: messages and their delivery events pass through your account, not ours.

5.3 Others, when needed. Professional advisers, such as lawyers and accountants, in the course of advising us; authorities, where the law requires it or where we believe in good faith that it is needed to protect rights, safety or property; and a successor, if the Service is ever transferred, who would be bound by this policy.

6. Where it is kept

The application runs on a server in Germany, and data is stored in a hosted PostgreSQL database in Frankfurt. Files that belong to a campaign (its lead queue, its send history) sit on a disk attached to that server. We run the Service from the Philippines, and some of the providers above, such as PayPal and the network, are based outside Europe, including in the United States. Section 11.5 explains how those transfers are protected.

7. How long we keep it

Campaign data stays until you erase it or close your account. The do-not-contact list is deliberately excluded from the erase tools: it exists to record that someone asked not to be emailed, and deleting it would lose that. Billing records are kept as long as tax law requires. When we no longer need information, we delete it or make it anonymous.

8. Your choices and rights

You can see and update your account details in the dashboard, and export or erase your campaign data there yourself. Depending on where you live, you may also have the right to see the information we hold about you, correct it, delete it, object to how we use it, or take it elsewhere. For anything the dashboard does not do, write to hello@galacticoutreach.com from the address on your account, and we will respond within 30 days. We may ask you to confirm your identity first. Exercising a right will never cost you anything or change how we treat you.

In the Philippines, the Data Privacy Act of 2012 gives you these rights, and you may complain to the National Privacy Commission if you are not satisfied with our answer.

In US states with privacy laws, you may have the rights above under your state's law, and the right to appeal a refusal by writing to us again. We do not sell or share personal information for targeted advertising, and we do not use it for profiling that has legal or similarly significant effects.

9. Security

Access is over HTTPS and each account's data is separated at the database level. Your email provider's API key and your AI provider's key are held in an encrypted secrets vault rather than in the application database, and never sent back to the browser. No system is perfectly secure; if a breach affects you, we will tell you.

10. Children

The Service is for businesses and is not meant for anyone under 18. If you believe we hold information about a child, tell us and we will delete it.

11. If you are in Europe or the UK

11.1 Controller. For the information about you in Section 1, we are the controller under the GDPR and the UK GDPR. For the information in Section 2, you are, and the Data Processing Agreement applies.

11.2 Our legal bases.

• Contract: providing the Service, communicating with you about it, and billing you.
• Legitimate interests: keeping the Service secure and free of abuse, and counting page views to improve it. We have weighed these against your interests, and kept both to the minimum they need.
• Legal obligation: keeping billing records, and responding to lawful requests.

11.3 Your rights. You may ask us to give you access to your information, correct it, delete it, restrict how we use it, or hand it to you or someone else in a machine-readable form. You may object to processing based on our legitimate interests. Write to us as in Section 8. If we decline a request, we will say why.

11.4 Complaints. You may complain to the data protection authority where you live or work. In the EEA, the European Data Protection Board lists each one. In the UK, it is the Information Commissioner's Office.

11.5 Transfers outside Europe. Your data is stored in Germany, but we run the Service from the Philippines, which has no adequacy decision from the European Commission, and some providers are in other countries. Where data leaves Europe, it goes to a country with an adequacy decision, or under the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), as the Data Processing Agreement sets out for campaign data. Write to us for a copy of the safeguards that apply.

11.6 No automated decisions. We do not make decisions about you by automated means that have legal or similarly significant effects.

12. Changes to this policy

If this policy changes materially, we will tell you by email before the change takes effect, and update the date at the top of this page.

13. How to contact us

Joan Gumban, Galactic Outreach, Davao City 8000, Philippines. hello@galacticoutreach.com.