Privacy Policy

Outhentik Privacy Policy

Effective date: 2 November 2026 Version: 3.2

This Privacy Policy explains how Outhentik ("we", "us", "our") collects, uses, stores, shares and protects personal data when you visit our website, create an account, use the Outhentik platform at outhentik.app, or send a message to a business that uses Outhentik.

Outhentik gives a business a direct channel from its customers. A customer scans a code or opens a link and sends a short message, typed, as a voice recording or as a video. The business reads every message, works a case for each customer who asks to be contacted, and sees issues that recur across its branches. Inviting customers to leave a Google review and sharing a customer's video publicly are optional features, and both are off until a business turns them on.

By accessing or using the Outhentik platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with how we handle personal data, please stop using our services. This policy should be read alongside our Terms of Service, Cookie Policy and Data Processing Agreement.

1. Who we are

Outhentik is operated by Dahi Alttatbiqat Establishment, Commercial Registration Number 7024055480, Alsafa, Jeddah, 23453, Saudi Arabia.

For data protection matters, and for anything else, contact us at: [email protected]

We act as the data controller for personal data of our business customers (account holders, their team members and billing contacts) and of visitors to our website. We act as the data processor for personal data of the customers who send messages to a business through Outhentik: the business that collects a message is the controller of it. The relationship between Outhentik and business customers is governed by the Data Processing Agreement.

2. Information we collect

2.1 Account information (business customers)

When you register for an account or accept an invitation to join one, we collect:

• Name and email address
• Hashed password (we never store passwords in plain text), or the name and email address Google shares if you sign in with Google
• The version of the Terms of Service in force when your account was created, and the time it was created
• Business name, branch names and addresses, and the Google place ID of each branch where you provide one
• Settings and branding (logo, brand colour, the language of your message page)

2.2 Messages and what customers choose (for the businesses that use Outhentik)

When a customer sends a message to a business through Outhentik, we process on that business's behalf:

• The message itself: typed text, or a voice or video recording
• A transcript of a voice or video message
• The customer's name, email address, phone number and star rating, each only if the customer chooses to give it. A phone number is asked for only when the customer asks to be contacted and the business accepts WhatsApp. It is used only so the business can reply, and it is offered on the same terms to every customer, whatever rating they gave
• The customer's choices: whether they asked to be contacted, whether they asked for a Google review link, and, for a video, whether they allowed it to be shared publicly
• A consent record: the exact privacy notice and wording the customer was shown, their answers, the time, their IP address and their browser details
• Analysis of the message: the topics and issues it raises, and short quotes from it
• The history of a case, when the business handles a customer's request to be contacted: who it was assigned to, and when it was marked contacted, resolved or reopened

2.3 Usage and device data

• IP address, browser type and version, operating system
• Pages visited and features used
• Date and time of access
• Referring address

Google Analytics collects usage data only after you accept analytics in the cookie banner. See section 5.

2.4 Payment information

If you subscribe to a paid plan, payment is handled by Paddle.com Market Ltd, which acts as merchant of record. We do not see or store card numbers. We receive transaction identifiers, billing details and plan details from Paddle.

2.5 Support chat and contact forms

• Support chat. What you type into the Outhentik support chat, and the replies, are stored as a conversation transcript. The chat does not ask who you are.
• Contact sales form. What you submit is sent by email to [email protected]. We keep a record that the email was sent.

2.6 Information from third parties

• Google sign-in. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Google Places. When you search for your business's Google listing, your search text is sent to Google to return suggestions. We store the resulting Google place ID.

3. How we use your information

• Running the service. To receive and store messages; to transcribe voice and video messages; to sort what customers say into topics and issues so a business can see what recurs across its branches; to show a business its messages, cases and reports; and to provide QR codes, links and the support assistant.
• Requests to be contacted. Where a customer asks to be contacted, the business receives the request in its Cases page with the email address or phone number the customer gave, so someone can reply, including through WhatsApp where the business accepts it. The box is shown when the business collects an email address or a phone number, and it is offered to every customer on the same terms, whatever rating they gave.
• Google review invites. Only where the business has turned Google review invites on. The customer can tick a box on the message page, before sending, and give an email address. We then send one email on the business's behalf with a link to review it on Google, about 24 to 48 hours after the message was sent. The box is offered to every customer on the same terms, whatever rating they gave, and nothing the customer says changes whether the email is sent.
• Shared findings. A business can share a finding about an issue, with short quotes from messages, through a private link that expires and that it can revoke. A quote shows the customer's own words exactly as said or typed, so a name spoken in those words appears as said; the name the customer entered in the form is not shown with it.
• Public video. Only where the business uses public sharing. A video is shown publicly, on the business's Wall of Love or its website embed, only if the customer said yes when asked and the business approved it. Typed and voice messages are never shown publicly.
• Account management. To create and manage accounts, authenticate users and process subscription billing through Paddle.
• Communications. To send account, security, team and alert emails.
• Analytics and improvement. To understand how the website is used, with your consent where cookies are involved, and to diagnose errors.
• Security and fraud prevention. To detect and prevent unauthorised access, abuse and fraud.
• Legal compliance. To comply with applicable law and lawful requests.
• Support. To answer your questions, including through the support chat.

Outhentik never contacts a business's customers for its own purposes.

4. Legal basis for processing

Under the EU GDPR and UK GDPR, we process personal data on these grounds:

• Contract (Art. 6(1)(b)). To provide the platform, manage your account and process payments.
• Legitimate interests (Art. 6(1)(f)). To secure and improve the platform, prevent fraud and diagnose errors. We balance these interests against your rights and freedoms.
• Consent (Art. 6(1)(a)). For analytics cookies and for a customer's choices on the message page. You can withdraw consent at any time without affecting processing carried out before.
• Legal obligation (Art. 6(1)(c)). For tax records and lawful requests.

For messages sent to a business through Outhentik, the business is the controller and is responsible for having a valid legal basis. Outhentik processes those messages on its instructions, under the DPA.

5. Cookies and browser storage

Outhentik uses two categories:

• Essential (always on). Sign-in, your cookie choice, and the settings you pick yourself, such as language and light or dark theme. These cannot be turned off.
• Analytics. Google Analytics. It is loaded only after you accept analytics in the cookie banner, and it is never loaded on the Wall of Love, the embed or a shared finding page. Google may process this data in the United States.

You can change your choice at any time through "Cookie settings" in the footer. Every cookie and storage item we use is listed in our Cookie Policy.

6. Sharing your information

We do not sell, rent or trade personal data.

6.1 Sub-processors

We share personal data with these sub-processors, which help us run the platform. Each is bound by a data processing agreement consistent with Article 28 GDPR. The same list is published at outhentik.app/sub-processors.

What you type into the support chat is sent to Google Gemini and OpenAI, so please do not enter passwords, payment details, or anything you would not want processed outside Outhentik.

6.2 Third parties your browser contacts

Some pages ask your browser to load files from these providers directly, so they receive your IP address and browser details:

6.3 Sharing by the businesses that use Outhentik

A business decides who on its team reads its messages. It may share short quotes from messages within its own organisation, for example with a branch or franchise partner, through a private link. A customer's video is shown publicly only if the customer said yes and the business approved it.

6.4 Other sharing

• Legal requirements. When required by law or lawful request, or to protect the rights, property or safety of Outhentik, our users or the public.
• Business transfers. In a merger, acquisition, reorganisation or sale of assets, data may be transferred as part of that transaction. We will tell you of any such change and the choices you have.
• Aggregated data. Data aggregated or de-identified so that it can no longer reasonably identify you.
• With your consent. For any other purpose, with your explicit consent.

7. International data transfers

Personal data is processed in these regions, by the sub-processors in section 6.1:

• Singapore: Supabase Inc.
• European Union: Cloudflare, Inc. (R2 storage); Speechmatics Ltd; Functional Software, Inc. (Sentry)
• United States: Vercel Inc.; Google LLC (Places API); OpenAI, L.L.C.; Pinecone Systems, Inc.; Resend Inc.
• Global: Google LLC (Gemini API)
• United Kingdom: Paddle.com Market Ltd
• Switzerland: Seven Assets Ltd (UptimeRobot)
• Saudi Arabia: Outhentik's authorised personnel, who access systems for operations and support

We apply EU GDPR and UK GDPR standards to all processing, wherever it happens. Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, with the UK International Data Transfer Addendum where UK personal data is involved
• Adequacy decisions where the European Commission has recognised a country as adequate (such as the United Kingdom and Switzerland)
• The EU-US Data Privacy Framework where the receiving organisation is certified
• Supplementary measures described in our Technical and Organisational Measures, including encryption in transit and at rest and access controls

You may ask for a copy of the safeguards for any transfer by contacting [email protected].

8. Data retention

• Messages. Voice and video files are kept for as long as the business keeps its Outhentik account, so it can play them back when handling a case or reviewing a recurring issue. Messages, their transcripts and their consent records are kept for the same period. The business can delete any message at any time, and a customer can ask the business to. When a message is deleted, its voice or video file is deleted with it.
• Accounts. Kept while the account exists. Cancelling a subscription does not delete anything. Deleting an account is a separate request, made in Settings: the account is locked and every session is signed out at once, and for 30 days signing in again cancels the deletion. After 30 days, the account and everything in it, including every message, file and consent record, is permanently deleted from our production systems. It leaves our backup systems within 90 days of the deletion request.
• Cookie choices. The record of your cookie choice (the choice, the time, your IP address and browser details) is kept as evidence of the choice. It has no fixed deletion date at present.
• Support chat transcripts. Kept with no fixed deletion date at present. Because the chat does not ask who you are, we may be unable to find one person's conversation to delete it.
• Usage and analytics data. Google Analytics keeps it for 14 months, then deletes it.
• Billing records. Kept as tax and accounting law requires, typically up to 7 years. Paddle.com Market Ltd holds billing data as merchant of record under its own retention policies.

You can ask for deletion of your data at any time by contacting [email protected] or, for an account, by using account deletion in Settings. Where the law requires us to keep something (such as billing records), we keep only that, and protect it until the legal period ends.

9. Data security

We apply technical and organisational measures to protect personal data, described in our Technical and Organisational Measures. They include:

• Encryption of data in transit (TLS 1.2 or higher)
• Encryption of data at rest where supported by sub-processors
• Multi-factor authentication on production infrastructure accounts
• Access controls limiting production data to authorised personnel
• Backups and disaster recovery
• Incident response, with notice of a confirmed personal data breach within 72 hours

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect your information and respond promptly to any incident.

10. Your privacy rights

You have rights over your personal data wherever you live. The exact rights depend on your jurisdiction, but these apply to most users:

• Access: a copy of the personal data we hold about you
• Rectification: correction of inaccurate or incomplete data
• Erasure: deletion of your data, subject to legal retention obligations
• Restriction: limits on how we process your data in certain circumstances
• Portability: your data in a structured, commonly used, machine-readable format
• Objection: to processing based on legitimate interests or for direct marketing
• Withdrawing consent: at any time, without affecting earlier processing
• Complaint: to your local data protection supervisory authority

To exercise any of these rights, contact [email protected]. We respond within 30 days. We may ask you to verify your identity, and we do not charge for reasonable requests.

If you sent a message to a business that uses Outhentik, that business is the controller of your data. Contact the business directly to exercise your rights. We will help the business fulfil your request.

11. Regional privacy rights

11.1 European Economic Area and United Kingdom

If you are in the EEA or the UK, your rights are set out in the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK General Data Protection Regulation. The rights in section 10 apply in full.

You can complain to your local supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ICO) at ico.org.uk. In the European Union it is your national supervisory authority.

11.2 California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights. While Outhentik may not currently meet the thresholds that make the CCPA apply, we honour these rights for California residents:

• Right to know the categories of personal information we collect, the purposes, the sources and the categories of third parties we share it with
• Right to delete personal information we collected from you
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing for cross-context behavioural advertising
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising these rights

We do not sell personal information as the CCPA defines it, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months.

Categories of personal information collected in the preceding twelve months:

• Identifiers (name, email address, phone number, IP address)
• Customer records (account information, billing information held by Paddle)
• Commercial information (subscription history, transaction details)
• Internet activity (interactions with our platform, web analytics)
• Audio and visual information (voice and video messages sent by customers)
• Inferences (the topics and issues found in messages)

Categories of sources: directly from you, automatically through your use of the platform, and from Google sign-in where used.

Business purposes: as described in section 3.

To exercise California rights, contact [email protected]. We respond within 45 days. You may also name an authorised agent to make a request for you.

If you are dissatisfied with our response, you may contact the California Attorney General's Office at oag.ca.gov.

11.3 Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island or Kentucky, you may have rights under your state's privacy law similar to those in section 10. Contact [email protected] and name your state.

11.4 Canadian residents

If you are in Canada, your rights are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial laws including Quebec's Law 25, Alberta's PIPA and British Columbia's PIPA.

You have rights to:

• Access the personal information we hold about you
• Ask for correction of inaccurate information
• Withdraw consent (subject to legal and contractual restrictions)
• Complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial commissioner

To exercise these rights, contact [email protected].

11.5 Australian and New Zealand residents

If you are in Australia, your rights are governed by the Privacy Act 1988 and the Australian Privacy Principles. If you are in New Zealand, they are governed by the Privacy Act 2020.

You can access, correct and complain about the handling of your personal information. Contact [email protected].

For unresolved complaints, Australian residents may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. New Zealand residents may contact the Office of the Privacy Commissioner at privacy.org.nz.

11.6 Other jurisdictions

We respect privacy rights under applicable law wherever our users live, including Brazil (LGPD), Singapore (PDPA), South Africa (POPIA), Japan (APPI) and Switzerland (FADP). The rights in section 10 are honoured for all users, and we cooperate with the relevant supervisory authority if asked.

To exercise a right under your local law, contact [email protected] and name the law you rely on.

12. Article 27 representative

Outhentik is established in Saudi Arabia. At the date of this policy, our processing of personal data of EU and UK data subjects is occasional and does not include large-scale processing of special category data within the meaning of Article 27(2)(a) GDPR.

If our processing later requires a representative under Article 27 EU GDPR or UK GDPR, we will appoint one and update this policy. In the meantime, EU and UK users may contact us directly at [email protected].

13. Children's privacy

Outhentik is not intended for use by anyone under 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child has given us personal data, contact [email protected].

14. Third-party links and services

The platform may link to websites and services that we do not operate, such as Google. We are not responsible for their privacy practices. Please review their privacy policies.

15. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, technology or the law. When we make material changes, we will:

• Update the "Effective date" at the top of this page
• Notify you by email or by a prominent notice on the platform
• Where the law requires it, seek your consent before applying the changes

Your continued use of Outhentik after a change constitutes acceptance of the updated policy.

16. Contact us

• Email, including data protection requests: [email protected]
• Postal address: Dahi Alttatbiqat Establishment, Alsafa, Jeddah, 23453, Saudi Arabia

If you are not satisfied with our response, you have the right to complain to your local data protection supervisory authority.

This Privacy Policy is published at outhentik.app/privacy.