Privacy policy
What we collect, why, who else handles it, and how to have it deleted.
Last updated: 8 November 2026
What we collect
- Account data: your email, your name, and your password stored as a bcrypt hash.
- LinkedIn session data: your
li_atcookie and user-agent string, encrypted at rest with Fernet (AES-128-CBC with HMAC-SHA256). The encryption key is kept in a separate locked file on the server, away from the database and the app settings. - Your cloud browser: each workspace has its own browser profile on our server, which holds the live LinkedIn session while it runs. It sits in a folder only the server administrator can read.
- IP address and Telegram settings: the country you pick, the static IP address we give your account and its login details (or the details of a proxy you paste in yourself), and your Telegram bot token if you connect one. The login details and the bot token are encrypted the same way as your cookie.
- Lead data: LinkedIn profile URLs, names, headlines, companies and locations of the people you find, import or scrape, plus any notes and message templates you write.
- Activity logs: a log for each run (which connection requests were sent, which posts were liked, which messages went out) and the daily counts used for your plan’s caps.
- Billing data: your plan and subscription status. Card details are entered on Dodo Payments’ checkout page and stay with Dodo Payments; we do not receive them.
How we use it
To run the tools you start, show you your leads, runs and logs, send the reports you turn on, and bill you. We do not sell or rent your personal data, and we do not use it for advertising.
People in your lead lists
Lead data is about people who are not our customers. You choose who to find and contact, and you are responsible for having a lawful basis to do so under the data-protection laws that apply to you. If someone asks you not to contact them, respect it. See the acceptable use policy.
Who else handles it
We use a small number of outside services to run Connected Outreach: Dodo Payments (payments), Apify (lead search), Proxy-Seller (each account’s own static IP address), Hostinger (server hosting), DeepSeek (AI-written connection notes) and Telegram (daily reports, only if you connect your own bot). The subprocessors page lists what each one receives.
How long we keep it
We keep your data while your account exists. Nightly database backups are kept for 14 days; any secrets inside them stay encrypted.
Deleting your data
You can delete your LinkedIn cookie yourself at any time from the LinkedIn cookie page in your account. That also wipes your cloud browser’s session.
To delete your whole account, email hello@connectedoutreach.com. Within 30 days we delete all your data, including encrypted credentials, leads and run logs. Copies in nightly backups expire within 14 days after that.
If you think your cookie has been exposed anywhere, open LinkedIn and go to Settings, Sign in and security, Where you’re signed in, and sign out of all sessions. That makes every copy of the cookie useless, including ours.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@connectedoutreach.com.
Cookies
The app keeps you signed in with a token stored in your browser’s local storage. We do not use analytics or advertising cookies.