Legal
Privacy notice
Last updated 9 September 2026
What we process
Outemit processes account identifiers, organization and billing metadata, API and portal access metadata, destination URLs, webhook payloads, delivery responses, and operational logs needed to provide and secure the service. API keys are stored as hashes. Endpoint signing secrets are encrypted at rest.
Why we process it
We use this data to authenticate users, deliver and troubleshoot webhooks, enforce plan limits, process payments, prevent abuse, respond to support and security requests, and meet legal obligations. We do not sell customer data or use webhook payloads for advertising.
Retention and deletion
Payload retention is controlled by the subscribed plan and is currently 7, 30, or 90 days. Shorter-lived security and operational records may be retained where reasonably required for abuse prevention, billing, incident response, and legal compliance. Account deletion requests include deletion of tenant records and associated object-storage payloads, subject to legally required retention and backup expiry.
Service providers and transfers
We use a limited set of providers for hosting, identity, billing, and transactional email. The current list is published on the subprocessors page. Their processing locations and transfer mechanisms may vary by service configuration.
Your choices
Depending on your location, you may have rights to access, correct, export, restrict, object to, or delete personal data. Contact security@outemit.dev. We may need to verify your identity and authority over an organization before acting.
Important status
Outemit is in private beta. This notice describes current product behavior but is not a claim of GDPR, SOC 2, HIPAA, PCI DSS, or other certification. Jurisdiction-specific legal review and a signed data-processing agreement are required before regulated production use.