Data handling and privacy

This is the plain-English summary. The privacy policy is the document that governs, and it covers retention, transfers, legal bases, the Australian Privacy Principles, GDPR and CCPA.

What you'll learn

• What is collected, in four categories
• What it is used for
• Where to get the formal documents

What is collected

Account data. Names, work email addresses and roles for the people who use the platform. Billing details are handled by our payment processor, not stored by us.

Workspace configuration. Your business profile, prompts, topics, competitors, markets and settings. You put this in deliberately.

Measurement data. The answers engines gave to your prompts, the citations found in them, the sources those answers leaned on, and the changes you shipped. This is the product.

Trace data, if you install the tag. Visits to your site, classified by whether they came from an AI assistant or a crawler. What it records is the arrival and its source, not a profile of a person.

What it is used for

• Running your monitoring and producing your answers.
• Improving the quality of judging and verification, in aggregate.
• Operating the service: support, billing, security and abuse prevention.

Your workspace data is not used to advertise to you, and it is not sold.

Data minimisation

Two deliberate choices worth knowing:

1. Prompts do not carry your customers' data. A tracked prompt is a generic category question, not anything drawn from your CRM.
2. Trace records arrivals, not identities. It answers "did an AI answer send somebody here", not "who".

AI processing

Answers are obtained from AI engines and assessed by models. The privacy policy has a section on AI and automated decision-making that covers this specifically, including what is sent where.

Retention, transfers and sub-processors

These are all in the privacy policy, which is the version that is kept current and is the one to cite in a procurement questionnaire. Security covers infrastructure, encryption, access control, incident response and responsible disclosure.

For a DPA, a sub-processor list or a completed security questionnaire, email support@outercite.com.

What this page cannot answer

Anything contractual. Retention periods, transfer mechanisms and processing terms change, and a knowledge base article that restates them will eventually be wrong in a way somebody relies on. That is why the numbers live in the policy and not here.

Try this in Outercite

If you are completing a vendor assessment, start from security and privacy, then email support for anything those two do not cover.

Related