Outerstep
Book a call

Legal

Privacy Notice

How we handle personal data — both for exporters who use Outerstep and for the business contacts we approach on their behalf. Those are two different relationships and this notice treats them separately.

Version 1.0Effective 8 September 2026

In short

We contact people in a business capacity, about products their company already imports. We do not sell personal data. An unsubscribe applies across the entire platform, not just to the exporter whose outreach prompted it — permanently, and without you having to ask twice.

1. Who we are

Outerstep is operated by Commerciax Infotech Pvt Ltd, which is the controller for the personal data described in this notice. Contact us at hello@outerstep.com.

2. Data about our customers

If you are an exporter using Outerstep, we hold:

  • Account and company data — name, work email, phone, role, company legal name, country, registered address.
  • What you sell — product records, specifications, capacity, certifications, ports and HS codes.
  • Activity — messages sent and received through the platform, introductions unlocked, deal-stage changes, documents uploaded, and the timestamps on all of it.
  • Agreement records — the terms you accepted, when, by whom, and from which IP address. We keep these because they are what an agreement is enforced on.
  • Payment details — held by our payment provider. Card numbers never reach Outerstep’s servers; we store only the card brand and last four digits.

We use this to run the service: to find buyers matching your products, to draft replies, to compute what is owed, and to keep the record of what happened.

3. Data about business contacts

If we have written to you on behalf of an exporter, we hold your work email address, your name and role, and your company’s details — drawn from public trade and customs records, company websites and business-data providers.

We contact you in a business capacity, about a product your company already imports, because that is the only kind of approach that is useful to either side. We do not hold consumer data and we do not write to personal email addresses.

If you reply, your message is processed to understand what you are asking for — the product, quantity, destination and timeline — and passed to the exporter concerned. If you do not reply, the sequence ends on its own.

4. Why we are allowed to

  • Contract — for customer data, because we need it to provide the service you signed up for.
  • Legitimate interests — for business-contact data, in conducting business-to-business outreach relevant to the recipient’s role. We balance this against your interests, which is why we cap how often a company is contacted, honour objections immediately and permanently, and never approach consumer addresses.
  • Legal obligation — where we must keep records for tax, accounting or compliance.

5. Who we share it with

  • The exporter, where you have replied to their outreach and an introduction is made. That is the point of the service.
  • Service providers who run parts of the platform on our behalf — email delivery and deliverability, business-data enrichment, cloud hosting and document storage, payment processing, and language models used to classify replies and draft responses. Each is bound to use the data only for that purpose.
  • Authorities, where the law requires it.

We do not sell personal data, and we do not license contact lists to anyone.

6. How long we keep it

  • Customer account and deal records — for the life of the account and then as long as needed for tax, accounting and the enforcement of agreements.
  • Agreement and acceptance records — retained after an account closes, because they evidence what was agreed.
  • Business-contact data — while the contact remains relevant to an active campaign, and then deleted.
  • Suppression records — kept indefinitely, and deliberately so. Retaining the fact that you asked not to be contacted is the only way to guarantee we do not contact you again.

7. Your rights

Subject to the law that applies to you, you can ask us to give you a copy of your personal data, correct it, delete it, restrict how we use it, or object to our using it. You can also object to legitimate-interest processing at any time.

Email hello@outerstep.com and we will respond within one month. There is no charge.

8. Opting out

Every message we send carries an unsubscribe link. Replying to ask us to stop works just as well — you do not have to find the link.

An opt-out is platform-wide. It is not scoped to the exporter whose campaign reached you. Once you are suppressed, no exporter using Outerstep can reach you through us, for any product, because the sending infrastructure is shared and so is the protection.

9. Security

Data is encrypted in transit and at rest. Credentials for connected mail accounts are encrypted with a separate key. Access is limited to staff who need it, and material actions are logged with the actor and a timestamp.

No system is perfectly secure. If a breach affects your data and the law requires us to tell you, we will.

10. International transfers

We operate from India and our providers operate in several countries, so personal data may be transferred across borders. Where it is, we rely on appropriate safeguards — including standard contractual clauses — to protect it.

11. Changes

We may update this notice. The version and effective date at the top of the page tell you which is current. If a change materially affects how we use your data, we will tell you rather than rely on you noticing.

12. Contact

Privacy questions, requests and complaints go to hello@outerstep.com. You also have the right to complain to your local data protection authority. For platform terms, see our terms of use.