Privacy Policy

Effective Date: 31st August 2026

This policy explains what personal data Outmail collects, why, who we share it with, and the rights you have over it. It is written to meet India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

It covers two different groups of people, and their rights are not the same:

  • Students who create an Outmail account and use the service.
  • Recruiters and hiring contacts whose business contact details are held in Outmail so that students can write to them. If you received an email sent through Outmail and want to know why, or want us to stop, go straight to section 6.

1. Who we are

Outmail is operated by PrimeWork Labs LLP, a limited liability partnership registered in India. For the purposes of the DPDP Act, PrimeWork Labs LLP is the Data Fiduciary.

LLPIN: ADB-2168

Registered address: 1/400, UIT, Bhiwadi, Alwar, Rajasthan 301019, India

General contact: support@outmail.in

Phone: +91 63751 19988

2. How Outmail works, in plain terms

You cannot judge a privacy policy without knowing what the product does, so here is the mechanism:

  • You upload your resume. We read it to understand your skills and experience, and to write emails in your name.
  • We hold a pool of recruiter and hiring-team business email addresses, which we source and verify ourselves.
  • Each week we choose companies and contacts that fit your profile, and draft personalised emails.
  • The emails are sent from your own Gmail account, by you, using our desktop application. They are not sent from Outmail’s servers and do not come from an Outmail address. You are the sender.
  • We record which emails were sent so you can see your own history and so we do not contact the same person twice.

3. Your Gmail credentials never reach our servers

This is the most sensitive part of the product and we want to be exact about it.

To send email as you, our desktop application needs a Gmail app password — a credential you generate in your own Google account and can revoke at any time.

That password is stored only in your computer’s own operating-system keychain. It is never transmitted to Outmail, never stored on our servers, and never visible to our staff. Our servers receive only the outcome of a send — whether it succeeded, and when.

Revoking the app password in your Google account immediately and permanently stops Outmail from being able to send anything.

4. What we collect about students, and why

DataWhyLawful basis
Name, email address and profile photo from Google Sign-InTo create and secure your accountYou gave it to us to open the account
Your resume, and the skills, education and experience we extract from itTo match you to companies and to write emails in your nameYour consent, given when you upload it
Profile details you add — phone, LinkedIn, GitHub, portfolio, location, job preferencesTo improve matching and to include in your outreach where relevantYour consent
A record of every email sent on your behalf — recipient, subject, body, time, outcomeSo you can see your history, and so the same recruiter is not contacted twiceYou gave it to us for this purpose
Saved answers you store for the Autofill extensionTo fill application forms on your instructionYour consent
Payment records — plan, amount, date, Razorpay referenceTo give you access, issue receipts and meet accounting obligationsRequired of us by law
Technical data — IP address, browser and device type, session tokensTo keep your account secure and to detect abuseNecessary to provide the service you asked for

We do not collect financial account details. Card and UPI details are entered directly with Razorpay and never reach us.

On lawful grounds: the DPDP Act allows personal data to be processed with your consent, or where you have voluntarily provided it for a specified purpose and have not withdrawn it, or where the law requires us to keep it. The right-hand column above says which applies. Where we rely on consent you may withdraw it at any time — see section 9.

5. Automated processing and AI

Outmail uses Google’s Gemini models to read your resume, to score how well a job matches your profile, and to draft the text of outreach emails. Your resume content and profile are sent to that service for those purposes.

Nothing is sent without your approval unless you switch approval off yourself. By default you review and approve your weekly plan before anything is sent. You can enable automatic sending, and you can turn it off again at any time.

No decision with a legal or similarly significant effect on you is made solely by automated means. Matching and drafting are suggestions; you decide whether to send.

6. Recruiter and hiring-contact data

If you are a recruiter and received an email through Outmail, this section is for you.

What we hold. Business contact details only: work email address, name where known, job title, employer, and whether previous messages were delivered or bounced. We do not hold personal addresses, personal phone numbers or any special category data about recruiters.

Where it comes from. We obtain business contact details from a mix of sources:

  • Publicly available sources — company careers and contact pages, job advertisements, and public professional profiles such as LinkedIn.
  • Commercial contact-data providers, such as Apollo and Hunter, which compile and license business contact information.
  • Recruiting and hiring contact lists circulated publicly — for example, lists of hiring contacts published or shared openly by people in the recruiting and careers community.

These lists largely gather together addresses that are already published elsewhere — a careers page, a job advertisement, a public profile. We are not able to verify that for every individual entry, and we do not claim to. Where an address is one we could not trace to a public source, the commitments below still apply in full.

We check every address with a deliverability verification service before it is used, and discard the ones that fail.

We will tell you where your specific address came from. Some of our sources compile data rather than publish it, and in those cases we may not be able to identify an original publication. If you ask, we will tell you what we know about the origin of your record, honestly, including where the only answer we have is the name of the provider we obtained it from.

Why we hold it. To let a job-seeking student send you a relevant, individually written application for a role you are hiring for. That is the only use. We do not sell, license, publish or share recruiter contact data with anyone, and our Terms forbid students from extracting it.

The commitments we make, regardless of what the law requires. We are aware that not every source above is one you personally chose to publish. We do not treat that as a technicality to hide behind. So:

  • we hold business contact details only — work email, name, job title and employer. Never a personal address, personal phone number, or anything about your private life;
  • we honour every right in section 9 — access, correction, erasure and grievance redressal — for recruiters exactly as we do for our own account holders, and we do not ask you to prove the Act obliges us;
  • one message stops it permanently, across every user, forever — see below;
  • we cap how many students may contact any one recruiter in a week, and no student may contact the same recruiter twice.

Who actually emailed you. The email came from the student’s own Gmail account. Outmail helped them find you and draft it. The student is the sender; replying goes to them, not to us.

The limits we place on ourselves. A given recruiter is contacted by only a small number of students in any week, and never twice by the same student. Every message carries an unsubscribe link.

To stop receiving these emails

Use the unsubscribe link in any message you received. It works immediately and needs no account or reply. You can also email support@outmail.in and we will remove you and confirm.

Once removed, your address is added to a permanent suppression list so that no student using Outmail can contact you again. We keep only the minimum needed to enforce that.

To exercise any of those rights, email support@outmail.in. You do not need an Outmail account, and there is no charge. If you are not satisfied with our response, our Grievance Officer is named in section 10.

7. Who we share data with

We do not sell personal data, and we do not share it for advertising. We use the following processors, each only for the purpose shown:

ServicePurposeData involved
Google (Sign-In, Gemini)Authentication; resume parsing, matching and email draftingAccount identity; resume and profile content
RazorpayPayment processingName, email, payment amount and reference
Amazon Web Services (S3)Resume file storageYour uploaded resume
NeonDatabase hostingAll account and application data
Render, VercelApplication and website hostingData in transit and in use
ResendTransactional email from Outmail to youYour name and email address
MillionVerifierChecking that a recruiter address is deliverableRecruiter business email addresses only
Adzuna and other job sourcesSourcing job openingsNo personal data is sent
Upstash (QStash)Scheduling background workInternal job identifiers
SentryError monitoringTechnical diagnostics; configured to redact personal data

We may also disclose data where we are legally required to, or to establish or defend a legal claim.

8. Where data is stored, and for how long

Our primary database is hosted in Singapore, and some processors listed above operate outside India. Transfers are made only to countries not restricted by the Central Government under section 16 of the DPDP Act, and are covered by contractual protections with each processor.

  • Your resume and profile — kept while your account is open. Deleted within 30 days of you deleting your account or asking us to remove them.
  • Your outreach history — kept while your account is open, so you can see what you sent and we can avoid repeat contacts.
  • Payment records — kept for eight years, as required by Indian accounting and tax law. This is the one category we cannot delete on request.
  • Unsubscribe records — kept indefinitely, in minimal form. If we deleted these we would be unable to keep honouring the unsubscribe.
  • Technical logs — up to 30 days.

9. Your rights

Under the DPDP Act you have the right to:

  • Ask what personal data we hold about you and get a copy of it.
  • Have inaccurate or incomplete data corrected or completed.
  • Have your data erased, except where we must keep it by law — see the retention table above.
  • Withdraw consent at any time, as easily as you gave it. Withdrawing consent for us to use your resume means we can no longer generate outreach for you.
  • Nominate someone to exercise your rights if you die or become incapacitated.
  • Raise a grievance with us, and escalate it — see section 10.

To exercise any of these, email support@outmail.in from the address on your account. We will respond within 30 days. There is no charge.

10. Grievance Officer

If you are unhappy with how we have handled your data or your request, contact our Grievance Officer:

Vishu Tomer

Designated Partner, PrimeWork Labs LLP

Email: admin@outmail.in

Phone: +91 63751 19988

1/400, UIT, Bhiwadi, Alwar, Rajasthan 301019, India

We acknowledge grievances within 48 hours and aim to resolve them within 30 days. If you remain dissatisfied, you may complain to the Data Protection Board of India.

11. Security

  • All traffic to and from Outmail is encrypted with TLS.
  • Data is encrypted at rest by our database and file-storage providers.
  • Access to production data is limited to those who need it, and secrets are held in managed secret storage rather than in code.
  • Your Gmail app password is not part of any of this, because we never hold it — see section 3.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the DPDP Act requires.

12. Age requirement

Outmail is only for people aged 18 or over. We do not knowingly collect data about children. If we learn that an account belongs to someone under 18 we will close it and delete the associated data.

13. Cookies

We use cookies and similar storage only to keep you signed in and to keep your session secure. We do not use advertising or cross-site tracking cookies, and we do not run third-party advertising trackers. Blocking these cookies will prevent you from staying signed in.

14. Changes to this policy

We may update this policy. The version in force is the one published here on the date you use the service. If a change materially affects your rights we will tell you by email before it takes effect.

15. Contact

Privacy questions and rights requests: support@outmail.in

Grievances: admin@outmail.in (Vishu Tomer, Grievance Officer)

See also our Terms and Conditions and Refund and Cancellation Policy.