Privacy Policy

1. Introduction

Outlyst ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use outlyst.io and related services.

2. Information We Collect

Information you provide:

• Account information: name, email address, profile photo (if signing in with Google/Apple/GitHub)
• Listing URLs and any data you submit for analysis
• Communications you send to us (support emails, feedback)

Information collected automatically:

• IP address, browser type, device information
• Pages visited, features used, time spent
• Cookies and similar tracking technologies (see Section 7)

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Service
• Generate AI-powered listing analyses, financial studies, and competitor reports
• Authenticate your account and prevent unauthorized access
• Send you transactional emails (welcome, report ready, account notifications)
• Respond to support requests and improve the Service
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

4. Legal Basis for Processing

We process your information under the following legal bases: (a) performance of our contract with you, (b) your consent, (c) our legitimate interests in operating and improving the Service, and (d) compliance with legal obligations under UAE law.

5. How We Share Your Information

We do not sell your personal information. We share your data only with:

• Supabase — authentication, database, and storage
• Anthropic (Claude API) — AI processing of listing data and rewrites
• Railway / Vercel — hosting infrastructure
• Resend / email providers — transactional email delivery
• PropertyFinder, DLD, and public real estate sources — to fetch publicly available listing and transaction data (we send queries, we do not share your personal info with them)
• Law enforcement — only when legally required

All third-party processors are bound by data processing agreements that require them to safeguard your information.

6. Data Retention

We retain your account information and saved reports for as long as your account is active. If you delete your account, we will permanently remove your personal data within 30 days, except where we are required to retain it for legal or regulatory reasons. Anonymized analytics data may be retained indefinitely.

7. Cookies and Tracking

We use essential cookies to keep you signed in and remember your preferences. We also use analytics tools (Google Analytics, Microsoft Clarity, PostHog) to understand how the Service is used and improve it. By signing in to Outlyst you consent to our use of cookies as described in this policy. You can control cookies at any time through your browser settings.

8. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Deletion — request deletion of your account and data at any time via your profile settings or by emailing [email protected]
• Portability — export your saved reports and account data
• Objection — object to certain processing activities
• Withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, contact [email protected]. We will respond within 30 days.

9. Account & Data Deletion

You can delete your Outlyst account and all associated data at any time:

• Sign in and visit your profile page
• Click "Delete my account" at the bottom of the page
• Or email [email protected] from the address associated with your account

Once deleted, your authentication credentials, profile, saved reports, and listing analyses are permanently removed from our active systems within 30 days.

10. Data Security

We implement industry-standard security measures including encryption in transit (HTTPS/TLS), encryption at rest, secure authentication, role-based access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. International Data Transfers

Outlyst is operated from the UAE, but our service providers may process data in other jurisdictions including the United States and the European Union. We rely on standard contractual clauses and equivalent safeguards to protect your data during international transfers.

12. Children's Privacy

Outlyst is not intended for users under 18. We do not knowingly collect personal data from children. If we learn that we have, we will delete it promptly.

13. Google API Services

If you sign in with Google, Outlyst's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the minimum scopes necessary (email, name, profile picture) to identify you and personalize your account.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the Service. The "Last updated" date at the top of this page indicates when the Policy was last revised.

15. Contact Us

For privacy questions, data requests, or complaints, email [email protected].