Privacy Policy

Last updated: January 29, 2026

Contact: [email protected]

This Privacy Policy explains how Outbox Labs collects, uses, discloses, and protects information in connection with VisitorIQ and our website (https://visitoriq.co) (collectively, the "Services"). This policy applies to (1) visitors to our website and (2) individuals whose information is processed when a Customer deploys our script on their websites, including website visitors who may be identified or associated with a visit.

1. Key definitions

"Customer" means an organization that uses the Services. "Customer Data" means information processed on behalf of a Customer, including website interaction data and enrichment data. "Personal Data" means information that identifies or relates to an identifiable individual.

2. Roles: controller vs. processor

When we process Customer Data on behalf of a Customer, the Customer is typically the "controller" (or "business") and we act as a "processor" (or "service provider"). For our own website operations, we are the controller.

3. Information we collect

A) Information you provide (website/account).

Account information (name, business email, password hash), billing details (handled by payment processors), support requests, and communications.

B) Automatically collected data (website).

Device and usage data such as IP address, browser type, pages viewed, referring URLs, and cookies or similar technologies.

C) Customer Data processed through the script.

When a Customer installs our script, we may collect and process:

  • Event data (page views, clicks, timestamps, UTM parameters, forms started/submitted where configured by the Customer).
  • Technical identifiers (IP address, user agent, device characteristics, cookie IDs or similar identifiers).
  • Visitor/lead information associated with a visit (which may include individual contact details and/or company/organization attributes), derived from first-party signals and third-party data sources.

We do not knowingly collect personal data from children under 13 (or older where required by law). Customers must not deploy the Services on child-directed sites.

4. How we use information

We use information to:

  • Provide, operate, secure, and improve the Services (including fraud prevention, debugging, and performance monitoring).
  • Identify and enrich website visits to help Customers understand buyer intent and prioritize outreach.
  • Respond to support requests and communicate about the Services.
  • Comply with legal obligations and enforce our agreements.

5. Legal bases (where applicable)

Where laws such as GDPR/UK GDPR apply, we rely on applicable legal bases such as performance of a contract, legitimate interests (e.g., security and service improvement), and consent where required for cookies or tracking. Customers are responsible for establishing and documenting their lawful basis for processing and contacting individuals.

6. How we share information

We may share information with:

  • Service providers and subprocessors that help us operate the Services (e.g., hosting, analytics, security, customer support, payment processing).
  • Third-party data providers used to enrich or associate visits with individuals or organizations (as configured in the Services).
  • Professional advisors (lawyers, auditors) and authorities where required by law.
  • A successor entity in connection with a merger, acquisition, or sale of assets (subject to appropriate safeguards).

We do not sell personal information in the traditional sense. If a law defines "sale" or "share" broadly (e.g., for cross-context behavioral advertising), our handling will depend on your configuration and notices/consent where required.

7. International transfers

We may process and store information in the United States and other countries where we or our providers operate. Where required, we use appropriate safeguards for international transfers (e.g., standard contractual clauses).

8. Data retention (3 months)

We retain Customer Data for up to 3 months by default. Retention may be shorter if a Customer deletes data earlier, or longer where necessary for security, dispute resolution, backups, legal compliance, or to provide the Services.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect information. However, no security measure is perfect and we cannot guarantee absolute security.

10. Your choices and rights

A) Customers (account owners).

Customers may access, export, correct, or delete Customer Data through the Services, subject to account permissions and legal constraints.

B) Individuals whose data may be processed.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict/opt-out, or object to processing. We generally handle these requests via the relevant Customer (the controller). To submit a request, contact us at [email protected] and we will route it appropriately.

Marketing opt-out: If you receive outreach from a Customer, follow the opt-out instructions in that message. We do not control Customers' communications.

11. Cookies and tracking

We use cookies and similar technologies for essential site functions, security, analytics, and (where enabled) to support the visitor identification features. See the Cookie Policy for details and controls.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date reflects the effective date.

13. Contact

For questions, requests, or complaints, contact [email protected].

If you are in the EEA/UK and need our EU/UK representative details or DPA terms, contact[email protected].