Privacy Policy

Depending on your use of OutlierDeck, we may collect:

• name and business contact information;
• organization, brand and job title;
• account and authentication information, including JWT tokens and login credentials;
• platform activity and usage information;
• tracked keywords, hashtags, search queries and monitoring configurations;
• brand and campaign configurations created within the platform;
• information uploaded by customers, including briefs and reference materials;
• technical and security information, including IP address, browser type and device information;
• approximate location derived from IP address;
• communications with OutlierDeck support and account administration;
• data from social media accounts you choose to connect, as described in section 3;
• billing and account administration information.

The OutlierDeck app keeps a sign-in token in your browser’s storage so you stay logged in. Our website and app do not use advertising or third-party tracking cookies.

OutlierDeck analyses information obtained from:

• publicly available social media content and public posts;
• licensed data sources;
• third-party APIs and data providers;
• customer-authorized sources;
• information provided directly by customers.

Public availability does not automatically mean that information can be used for every purpose. OutlierDeck seeks to use information only where there is an appropriate lawful basis and legitimate business purpose, and only collects publicly accessible content rather than private or direct messages.

The only exception is social media accounts that you choose to connect. For those accounts alone, and only with your permission, OutlierDeck receives the account’s direct messages and the other data described in section 3.

You can connect social media accounts that you own or manage to OutlierDeck. This lets you read and answer messages, manage comments and publish content from one place.

We receive data from an account only after you sign in to that platform and grant access. An OutlierDeck administrator may also connect an account for a customer organisation, with the account owner’s permission. We request only the permissions needed for the features you use.

Facebook Pages and Instagram professional accounts. When you connect them through Meta, we receive:

• your Facebook Page’s ID and name, and the ID of any Instagram professional account linked to it;
• your Instagram account’s ID, username, name and profile picture;
• access tokens that let OutlierDeck act on the account at your request;
• messages sent to and from your Page or Instagram account through Messenger and Instagram Direct, including the sender’s account ID, username or name, and the time sent;
• posts on your Page or Instagram account, including captions, media links and engagement counts such as likes and comments;
• comments on your posts, including the commenter’s account ID, username and comment text;
• posts you create, schedule or publish through OutlierDeck.

We use each Meta permission for the following features:

• instagram_business_basic and pages_show_list — identify your Instagram account and list the Pages you can connect;
• instagram_business_manage_messages and pages_messaging — show your messages in the OutlierDeck inbox and send the replies you write;
• instagram_business_manage_comments and pages_read_engagement — show comments and engagement on your posts, and reply to, hide or delete comments when you choose to;
• instagram_business_content_publish and pages_manage_posts — publish or schedule the posts you create in OutlierDeck;
• pages_manage_metadata — subscribe your Page to updates so new messages and comments reach OutlierDeck;
• business_management — find the Pages and Instagram accounts your business owns, so you can choose which ones to connect.

YouTube. When you connect a YouTube channel through Google, we receive the channel’s ID, name and picture, access tokens, your videos and their statistics, and comments on your videos. We use this to show your channel’s performance and comments, upload the videos you publish through OutlierDeck, and post the comment replies you write.

OutlierDeck uses YouTube API Services. By connecting a channel you agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy.

X. When you connect an X account, we receive the account’s ID, username, name and picture, access tokens, your posts and their metrics, your direct messages, and your likes and followers. We use this to show your account’s activity, publish the posts you create and send the direct-message replies you write.

We use data from connected accounts only to provide the features you use:

• showing messages and comments in your OutlierDeck inbox;
• sending the replies and messages you or your team write;
• publishing and scheduling the content you create, including team review and approval before it is posted;
• replying to, hiding or deleting comments when you choose to;
• showing how your posts and accounts perform in your dashboards and reports;
• keeping the connection working and secure, and fixing problems you report.

OutlierDeck sends messages, replies and posts only when you or someone on your team asks it to. It does not send automatic replies.

We do not sell data from connected accounts. We do not use it for advertising, share it with data brokers, or use it to train AI models. We do not use it to build profiles of the people who message or comment on your accounts.

We use data from Facebook and Instagram only as allowed by the Meta Platform Terms and Meta’s Developer Policies.

OutlierDeck’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We may use information to:

• provide and operate the OutlierDeck platform and dashboards;
• monitor public content and track keywords, hashtags and brands;
• generate narrative intelligence, sentiment analysis and analytical outputs;
• detect emerging trends, narrative shifts and outlier signals;
• produce reports, visualisations and exports (including PDF and presentation formats);
• provide customer support and respond to enquiries;
• maintain platform security and authentication;
• monitor and improve platform performance and reliability;
• detect fraud, misuse and unauthorised access;
• administer beta testing and onboarding;
• improve and develop our products and features;
• communicate with users about their accounts and the platform;
• comply with applicable law.

OutlierDeck uses artificial intelligence and machine-learning models to assist with content classification, sentiment scoring, summarisation, theme detection, trend identification, narrative-shift detection and report generation.

AI-generated outputs are probabilistic and may contain errors, omissions or uncertainty. Users should review AI-generated analysis before relying on it for significant business, communications, political, financial or operational decisions.

OutlierDeck seeks to minimise unnecessary collection of personal information.

The platform is designed for organisational and professional use — narrative monitoring, brand intelligence and public-affairs research — and is not designed to facilitate unlawful surveillance, individual psychological profiling, discrimination or exploitation of sensitive personal characteristics.

Where public content includes references to identifiable individuals, OutlierDeck processes such references only for aggregate analytical purposes and does not build individual behavioural profiles for targeting.

OutlierDeck is currently registered and operated in Canada and is initially conducting beta testing with users in the Caribbean.

Customer data may be processed and stored using cloud infrastructure providers located in Canada and the United States. Depending on the services used and the location of users or individuals whose information is processed, additional privacy or data-protection requirements may apply.

Our main database and file storage, including data from connected accounts, are hosted by Amazon Web Services in the United States.

OutlierDeck may therefore apply additional controls based on jurisdiction.

We may share information with trusted service providers that help us operate the platform, including hosting, cloud storage, security, authentication, analytics, email delivery and infrastructure providers.

These include Amazon Web Services for hosting, storage and AI processing, other AI model providers, and Google for email. They may use information only to provide their services to us.

When you send a message, reply to a comment or publish a post, we share that content with Meta, Google (YouTube) or X through their APIs. That is how it reaches the platform.

People in your OutlierDeck workspace can see connected-account messages, comments and drafts, according to the access your organisation gives them.

We do not sell customer data or publicly scraped content to third parties.

We may also disclose information where required by law or necessary to protect OutlierDeck, its users or others.

If OutlierDeck is merged, acquired or sold, information may transfer to the new owner, and this Privacy Policy will continue to apply to it.

We use reasonable administrative, technical and organisational safeguards designed to protect information against unauthorised access, loss, misuse or disclosure, including encrypted authentication (JWT), role-based access controls, and isolated per-tenant data where applicable.

Our database is encrypted at rest, and information travels over encrypted HTTPS connections. Access tokens for connected accounts are kept in that encrypted database, and access to them is limited to the systems and staff that need them.

We retain information only for as long as reasonably necessary for the purposes for which it was collected, including legitimate business, contractual, security and legal requirements.

Operational and analytical logs are retained on a rolling basis with automatic expiry, while customer account data is retained for the life of the account and deleted or anonymised on request, subject to legal and contractual obligations.

Data from a connected account is kept while the account stays connected. When you disconnect it in OutlierDeck, we immediately delete its access tokens and the messages, posts and comments we received from it. Copies in our encrypted database backups are removed as those backups expire.

Posts you created in OutlierDeck stay in your workspace until you ask us to delete them or close your account. Disconnecting an account does not remove public content collected under section 2.

You can delete the data OutlierDeck holds about you or your connected accounts in any of these ways:

• In the app: sign in at app.outlierdeck.com, open Integrations and choose Disconnect on the account. This immediately deletes its access tokens and the messages, posts and comments we received from it.
• By email: write to privacy@outlierdeck.com with the subject “Data deletion request”. Include your OutlierDeck email address and the Page or account username. We will delete the data and confirm by email within 30 days.
• From Facebook: go to Settings & privacy → Settings → Business integrations (or Apps and websites) and remove OutlierDeck.
• From Instagram: go to Settings → Website permissions → Apps and websites and remove OutlierDeck.
• From Google: remove OutlierDeck on the Google security settings page.
• From X: go to Settings → Security and account access → Apps and sessions → Connected apps and revoke OutlierDeck.

Removing OutlierDeck on Facebook, Instagram, Google or X stops our access straight away. To also delete the data we already hold, disconnect the account in OutlierDeck or email us.

If an OutlierDeck administrator connected the account for you, email privacy@outlierdeck.com and we will disconnect it and delete its data.

If you messaged or commented on an account that uses OutlierDeck and want that data deleted, email privacy@outlierdeck.com with your username and the account you contacted. You can also contact that business directly.

To close your OutlierDeck account and delete all of its data, email privacy@outlierdeck.com. We will delete it within 30 days, except records we must keep by law.

Depending on applicable law, you may have rights relating to access, correction, deletion, objection, withdrawal of consent or other controls over your personal information.

Privacy requests may be submitted to privacy@outlierdeck.com.

You can withdraw consent for a connected account at any time by disconnecting it. To delete data, see section 12.

If you have a concern we have not resolved, you can complain to the Office of the Privacy Commissioner of Canada.

OutlierDeck is intended for professional and organisational users and is not directed toward children.

We do not knowingly create profiles of children for advertising, political targeting or behavioural purposes.

OutlierDeck accounts are not intended for anyone under 16.

We may update this Privacy Policy as the OutlierDeck platform develops and as applicable legal requirements evolve.

We will post updates on this page and change the “Last updated” date. For significant changes, we will notify account holders by email.

Privacy Officer

OutlierDeck Inc.

Toronto, Ontario, Canada

privacy@outlierdeck.com