Privacy Policy

Last updated: July 15, 2026

Introduction

Outstand ("we," "our," or "us") operates the social media scheduling and publishing platform at outstand.one. We are committed to protecting your personal data and being transparent about how we handle it. This Privacy Policy describes what data we collect, why we collect it, how we use it, and the rights you have over your information.

Information We Collect

Account & Profile Data

When you register, we collect your name, email address, and any profile information you provide. This is necessary to create and manage your account.

Billing Information

Payments are processed by Stripe. We do not store your full card details — Stripe handles all payment data under their own PCI-DSS certified infrastructure. We retain billing records (invoice amounts, dates, plan details) to comply with accounting and tax obligations.

Social Media Account Credentials

To publish on your behalf, we store encrypted OAuth tokens for each social media account you connect (Facebook, Instagram, LinkedIn, Threads, Bluesky, Pinterest, and others). These tokens are encrypted at rest and used solely to deliver your scheduled content to those platforms.

Content You Schedule

We temporarily process the posts, images, and videos you create or upload through our platform in order to deliver them to the appropriate social networks at the scheduled time. Media files are stored in Cloudflare R2 and associated with your workspace. You can delete your media from the media library at any time.

Usage & API Data

We collect logs of API requests, feature usage, session activity, error events, and performance metrics. This data is used for billing calculation, security monitoring, and improving the service.

Device & Browser Data

When you visit outstand.one, we automatically collect your IP address, browser type, operating system, pages visited, and referring URLs. This is used for security, fraud prevention, and aggregate analytics.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data on the following grounds:

  • Contractual necessity — to provide the services you signed up for
  • Legitimate interests — for security, fraud prevention, and service improvement, where these do not override your rights
  • Legal obligation — where required by law (e.g., tax and accounting records)
  • Consent — for optional communications and non-essential cookies, which you may withdraw at any time

How We Use Your Information

  • To create and manage your account and workspace
  • To schedule and publish your content to connected social media platforms
  • To calculate and process usage-based billing
  • To provide customer support and respond to inquiries
  • To detect and prevent fraud, abuse, and security incidents
  • To improve the platform and develop new features
  • To send transactional emails (account alerts, billing receipts, security notices)
  • To comply with legal and regulatory requirements

Cookies & Tracking

We use cookies and similar technologies for authentication, session management, security, and aggregate analytics. You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the service.

Data Sharing & Disclosure

We do not sell or rent your personal data. We may share your information with:

  • Infrastructure providers — Cloudflare (hosting, R2 storage), Supabase (database), and Stripe (payments), all under data processing agreements
  • Social media platforms — to deliver your scheduled content as instructed
  • Legal authorities — when required by law, court order, or to protect the safety of our users or the public
  • Business transfers — in connection with a merger or acquisition, with prior notice to you

International Data Transfers

Your data may be processed in countries outside your own, including the United States, where our infrastructure providers operate. We ensure appropriate safeguards (such as Standard Contractual Clauses) are in place for any transfers outside the EEA.

Data Security

We implement industry-standard security measures including TLS/SSL encryption for all data in transit, encryption at rest for sensitive credentials, access controls, and regular security reviews. However, no system is completely immune to risk. In the event of a data breach that affects your rights and freedoms, we will notify you and applicable authorities as required by law.

Data Retention

  • Account data — retained while your account is active, plus 90 days after deletion for recovery purposes
  • Media files — stored until you delete them or your account is closed
  • Usage logs & API data — up to 2 years for billing and analytics
  • Billing records — 7 years to comply with financial regulations

Your Rights

Depending on your location, you may have the right to:

  • Access — request a copy of your personal data
  • Rectification — correct inaccurate or incomplete data
  • Erasure — request deletion of your data under certain conditions
  • Portability — receive your data in a machine-readable format
  • Object or restrict — limit how we process your data in certain circumstances
  • Withdraw consent — at any time, where processing is based on consent

To exercise these rights, contact us at support@outstand.one. We will respond within 30 days.

Children's Privacy

Our service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their information, please contact us immediately and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on our platform at least 14 days before changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

Contact Us

If you have questions or requests about this Privacy Policy, please contact us:

Email: support@outstand.one
Website: outstand.one