Privacy Policy

What we collect

Getty Point, LLC, operating Outerpath, collects account identifiers, company profile information, subscription and service status, support messages and live-chat conversations you choose to submit, managed buyer-research inquiries, early-access experiment requests, and the buyer-path records you choose to save. An early-access request includes the work email, company name, optional website and optional business-development challenge you submit, plus sanitized campaign parameters when present. Payment card details are handled by Stripe and are not stored by Outerpath.

How we use information

We use information to authenticate users, operate and secure the service, provide requested research and analysis, administer subscriptions, respond to support requests, and improve product workflows. We do not sell personal information.

Service providers

We use service providers including Supabase for authentication and database services, Vercel for hosting and limited public-page analytics, Stripe for billing, OpenAI for explicitly requested AI analysis, Resend for support email, Tawk.to for visitor-initiated public-page chat, PostHog for cookieless public-site analytics and—only with consent—a separate product-analytics project, and Google Analytics only with consent. Public acquisition searches may send the search parameters you submit to SAM.gov and USAspending. When you explicitly upload a capability statement for extraction, its text is sent to OpenAI to create a private, reviewable Company Intelligence draft. When you use Ask Outerpath, a bounded set of records from the selected Path and recent Path-scoped conversation is sent to OpenAI to answer your question.

Public-page chat

Outerpath uses Tawk.to to offer live or offline chat on approved public marketing, pricing, research, video, and LinkedIn pages. It does not run on the separate public AI Advisor experiment or on login, onboarding, account, billing, Companies, Workbench, or Buyer Path pages. Outerpath does not provide Tawk.to with authenticated account identity, company intelligence, Buyer Path content, research terms, notes, or contacts.

If you choose to start a chat, Tawk.to may process the conversation and information you provide, along with technical information needed to deliver the service, such as network address, browser and device information, page context, cookies, and local or session storage. The widget presents Tawk.to's configured consent form before chat storage is enabled. Do not submit classified information, controlled unclassified information, proprietary customer information, or other sensitive material through public chat.

Tawk.to stores service data in the United States and uses a global content-delivery network. Chat records remain available to Outerpath in the provider dashboard until they are deleted or a deletion request is completed, subject to applicable legal and provider requirements. Public chat is operationally separate from Outerpath's PostHog, Google Analytics, Supabase identity, and authenticated product records.

Public-page analytics

Outerpath uses Vercel Web Analytics and a separate PostHog public-web project on the homepage, pricing, the LinkedIn and AI BD experiment landing pages, curated Federal Buyer Research pages, and public video pages. These services help us understand page traffic, exits, time and meaningful engagement, navigation between those public pages, coarse scroll depth, and engagement with calls to action and product demonstrations. They do not run on login, onboarding, account, billing, Companies, Workbench, or Buyer Path pages.

The public PostHog project operates in cookieless mode and does not store a PostHog identifier in cookies, local storage, or session storage. PostHog calculates a temporary privacy-preserving value on its servers to associate events within a limited browsing period; it is not used to recognize a browser persistently across later visits. The public project does not call identify() or alias(), create person profiles, use session replay, capture keystrokes or forms, or connect public activity to an account, company, Buyer Path, the consented product-analytics project, Google Analytics, or Supabase identity.

Public event properties are limited to a sanitized approved route, coarse event type or placement, duration or scroll threshold, and bounded sanitized campaign values present on that visit. The AI BD experiment may also record its fixed landing variant, coarse mobile/desktop class, and controlled lifecycle outcomes. Fragments, advertising click identifiers, arbitrary query values, names, email addresses, account or company identifiers, company intelligence, Buyer Path content, questions, responses, search terms, notes, contacts, and other form contents are excluded. PostHog and Vercel necessarily receive a network request and may process an IP address and user agent to provide the service, but Outerpath does not intentionally place those values in stored event properties.

Vercel's visitor hash rotates after 24 hours. You can stop future public PostHog collection using Analytics preferences; Outerpath also treats an enabled Global Privacy Control signal as an opt-out from public PostHog. Vercel's limited cookieless measurement operates separately. PostHog Cloud currently retains public-site events for one year under Outerpath's free plan; this provider-controlled period must be reviewed before any plan change. Cookieless measurement cannot reliably recognize returning visitors across separate browsing periods or connect a campaign visit to a later account. Browser blocking, missing referrers and automated-traffic classification mean these reports are estimates and not proof of a unique human visitor.

Public AI Advisor experiment

You may use the public AI Advisor without an account. Outerpath sends the current question and a bounded portion of the same public conversation to OpenAI to generate a response. The public Advisor cannot access an account, company workspace, Buyer Path, private records, authenticated tools, or live acquisition research. Responses are AI-generated guidance and may be incomplete or wrong.

Outerpath stores the conversation encrypted at rest in a private, service-only research store for up to 30 days so the conversation can continue in the same browser session and an authorized administrator can review it for product research, safety, quality, and abuse prevention. We also store bounded, evidence-supported research classifications, sanitized campaign fields, controlled CTA outcomes, provider/model usage, cost, latency, status, and error codes. Public analytics receives only controlled lifecycle events and sanitized campaign context; it never receives the question, response, classification, network address, session token, or identity. The public conversation is not joined to a later account. You can delete the conversation from the page or request deletion through Support.

Federal Buyer Discovery pilot

The controlled public Federal Buyer Discovery pilot accepts a public company website, an uploaded PDF capability statement, or a short description of the work you want to pursue. For a website request, Outerpath retrieves the public page from the supplied host. For a PDF request, Outerpath extracts text in server memory. Outerpath sends a bounded portion of the extracted text and the optional work description to OpenAI for one structured interpretation of documented capabilities, user-declared focus, possible adjacent capabilities, exclusions, and acquisition search terms. The source website content, PDF, and full extracted text are not retained, sent to public analytics, or added to a workspace.

Only the resulting bounded acquisition terms and filters—not the company URL, PDF, full document text, or company name—are sent to SAM.gov and USAspending. When the database-backed pilot is enabled, Supabase temporarily stores the resulting public-record recommendations, the stated research focus, the bounded interpretation and search-plan trace, coverage and operational status, and salted one-way hashes of the anonymous session token and request network address. An authorized operator may review those temporary results and operational fields for quality and reliability. Results expire after two hours and are operationally separate from customer workspaces.

Public PostHog receives only controlled lifecycle events, input method, approved placement, sanitized route, and bounded campaign code. It does not receive the submitted website, PDF, document text, work description, interpreted capabilities, search terms, recommendation organization, acquisition identifiers, result identifier, session token, or network hash. PostHog's separate public-web project may associate those coarse events only within its limited cookieless measurement period; it is not joined to an Outerpath account. Vercel, OpenAI, Supabase, PostHog, SAM.gov, USAspending, and the submitted website host may process network and request data needed to provide their respective services.

Managed buyer-research and early-access inquiries

You can submit either inquiry without creating an account. We use managed-research information to assess and administer that requested service. Existing AI BD early-access records remain private historical experiment records; the public Advisor does not add a person to that waitlist. Public analytics receives only coarse experiment, device, campaign, success or controlled error properties—not email, company, website, or other form contents. Submission does not create an account, Buyer Path, subscription, monitoring configuration, product access, or payment.

Optional product analytics and attribution

Google Analytics and PostHog are disabled until you consent. When enabled, they may process page views, browser and device information, approximate location derived from network information, campaign parameters, referring and landing pages, advertising click identifiers such as Google's gclid, and a small set of product-activation events. Consented campaign attribution is retained in your browser and associated with your account after you authenticate so we can understand which campaigns lead to workspace and Buyer Path creation. We do not intentionally send email addresses, prompts, notes, contacts, company details, search text, or Buyer Path content to either service. PostHog autocapture and session replay are disabled. Attribution is browser-dependent and may not connect visits made on different devices or browsers. Signing out resets the PostHog identity on that browser. You can grant or withdraw optional analytics consent using Analytics preferences in the footer or authenticated Account settings. Withdrawal stops future optional capture on that browser but does not automatically delete data collected earlier. Declining does not prevent use of Outerpath.

Sharing and disclosure

We disclose information to service providers as needed to operate Outerpath, when you direct us to, or when required to protect users, the service, or comply with law. A company’s basic public listing is limited to information described in the product; private workspace records are not intended for public display.

Security and retention

We use authentication, organization-scoped access controls, database row-level security, and application encryption for the public Advisor transcript store. Capability-statement files and full extracted text are processed transiently and are not retained by Outerpath; the private draft claims, limited source metadata, and review decisions are retained with the workspace. Authenticated Ask Outerpath conversations are retained for up to 180 days; separate public Advisor conversations are retained for up to 30 days. Neither transcript is sent to product analytics. No system is perfectly secure. Retention and deletion practices are described in our Data Retention and Account Deletion policy.

Contact

Questions or privacy requests can be submitted through Outerpath Support or emailed to support@outerpath.ai.