Privacy Policy.

The data controller (POPIA: Responsible Party) for personal information collected directly from Service users is:

Hustlery LLC
20 Hotel Street, Pretoria 0083, South Africa
Email: privacy@hustlery.co.za
Information Officer: Tyron Williams, tyron@hustlery.co.za

For personal information of prospects (third parties whom our customers contact through their own outbound campaigns), the customer is the controller / Responsible Party and OUTPOST acts as a processor / Operator. The customer’s own privacy notice applies to those data subjects.

From Service users (you)

• Account data: name, email, company, authentication metadata, role.
• Billing data: billing name, address, VAT/tax ID, payment method tokens (we do not store full card numbers; this is handled by Stripe).
• Usage data: pages viewed, features used, log timestamps, IP address, user agent, device type, referrer.
• Communications: support tickets, emails, chat messages, voice recordings and transcripts from voice onboarding sessions.
• Integration credentials: encrypted API keys for Smartlead, Zapmail, Prospeo, Slack and similar tools you voluntarily connect.

From your customer data (prospects)

You may upload, import via integration, or otherwise direct OUTPOST to process personal information about your prospects, including names, business email addresses, job titles, company information, and reply content. You, not OUTPOST, are responsible for ensuring you have a lawful basis to process this data.

Automatic data

Server logs, error reports, performance telemetry, and cookies (see Section 11).

• To provide, operate, and improve the Service.
• To authenticate you, secure your account, and prevent abuse.
• To bill you and process payments.
• To send transactional, security, and service-related communications.
• To respond to your support requests and to investigate problems.
• To comply with legal obligations, enforce our Terms of Service, and defend our legal rights.
• To improve our AI models (in aggregated, de-identified form only) unless you opt out.

Where the GDPR or UK GDPR applies, we rely on the following bases:

• Contract (Art. 6(1)(b)): to deliver the Service you have signed up for.
• Legitimate interests (Art. 6(1)(f)): to operate, secure, and improve the Service; to communicate with you about your account; to defend our legal rights. We have weighed these against your interests and rights.
• Legal obligation (Art. 6(1)(c)): to comply with tax, accounting, anti-fraud, and other regulatory requirements.
• Consent (Art. 6(1)(a)): where we ask for it (e.g. optional marketing emails). You can withdraw consent at any time.

In accordance with Section 18 of the South African Protection of Personal Information Act:

• Responsible Party: Hustlery LLC, 20 Hotel Street, Pretoria, South Africa.
• Source of information: directly from you, or, where applicable, from third-party integrations you authorize.
• Purpose: as set out in Section 03.
• Voluntariness: provision of personal information is voluntary, but is required to use the Service. Failure to provide it means we cannot create or maintain your account.
• Authorising laws: POPIA, and applicable foreign laws under which we operate.
• Recipients: our sub-processors (Section 06) and any party to whom you direct us to transmit data.
• Cross-border transfers: we may transfer personal information outside South Africa under Section 72 safeguards (binding contractual obligations on the recipient).
• Your rights: see Section 09.

Complaints may be submitted to the South African Information Regulator at inforegulator.org.za.

We share personal information only with vetted sub-processors that help us deliver the Service. Each is bound by a written data-processing agreement, confidentiality obligations, and security requirements at least as protective as those in this Policy.

• Vercel Inc.: web hosting and edge infrastructure (United States).
• Supabase Inc.: database, authentication, file storage (EU and US regions).
• Anthropic PBC: large language model inference for AI features (United States). Inputs are not used by Anthropic to train its models per its API terms.
• Stripe Inc.: payment processing (United States).
• Smartlead, Zapmail, Prospeo, Slack . optional integrations you choose to connect. You are responsible for reviewing their privacy practices.
• Cloudflare Inc.: DNS and DDoS protection.

We may also disclose personal information (a) to comply with a lawful subpoena, court order, or other legal process; (b) to enforce our Terms or protect our rights; (c) in connection with a merger, acquisition, or sale of all or part of our business, subject to confidentiality undertakings.

We do not sell personal information.We do not engage in “sharing” for cross-context behavioral advertising as defined by the CCPA / CPRA.

Because Hustlery operates from South Africa and our sub-processors operate primarily from the United States and the European Union, personal information may be transferred across borders. We rely on the following safeguards:

• EU Standard Contractual Clauses (2021) for transfers from the EU/UK to third countries.
• UK International Data Transfer Addendum where the UK GDPR applies.
• POPIA Section 72 binding obligations for transfers out of South Africa.
• Supplementary measures including encryption in transit and at rest, and access controls.

• Account and billing data: kept while your account is active and for seven (7) years after closure for tax and accounting purposes.
• Service usage logs: up to 18 months.
• Voice recordings and transcripts: kept for the lifetime of the relevant ICP/campaign brief, deletable on request.
• Customer prospect data: retained for the duration of your subscription and deleted within ninety (90) days of termination, except where retention is required by law.
• Backups: rotated and overwritten on a rolling basis up to 90 days.

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information (subject to legal retention).
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority (the SA Information Regulator, your local EU/UK Data Protection Authority, or the California Attorney General).

To exercise any of these rights, email privacy@hustlery.co.za. We will respond within thirty (30) days, or such shorter period as required by applicable law. We may need to verify your identity before responding.

California (CCPA / CPRA) specifics

California residents have the additional right to know what categories of personal information we have collected, sold (we do not sell), or disclosed for a business purpose in the past twelve (12) months. You may also designate an authorized agent. We do not discriminate against you for exercising these rights.

We use industry-standard administrative, technical, and physical safeguards: encryption in transit (TLS 1.2+) and at rest (AES-256), tenant-isolated database rows, role-based access control, multi-factor authentication, audit logging, and regular vulnerability scanning. No system is perfectly secure. You are responsible for keeping your account credentials confidential. Report suspected breaches to security@hustlery.co.za.

We use essential cookies to operate the Service (authentication, session, security) and limited analytics cookies to understand aggregate usage. We do not use third-party advertising cookies. You can disable non-essential cookies in your browser. Disabling essential cookies may prevent the Service from functioning.

The Service is offered to businesses and is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

We may update this Policy from time to time. Material changes will be notified by email to the address on your account, or by prominent notice on the Service, at least thirty (30) days before they take effect. The “Last updated” date at the top of this page tells you when this Policy was last revised.

If you are located in the EU/UK, you may also contact our EU/UK representative by email at the address above. If we cannot resolve your complaint, you may escalate to your local supervisory authority.