Privacy Policy

1. Who we are

OptOutHQ (“OptOutHQ,” “we,” “us”) provides a service that helps you opt out of junk mail, marketing email, robocall lists, and data-broker databases from one dashboard. This policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over it. It applies to optouthq.com and the OptOutHQ application.

2. What we collect

We collect only what an opt-out actually requires:

• Identity & contact data — your name, current and prior mailing addresses, email address(es), phone number(s), and year of birth. Data brokers index people by these fields, and removal requests fail without an exact match.
• Account data — the email and password (stored only as a salted hash) you use to sign in, and your subscription status.
• Opt-out records — the log of which removals we requested, when, and their outcome, including any evidence (confirmation pages, responses) we capture on your behalf.
• Forwarded email — when you forward mail to your unsubscribe alias, we process the message to perform the unsubscribe, then delete the message body (see retention below).
• Payment data — handled by our payment processor. We store a customer reference and subscription state; we never see or store your full card number.

We do not collect your Social Security number, and we do not request access to your email inbox. Where an opt-out legally requires an SSN (OptOutPrescreen), you enter it directly on the official government-authorized site — never with us.

3. How we use it

We use your information solely to provide the service: to submit and track opt-out and removal requests to the parties you ask us to, to operate your unsubscribe alias, to show you your removal log and evidence, to send renewal reminders and essential service emails, to process your subscription, and to keep the service secure. We do not use your personal data for advertising, and we do not build profiles of you for anyone.

4. The categories we never sell or share

We do not sell, rent, or share your personal information, in the technical sense of the California Consumer Privacy Act (as amended by the CPRA) or in any common-sense meaning of those words. This is a contractual commitment in our Terms of Service, not merely a policy we could quietly change. 100% of our revenue comes from subscriptions.

5. Who processes your data for us

We rely on a small set of service providers (“ subprocessors”), each bound to use your data only to provide their service to us:

• Vercel — hosting for this site and the application.
• Neon — our database. Sensitive fields are encrypted at the field level.
• Stripe — payment processing. Handles your card data directly.
• Resend — transactional email and your unsubscribe alias.
• Optery (or equivalent removal partner) — receives only the specific fields a given broker removal requires.

To act on your behalf, we disclose the minimum necessary fields to each opt-out target (a data broker, registry, or sender). Each such disclosure is logged and shown to you. We may also disclose information if required by law, to enforce our Terms, or to protect the rights and safety of our users.

6. How long we keep it

• Account profile (name, addresses, phone numbers): for the life of your account, deleted within 30 days after closure.
• Forwarded email bodies: parsed and then deleted within 7 days; the sender and the action taken are retained as your opt-out log.
• Opt-out evidence (confirmations, responses): for the life of your account — it is your record.
• Closed accounts: hard-deleted within 30 days; backups age out within 90 days. We send a confirmation email.

7. Your rights

Depending on where you live (including under the CCPA/CPRA and similar U.S. state laws), you have the right to access the personal information we hold about you, to correct it, to delete it, to obtain a portable copy, and to not be discriminated against for exercising these rights. You can delete everything yourself from Account settings → Delete my account, or contact us and we will act on your request. Because we do not sell or share your data, there is nothing to opt out of — but the choice is honored regardless.

8. Security

Addresses, phone numbers, and year of birth are encrypted with AES-256-GCM before they reach the database, so a database leak would expose ciphertext rather than your details. Each integration has a hardcoded allow-list of the fields it may receive; there is no code path that transmits “ everything.” No system is perfectly secure, but we design to minimize what a breach could ever expose.

9. Children

OptOutHQ is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to this policy

We update this page like a changelog. If we make a material change, we will notify subscribers by email before it takes effect. The “last updated” date above always reflects the current version.

11. Contact

Questions, requests, or corrections: email privacy@optouthq.com.