Privacy Policy

Last updated: October 25, 2026

1. Overview

Fortify Outreach Hub ("we," "us," "the Service") is a cold email outreach platform operated by Fortify Project Estimators LLC at https://fortifyapponline.online. This Privacy Policy explains what data we collect, how we use it, and the specific data we access through Google OAuth and the Gmail API when you choose to connect a Google account.

2. Information We Collect

  • Account information: email address and authentication credentials you provide when creating an account.
  • Leads and campaign data: contacts you import (name, email, company, custom fields), campaigns, sequences, templates, and mailbox signatures you configure.
  • Sending activity: metadata about emails sent through the Service, including timestamps, message IDs, thread IDs, delivery status, replies, and bounces.
  • Google account data: only what is described in Section 4 below.

3. How We Use Information

  • Authenticate you and secure your account.
  • Send outbound email campaigns and follow-up sequences on your behalf, from mailboxes you have explicitly connected.
  • Record manual reply and suppression decisions. Only legacy Gmail mailboxes with read permission and polling enabled can detect inbox replies and bounce notifications automatically. Send-only users handle replies in Gmail and stop follow-ups manually in EOE.
  • Provide reporting on send, reply, and bounce activity.
  • Operate, maintain, and improve the Service.

4. Google User Data & Gmail API

When you choose to connect a Google account as a sending mailbox, new connections request only the following OAuth scopes:

  • openid and https://www.googleapis.com/auth/userinfo.email — to identify the Google account being connected and display its email address in the app.
  • https://www.googleapis.com/auth/gmail.send — to send outbound campaign, sequence, follow-up, and test emails from your Gmail account, at your explicit direction.

Legacy connections. Older mailboxes may retain https://www.googleapis.com/auth/gmail.readonly. Email Accounts identifies this permission and whether polling is enabled. For those accounts, polling reads message headers and snippets for reply and bounce detection. Reconnecting requests send-only access and disables polling, but does not itself revoke existing permissions at Google. New send-only mailboxes do not read messages, detect replies, or detect later delivery notices. Follow-up threading uses stored outgoing message headers and the Gmail send response, without reading the inbox.

Google data use is subject to the Google API Services User Data Policy, including applicable Limited Use requirements. This policy is not a claim of Google approval or an independent security certification. Our handling of Google data is described below:

  • We only use Google user data to provide user-facing features of the Service (sending, reply detection, bounce detection, threading).
  • We do not sell Google user data, use it for advertising, or use it for any purpose unrelated to the features described above.
  • We do not allow humans to read Google user data unless we have your affirmative consent for specific messages, are required to do so for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymized for internal operations.
  • We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
  • We do not use Google user data to develop, improve, or train generalized or non-personalized AI and/or machine learning models.

You can delete a mailbox from the Email Accountspage to remove its account row and stored credentials from the active application database. Deletion does not revoke Google authorization. Revoke access separately at https://myaccount.google.com/permissions. A send or poll already in progress may finish. Sent messages remain in Gmail, and EOE sending history is preserved. To obtain a fresh send-only grant for a legacy connection, revoke the old authorization at Google before reconnecting; this may affect other mailboxes using the same Google authorization.

5. Data Storage & Security

Application data is stored in Lovable Cloud. Gmail access and refresh tokens are encrypted by the application before storage. The Google client secret and token refresh operations remain server-side. Account access controls restrict application data. Outgoing content and send results, including message/thread IDs, may be stored in activity logs. No security system can guarantee absolute protection.

6. Data Retention & Deletion

Leads, campaigns, outgoing message logs, and recorded replies or bounces remain stored until deleted through supported controls or a deletion request. Administrators have maintenance controls for eligible historical data; there is no universal automatic deletion deadline. You may request deletion of your account and associated data by contacting us at faralloncontractorgc@gmail.com. Mailbox deletion removes its stored tokens from the active account row, not historical send records, sent Gmail messages, or Google's authorization. Removal from backups is governed by the hosting provider's retention processes; no immediate backup erasure is promised.

7. Third-Party Services

We rely on service providers for hosting, database, and email delivery (including Google's Gmail API for connected Google mailboxes). These providers process data only to perform services on our behalf.

8. Children's Privacy

The Service is not intended for individuals under 16 and we do not knowingly collect data from them.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page.

10. Contact

Questions about this Privacy Policy or your data can be sent to faralloncontractorgc@gmail.com.