Privacy Policy

1 Overview

This Privacy Policy describes how Lookout Software, LLC ("Company," "we," "us," or "our") collects, uses, stores, and protects information when you use the SwiftMerge for Outlook 365 application, website, and related services (collectively, the "Service").

We are committed to protecting your privacy and handling your data transparently. We only collect information that is necessary to provide and improve the Service, and we never sell your personal data to third parties.

2 Information We Collect

We collect information in the following categories:

Account Information

When you sign in via Microsoft OAuth, we receive your name, email address, and Microsoft 365 tenant identifier. We do not receive or store your Microsoft password.

Contact & Campaign Data

When you import contacts and create campaigns, we process recipient names, email addresses, custom merge field values, email content, and scheduling preferences. This data is stored securely on our servers to enable campaign delivery and tracking.

Usage & Analytics Data

We automatically collect information about how you interact with the Service, including features used, campaign actions performed, and general usage patterns. This helps us improve the product experience.

Engagement Tracking Data

When email tracking is enabled, we collect data on email opens, link clicks, and bounce events associated with your campaigns. This data is tied to recipient email addresses and timestamps.

3 How We Use Your Data

We use the information we collect to:

• Provide the Service — authenticate your account, send emails on your behalf through Microsoft Graph, deliver merge campaigns, and display tracking analytics.
• Improve the Service — analyze usage patterns to fix bugs, optimize performance, and develop new features that serve our users better.
• Communicate with you — send account-related notifications, security alerts, billing receipts, product updates, and respond to support requests.
• Ensure security — detect and prevent fraud, abuse, and unauthorized access to accounts and data.
• Comply with legal obligations — respond to legal requests and enforce our Terms of Service.

We do not use your data for advertising, profiling, or any purpose unrelated to providing and improving the Service.

4 Legal Basis for Processing

For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions that require a legal basis for processing personal data, we rely on the following:

• Contract performance — processing necessary to provide the Service you've subscribed to and fulfill our obligations under the Terms of Service.
• Legitimate interests — processing for product improvement, security, and fraud prevention, where our interests do not override your data protection rights.
• Consent — where you have explicitly opted in to optional data processing, such as marketing communications. You may withdraw consent at any time.
• Legal compliance — processing required to comply with applicable laws, regulations, or legal proceedings.

5 Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share limited data with the following categories of third parties, solely as necessary to operate the Service:

• Microsoft Corporation — we interact with Microsoft Graph API to send emails on your behalf. Microsoft processes these emails under its own privacy policies.
• Infrastructure providers — we use cloud hosting and database services (e.g., encrypted storage, content delivery) to securely run the Service. These providers process data on our behalf under strict data processing agreements.
• Payment processors — when you subscribe to a paid plan, payment information is handled directly by our payment processor. We never store your full credit card number.
• Legal authorities — we may disclose data if required by law, subpoena, court order, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

6 Data Storage & Security

We take the security of your data seriously and implement industry-standard measures to protect it:

• Encryption at rest — all stored data is encrypted using AES-256 encryption.
• Encryption in transit — all data transmitted between your browser, our servers, and Microsoft is protected by TLS 1.3.
• Authentication — we use Microsoft OAuth 2.0 for sign-in. We never receive, store, or have access to your Microsoft password.
• Token management — authentication tokens are stored securely with automatic expiration and cleanup. Expired tokens are purged on a regular schedule.
• Access controls — access to production data is restricted to authorized personnel and requires multi-factor authentication.
• Monitoring — we continuously monitor our systems for unauthorized access, vulnerabilities, and anomalous activity.

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we commit to promptly notifying affected users in the event of a data breach.

7 Data Retention

We retain your data only as long as necessary to provide the Service and fulfill the purposes described in this policy:

• Account data — retained for the duration of your active account plus 30 days after account deletion.
• Campaign & contact data — retained while your account is active. Deleted within 30 days of account deletion or upon explicit request.
• Tracking & analytics data — campaign engagement data is retained for 12 months, after which it is aggregated and anonymized.
• Billing records — retained for 7 years as required by tax and accounting regulations.
• Server logs — automatically purged after 90 days.

You may request early deletion of your data at any time through your account settings or by contacting us. We will process deletion requests within 30 days, except where retention is required by law.

8 Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format (CSV or JSON).
• Restriction — request that we limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us at privacy@swiftmerge.com. We will respond to your request within 30 days. We may ask for additional verification to protect your account security.

9 Cookies & Tracking

Our website and Service use a limited number of cookies and similar technologies:

We do not use advertising cookies or third-party tracking cookies. You can configure your browser to refuse cookies, but some features of the Service may not function properly without essential cookies.

Email tracking pixels: When open tracking is enabled on a campaign, a small transparent pixel is included in outgoing emails. Recipients' email clients load this pixel upon opening, which registers the open event. Click tracking works by routing links through our tracking server. Recipients can disable image loading in their email client to prevent open tracking.

10 Third-Party Services

The Service integrates with third-party services that have their own privacy policies. We encourage you to review them:

• Microsoft 365 & Microsoft Graph — used for email sending, authentication, and mailbox integration. See Microsoft's Privacy Statement.
• Cloud hosting provider — our infrastructure runs on enterprise-grade cloud services with SOC 2 compliance.
• Payment processor — handles subscription billing securely. PCI DSS compliant.

We carefully vet all third-party providers for security and privacy compliance. Data shared with third parties is limited to what is strictly necessary for them to perform their designated functions.

11 Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 18, we will take immediate steps to delete that information.

If you believe a child has provided us with personal data, please contact us at privacy@swiftmerge.com and we will promptly investigate and take appropriate action.

12 International Data Transfers

Your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate. If you are accessing the Service from outside the United States, please be aware that your data may be transferred to a jurisdiction with different data protection laws than your own.

For transfers from the EEA and UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organizational safeguards where appropriate, to ensure an adequate level of data protection.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Notify you by email at least 30 days before the changes take effect.
• Post a prominent notice within the Service.
• Update the "Last updated" date at the top of this page.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you disagree with the changes, you should stop using the Service and delete your account.

14 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

We aim to respond to all privacy-related inquiries within 30 days. For urgent data protection matters, please include "URGENT" in your email subject line.

You also have the right to lodge a complaint with your local data protection authority if you believe your data protection rights have been violated.