ocuro Privacy Policy

Effective date: October 6, 2026

ocuro ("we", "us") is an email outreach assistant offered as a Chrome extension with a managed backend service. This policy explains what information ocuro handles when you use it, and how.

What ocuro accesses, and why

When you sign in with Google and connect a spreadsheet, you authorize ocuro to:

• Read your basic Google profile (name, email address): to identify your account inside ocuro.
• Read and update the lead spreadsheet you connect: your spreadsheet is the source of truth for your leads; ocuro reads lead details from it and writes outreach status and sent-email records back to it. ocuro only touches the spreadsheet you explicitly connect.
• Create drafts in your Gmail and read your outreach threads: ocuro writes personalized email drafts into your Gmail Drafts folder and checks the conversations it created to detect when you sent an email, when a prospect replied, or when a message bounced. When a prospect replies, ocuro reads that reply so it can draft your answer in the same thread (you can turn auto-reply drafts off for any sheet). When a message bounces, ocuro reads the mail server's delivery report to tell a dead address from a policy block, so it stops emailing where your mail is not accepted. ocuro sends email from your Gmail only when you ask it to: a row whose Status you set to Automatic (every email) or Semi-Automatic (follow-ups only) is sent for you at the recommended send time, from your own account, and you can stop it at any time by changing the cell. Every other message you review and send yourself from Gmail.

What we store

• Your account identifiers (name, email) and Google OAuth tokens (never your password; Google issues scoped tokens that you can revoke at any time at myaccount.google.com/permissions).
• Lead information from your connected spreadsheet and the outreach emails generated for those leads, so sequences and follow-ups work.
• Your voice profile: a short description of your writing style (for example, preferred sentence length and formality), learned from the edits you make to drafts before sending. It never contains your emails themselves, and you can delete it at any time with “Reset voice profile” in the side panel's account menu.
• Documents you choose to upload about your own business (for example a one-pager or a case study): ocuro extracts a short fact sheet from each file once and stores only that fact sheet and the filename, never the file itself. Fact sheets are used solely to ground the emails written for you, and you can remove any of them at any time from the side panel's Documents card.
• The text of replies you receive from prospects in the outreach threads ocuro created (capped at a few thousand characters, with quoted history removed), stored so ocuro can draft your answer in the same thread and, over time, describe which of your emails earn replies. That description is a short summary of patterns on your profile; it never quotes a prospect. Reply text is kept with its lead and deleted on the same schedule as the lead.
• Email domains whose mail servers rejected your email by policy, so ocuro stops emailing people there. You can see and lift any of them on the side panel's Blocked domains page.
• Lead Finder lookups: the identifiers you paste (a LinkedIn profile link, an email address, or a name and company), what was found for each (name, job title, company, company website, city, work email, phone number, LinkedIn profile) and the outcome, kept for 90 days so you can see what a run did; the row written to your spreadsheet is the lasting record.
• Operational records (campaign settings, send/reply status, service logs). Internal event logs are automatically deleted after 90 days.

How your information is used

Solely to operate ocuro for you: generating personalized outreach emails, placing drafts in your Gmail, tracking your campaigns, and showing your dashboard. Lead details are shared with our AI provider (Anthropic) only as needed to write each email, under contractual terms that prohibit training on or retaining your data beyond service delivery.

We do not sell your data. We do not use it for advertising. We do not transfer it to third parties except the service providers that run ocuro (Google APIs, Anthropic for text generation, Supabase for secure hosting, Resend for service alert and referral invitation emails, Airscale for Lead Finder lookups you start), each processing it only on our instructions.

Voice learning

ocuro adapts to how you write. When you edit a draft in Gmail before sending it, ocuro compares the draft it wrote with the email you actually sent and updates your voice profile: a short, plain-language description of your writing tendencies (things like sentence length, formality, and how direct your asks are). Future drafts are written with that profile so they sound more like you.

• The comparison uses only emails ocuro itself drafted in your outreach campaigns; ocuro does not read any other mail in your account.
• The profile describes how you write. It never stores the text of your emails, and analysis happens only for a limited number of edited emails (the first 20, then up to 10 per month).
• The two email versions are shared with our AI provider (Anthropic) only to perform this comparison, under the same no-training, no-retention terms as email generation.
• “Reset voice profile” in the side panel's account menu deletes your current profile immediately.

Refer a friend

If you use the "Refer a friend" feature, you give us the email address of someone you know so we can send them a single invitation on your behalf. We use that address only to deliver that invitation and to grant the promised usage credits ($5 to each of you) if they join and their first email is generated within 5 days of joining. It is never added to a marketing list, never sold, and never used for anything else. If the person does not join, the invitation simply expires.

OMNI-PRESENCE (optional, usage-priced)

OMNI-PRESENCE is off until you switch it on in the side panel. Each recommendation costs 25 cents, only on days an alert is sent, with at most 10 per alert. If you turn on OMNI-PRESENCE, ocuro also looks for publicly available posts published by the prospects you email (and by any public profiles you choose to add to your watch list) and emails you, on the days you pick, a short list of posts worth engaging with and the words you could say. Every suggestion is something you carry out yourself: ocuro never posts, comments, likes, or messages anyone on your behalf.

• Where the posts come from: the LinkedIn link in your spreadsheet, the social pages a prospect's company links from its own website, and the handles on your watch list. To read recent public posts, ocuro sends the public profile link or handle (never an email address) to public-data providers that read publicly visible pages: Web Scraping Guy LLC (ScrapeCreators, Texas, USA) for LinkedIn, Facebook, Instagram, Threads, TikTok, YouTube, Bluesky, Telegram, Truth Social, Twitch, Rumble and Snapchat, and X Corp's official API for X. They receive only the public identifier and return only publicly visible posts. ocuro never logs in to any social network and never uses your account or cookies.
• What is collected: links to public posts, their dates, a short excerpt, public reaction counts, and the public handle or page the post appeared on. Only publicly visible content is used; private profiles and private messages are never accessed.
• Who else sees it: our AI provider (Anthropic) judges which posts are relevant to your business and drafts the suggested words from the post text, under the same no-training, no-retention terms as email generation; Supabase stores the queue; Resend delivers your alert email. Nothing is sold or used for advertising.
• What is stored: the public profile links or handles found for a prospect (so they are not looked up again) and a note that a lookup found nothing (kept up to a year). Fetched posts are deleted within 14 days. Suggestions expire within a week and are deleted after 30 days. Everything stored about a prospect is deleted within a month of the prospect leaving your spreadsheet, or within 30 days of turning the add-on off. To make sure the same post is never suggested twice, ocuro keeps a permanent one-way hash of each post link it has suggested; it contains no content, no name and no address.
• Watch list: the profile links or handles you add are stored so we can check them for new public posts on your alert days. You can remove any of them at any time, which deletes the entry.
• If you are a prospect and would rather not be included: email support@useocuro.com with your profile link and we will exclude it across every ocuro account.

Lead Finder (optional, usage-priced)

Lead Finder fills in the people you already know so you do not type them by hand. You paste one identifier per person in the side panel (a LinkedIn profile link, an email address, or a first name, last name and company) and ocuro adds a complete row to your spreadsheet. Nothing runs until you press Find.

• What is sent where: the identifier you typed is sent to Airscale (airscale.io), a business-contact data provider, to find that person's work email address, mobile phone number (only when you switch Phones on) and public profile details (name, job title, company, company website, city, LinkedIn profile). Airscale receives only the identifier for that line and returns business-contact data about that person. ocuro uses its own Airscale account; you never create one.
• What it costs: nothing when you give the email address; 25 cents when ocuro finds the email; 50 cents per phone number found; nothing at all on the free plan. A lookup that finds no valid email adds nothing to your sheet and costs you nothing. A person already in your sheet is reported as such and not looked up again.
• What is written: one row per person in the leads tab of the spreadsheet you connected, with Regarding? and Additional Notes left blank for you to fill in. No email is written or sent for that person until you do.
• What is stored: the identifiers you pasted, what was found, and the outcome of each line, for 90 days (see “What we store”); the usage record for billing. Nothing is sold or used for advertising.
• If you are a prospect and would rather not be included: email support@useocuro.com with your name or profile link and we will exclude it across every ocuro account.

Google API Services: Limited Use disclosure

ocuro's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the user-facing features described above, is never sold, is never used for advertising, and is never read by humans except with your explicit consent, for security purposes, or as required by law.

Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to the operator. Backend secrets are stored in managed vaults, never in the extension you install.

Retention and deletion

Your data is retained while your account is active. Disconnecting a campaign stops all processing for it. To delete your account data entirely, email us and we will remove your stored leads, generated emails, and tokens. Leads removed from your spreadsheet stop being processed immediately and are automatically purged from our systems after 12 months (kept that long so a lead you re-add resumes its sequence instead of being emailed from scratch).

Contact

We may update this policy as ocuro evolves; material changes will be reflected on this page with a new effective date.