Privacy Policy

Who we are & scope

Outsource is a marketing-services platform operated by The Good Picture, based in Nairobi, Kenya. For personal data processed at outsource.thegoodpicture.com, we act as the data controller for account and platform data, and as a processor for the client content you submit to have work done. This policy explains what we collect, why, who we share it with, how long we keep it, and your rights.

Who operates this service

Outsource is operated by The Good Picture, based in Nairobi, Kenya.

Data-protection contact: contact@thegoodpicture.com. Privacy matters are handled by our team and escalated to our founders, Frédéric Cavé and Alexandre Brecher, where needed.

2. Personal data we collect

Depending on how you use the Service, we collect the following categories of personal data:

We do not intentionally collect special-category data (such as health or political data) and ask that you not submit it.

3. How we use your data & our legal bases

Where the GDPR or the Kenya Data Protection Act, 2019 applies, we rely on the following legal bases. We use your data only for the purposes below.

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see your rights below). We do not sell your personal data.

4. AI & automated processing

Some features use AI, provided by our sub-processor Anthropic, to help draft, adapt, and summarise content. Content you send to these features is not used to train the underlying models.

We do not use your personal data to make decisions that produce legal or similarly significant effects about you solely by automated means. AI output is a draft for a human to review — a person is always in the loop before anything is delivered or published.

5. Cookies & analytics

We use only essential and functional first-party cookies and local storage (primarily to keep you signed in and remember interface preferences), plus Vercel Web Analytics, a privacy-friendly, cookieless tool that records anonymised page views. We do not use advertising or cross-site tracking cookies.

Full details, including a cookie-by-cookie table, are in our Cookie Policy.

6.Sub-processors

We rely on the vetted sub-processors below to operate the Service. Each is engaged under a data-processing agreement with appropriate safeguards.

The full list, with the data each one processes, is on our Sub-processors page, which you can subscribe to for change notifications.

7. Sharing & disclosure

We share personal data only:

• With the sub-processors listed above, to operate the Service on our behalf;

• With third-party platforms you choose to connect, for actions you initiate;

• Where required by law, court order, or a lawful request by a public authority;

• To protect our rights, safety, and property, or those of our users, where reasonably necessary;

• In connection with a merger, acquisition, or sale of assets, under confidentiality and this policy.

We do not otherwise disclose your personal data, and we never sell it.

8. Where your data is stored & international transfers

Your account and content data is stored in our primary database (Supabase) in the European Union (Frankfurt). Workflow automation (n8n Cloud) also runs in the EU. Application hosting (Vercel) and some sub-processors (Anthropic, Postmark, Sentry) run in the United States; our payment processor (Paystack) operates in Nigeria and South Africa.

Where personal data of individuals in the EU/EEA, UK, or Kenya is transferred to a country without an adequacy decision, we rely on appropriate safeguards under GDPR Article 46 — principally Standard Contractual Clauses — together with each sub-processor’s own transfer mechanisms and, where relevant, supplementary measures such as encryption.

9. Data retention

We keep personal data only as long as needed for the purposes above, then delete or anonymise it.

10. Your rights

Subject to applicable law, you have rights over your personal data. To exercise any of them, email contact@thegoodpicture.com. We respond within 30 days and may ask you to verify your identity first.

Under the GDPR (EU/EEA/UK) and the Kenya Data Protection Act, 2019

• Access — a copy of the personal data we hold about you.

• Rectification — correct inaccurate or incomplete data.

• Erasure — delete your data (the “right to be forgotten”).

• Portability — receive your data in a structured, machine-readable format.

• Restriction — limit how we process your data.

• Objection — object to processing based on legitimate interests.

• Withdraw consent — where we rely on consent, withdraw it at any time.

You may also lodge a complaint with your supervisory authority — in Kenya, the Office of the Data Protection Commissioner (ODPC); in the EU/EEA, your local authority.

If you are a California resident (CCPA/CPRA)

You have the right to know, delete, and correct your personal information, and to opt out of its “sale” or “sharing”. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights.

11. Security

We protect your data with encryption in transit and at rest, row-level access controls, encrypted integration tokens, least-privilege access, and audit logging. No method of transmission or storage is completely secure, but we work to protect your data and review our practices regularly. Our full posture is described on the Security page.

12. Children’s data

Outsource is a business tool intended for professional use. It is not directed to, and we do not knowingly collect personal data from, anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

13. Breach notification

In the event of a personal-data breach likely to result in a risk to your rights, we will notify affected users and, where required, the relevant supervisory authority within 72 hours of becoming aware, in line with GDPR Articles 33 and 34 and the equivalent Kenyan requirements.

14. Data Processing Agreement

Business customers who need a Data Processing Agreement (DPA) — for example where we process personal data on your behalf as your processor — can request one at contact@thegoodpicture.com. Our DPA incorporates the Standard Contractual Clauses and our current sub-processor list.

15. Changes to this policy

We may update this policy from time to time. For material changes, we will give at least 30 days’ notice by email and update the version and effective date above before the changes take effect.

16 .Contact

For any privacy question, or to exercise a right, contact our data-protection contact at contact@thegoodpicture.com.