1. Who we are
Outllyr ("we," "us," or "our") is a market intelligence company incorporated in India. We act as the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) and Data Controller (under the EU General Data Protection Regulation) for personal data collected through this website.
Contact: hello@outllyr.com
2. Data we collect
2.1 Data you provide (via the demo request form)
- Work email address
- Company name
- Professional role
- Primary use case (optional)
- Marketing communication preference
2.2 Data you provide (via the case study request form)
- Name
- Work email address
- Company name and website
- Country
- Professional role
- The case study you asked for
Alongside these, we record whether and when you confirmed your email address and whether your request was approved. To limit abuse, we also keep a one-way hash of your IP address, from which the address itself cannot be read back. An approved request is sent a passcode for that case study, issued to your company; how the case study is read with it is described in 2.3.
2.3 Reading a case study or report with a passcode
Our case studies, and the reports we prepare for clients, are read online behind a passcode. Each passcode is issued to one company. Before a document opens, you are asked to agree that how it is read is recorded, and while it is open we record, against that passcode:
- Which sections are on screen, for how long, and how far into each you scroll
- Which buttons, links, filters and charts you click or use, and what you type into a document's own search box
- Text you copy, whether you print, and answers to "Was this section useful?"
- Signs that something is not working: repeated clicks in one place, clicks on charts that do nothing, zooming on a phone, and page errors
- Your device type, browser, screen size, and a shortened one-way hash of your IP address
This is recorded against the passcode and the company it was issued to, not against your name or email address. It is collected by our own systems and stored on Google Cloud / Firebase in India; no third-party analytics service receives it. Each page carries a faint mark naming the company the passcode was issued to. We keep a cookie for seven days so you do not have to re-enter the passcode, and we are notified by email when a passcode is used.
2.4 Data collected automatically (with your consent)
If you accept analytics cookies, the following third-party services may collect data:
| Service | Provider | Purpose | Data collected |
|---|---|---|---|
| Google Analytics | Google LLC (USA) | Website usage analytics | Pages visited, session duration, device type, approximate location |
| Microsoft Clarity | Microsoft Corporation (USA) | Session recordings, heatmaps | Click patterns, scroll depth, mouse movements, session replays |
Each service only activates after you switch it on in the cookie banner, either with "Accept all" or one at a time under "Choose". If you select "Essentials only", neither is loaded and no analytics data is collected.
2.5 Cookie declaration
Every cookie and stored item this website uses, grouped as the cookie banner groups them.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| Essential (always on) | |||
| outllyr_cookie_consent, outllyr_cookie_consent_v2 | Outllyr (local storage, not a cookie) | Remembers your cookie choices, so the banner is not shown again | Until you clear it |
| __session | Outllyr | Keeps you signed in to a case study or report you have unlocked with a passcode. Set only on those pages, only after a passcode is accepted | 7 days |
| Analytics (Google Analytics, only if you switch it on) | |||
| _ga | Distinguishes one visitor from another | 2 years | |
| _ga_N6P2YV4MZB | Keeps the state of a visit | 2 years | |
| Session insights (Microsoft Clarity, only if you switch it on) | |||
| _clck | Microsoft | Keeps the same Clarity user ID across visits | 1 year |
| _clsk | Microsoft | Connects page views into a single session recording | 1 day |
| CLID, MUID, ANONCHK, MR, SM | Microsoft (on clarity.ms and bing.com) | Identify the browser to Clarity and check whether it should be counted | Up to 1 year |
No cookie on this website is used for advertising.
3. Why we collect your data
- Demo request processing: To respond to your inquiry, schedule a demo, and communicate with you about Outllyr's services.
- Product updates (if opted in): To send you occasional updates about Outllyr's product, features, and insights. You can unsubscribe at any time.
- Website improvement: To understand how visitors interact with our site and improve the user experience (only with consent).
- Case study requests: To confirm that a request comes from a business email address, decide whether to share the case study, send you a passcode for it, and follow up with you about it.
- Improving our case studies and reports: To learn which parts of a document are read, which are skipped, and where readers get stuck, so that we can make them clearer (only with your agreement on the passcode page).
4. Legal basis for processing
- Consent (DPDPA, GDPR Art. 6(1)(a)): For analytics cookies, marketing communications, and recording how a passcode-protected document is read. You provide affirmative consent via checkboxes, the cookie banner, and the box on the passcode page.
- Legitimate interest (GDPR Art. 6(1)(f)): For processing demo and case study requests. We have a legitimate business interest in responding to inquiries from potential customers, and in sharing our case studies only with verified business contacts.
5. Who we share your data with
We do not sell, rent, or trade your personal data. We share data only with:
- Google Cloud / Firebase: Our website infrastructure and database provider.
- Google Analytics: Website analytics (only with your consent).
- Microsoft Clarity: Session analytics (only with your consent).
- Resend: Sends the confirmation and passcode emails for case study requests.
6. How long we keep your data
Demo request data is retained for 24 months from your last interaction with us. After this period, your data is automatically deleted. Case study request data is kept on the same terms: 24 months from your request, after which it is deleted. Records of how a passcode-protected document was read are deleted 24 months after the visit they describe. You may request earlier deletion at any time.
7. Your rights
Depending on your jurisdiction, you have the following rights:
India: DPDPA 2023
- Access your personal data
- Correction and erasure
- Withdraw consent at any time
- Grievance redressal
- Nominate a representative
- Complain to the Data Protection Board of India
EU / UK: GDPR
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object (Art. 21)
- Complain to your supervisory authority
California: CCPA / CPRA
- Know what information is collected
- Delete your personal information
- Opt out of sale (we do not sell data)
- Non-discrimination for exercising rights
To exercise any of these rights, contact us at hello@outllyr.com. We will respond within 30 days.
8. Managing your cookie preferences
You can change your cookie preferences at any time with the Privacy button in the corner of every page, or Cookie settings in the footer, which reopen the cookie banner with each category's switch. Turning a service off stops it straight away and deletes the cookies it set on outllyr.com; Microsoft's own cookies on clarity.ms and bing.com can only be removed in your browser. Clearing this site's local storage also brings the banner back, and you can block cookies altogether in your browser's settings.
9. International data transfers
Your data may be processed by third-party services (Google, Microsoft, Resend) in the United States or other countries. These providers maintain appropriate data protection safeguards, including Standard Contractual Clauses (SCCs) where required under GDPR.
10. Data security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encrypted data transmission (HTTPS/TLS)
- Firestore security rules restricting database access
- Firebase App Check to prevent unauthorized API access
- Access limited to authorized team members only
11. Children's privacy
Our services are designed for business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
13. Contact us
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact Outllyr at hello@outllyr.com. We aim to respond to all privacy-related inquiries within 30 days.