Privacy Policy
Last updated · 23 September 2026
Who we are
Oxpium is B2B sales prospecting software published by Oxpium SAS, a French simplified joint-stock company with a share capital of €1,000, registered with the Toulon Trade and Companies Register under number 109 090 134, with its registered office at 23 avenue Marie Bonnafoux, 83110 Sanary-sur-Mer, France.
For any question about your data: rgpd@oxpium.com.
Who this policy applies to
- Users of Oxpium, who create an account and may connect their mailboxes to it.
- People contacted by Oxpium users, or whose professional profile is part of Oxpium's database.
User data
We process your account data (name, email address, organization, role), the usage data required to run and secure the service (technical logs, actions performed in the tool) and, where applicable, billing data.
Legal basis: performance of the contract between you and Oxpium, and our legitimate interest in securing the service.
Connected mailboxes (Google and Microsoft)
Oxpium lets you connect your Gmail or Google Workspace mailbox, or your Microsoft 365 or Outlook mailbox, so that you can send your outreach sequences from your own address and follow the replies. The connection goes through the official Google or Microsoft authorization screen. Oxpium never receives your password.
What we do with your authorization
- Send the emails you wrote or approved in Oxpium, from your mailbox (Google scope
gmail.send, Microsoft permissionMail.Send). - Read incoming messages in your mailbox in order to recognize replies and non-delivery notices related to emails sent from Oxpium, automatically stop a sequence when the recipient replies, and show you those replies in Oxpium (Google scope
gmail.readonly, Microsoft permissionMail.ReadWrite, which is also used to prepare follow-ups in the original conversation thread).
What we store
- Authorization tokens, encrypted, for as long as the mailbox is connected.
- Emails sent from Oxpium, and the replies and non-delivery notices that belong to those conversations.
Other messages in your mailbox are read only to be recognized as unrelated to Oxpium. They are neither stored nor analyzed.
What we never do
- Sell your data or your correspondents' data, or use it for advertising.
- Use the content of your emails to train or improve artificial intelligence models, whether ours or a third party's.
- Allow any member of the Oxpium team to read your emails, except with your explicit consent for a specific support request, to investigate abuse or a security incident, or to comply with a legal obligation.
Artificial intelligence. The content of a reply may be analyzed by an artificial intelligence model solely to provide you with a feature visible in Oxpium, for example telling a real reply apart from an out-of-office message. This processing is performed by Anthropic, which does not use this data to train its models.
Sharing. Data from your mailbox is only shared with the sub-processors required to run the service (hosting and artificial intelligence, see section 6), under contract, and only to provide the features you use, or when required by law.
Disconnection and deletion. You can disconnect a mailbox at any time from Oxpium: its authorization tokens are deleted immediately and Oxpium no longer accesses it. You can also revoke access from your Google account (myaccount.google.com/permissions) or Microsoft account (myapps.microsoft.com). Stored messages are deleted no later than 30 days after your account is closed, or earlier upon request to rgpd@oxpium.com.
Google user data
Oxpium's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Data about people contacted
Oxpium helps companies prospect other companies. In this context we process professional data about people in connection with their job.
Sources. Professional profiles published by the people themselves and supplied by a professional data provider; the French Sirene business register (INSEE); public job postings and company pages. When a user targets a person, their business email address and, if requested, their business phone number are looked up and verified by FullEnrich, a French company. We do not buy email lists and do not collect data from personal websites.
Purpose and legal basis. Business-to-business prospecting related to the person's job, based on legitimate interest (Article 6(1)(f) GDPR). Oxpium is the controller for its profile database; the company using Oxpium is the controller for its own campaigns, with Oxpium acting on its behalf.
Objection. Simply reply to the email you received and the sequence stops. You can also write to rgpd@oxpium.com to object to any processing or to ask where your data comes from.
Hosting and sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Supabase | Database and storage | European Union (Paris), backups in the same region |
| Railway | Application hosting | Servers in Amsterdam, company established in the United States |
| Anthropic | Artificial intelligence models | United States |
| FullEnrich | Business contact verification | France |
| Mailbox provider | Google Workspace and Microsoft 365 mailboxes purchased through Oxpium | Depends on the provider |
Transfers outside the European Economic Area are covered by the safeguards provided for by the GDPR, including the European Commission's standard contractual clauses. The up-to-date named list of our sub-processors is available on request at rgpd@oxpium.com.
Security
Encryption in transit, authorization tokens encrypted at rest, access to production data restricted to the two founders with strong authentication, strict separation between customer organizations: one company's data is never accessible to another.
Retention periods
| Data | Retention |
|---|---|
| User account | Duration of the contract, then deletion within 30 days |
| Mailbox authorization tokens | Until the mailbox is disconnected |
| Emails sent, replies and non-delivery notices | Duration of the contract, then deletion within 30 days |
| Other messages in the mailbox | Not stored |
| A customer's lists, campaigns and targeted contacts | Duration of the contract, then return or deletion within 30 days |
| Professional profile database | As long as the data matches a public professional profile, deletion on request |
| Technical logs | 12 months |
| Backups | Rotated within 30 days |
Your rights
You have the rights of access, rectification, erasure, objection, restriction and portability, and the right to know where your data comes from. Write to rgpd@oxpium.com: we answer within one month at most. You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
Changes
Any change to this policy is published on this page with its update date. If a change affects how we use data from your mailbox, we will inform you before it applies.