Privacy Policy

Account data you give us: your name, work email, password (stored only as a hash), workspace name, and the business-profile content you type or accept from our research feature (your website, services, pain points you solve, proof points).

Lead data you import or generate: names, job titles, work emails, company names, and similar business contact details — either imported from your lists or discovered from public web and third-party data sources when you run lead discovery.

Connected-account tokens: when you connect your own Gmail, Google Calendar, or LinkedIn account, we store OAuth tokens encrypted so the product can send from your mailbox, read replies, and book meetings on your behalf.

Usage and delivery data: email events (sent, delivered, opened, clicked, bounced) and reply classifications, needed to run sequences and show analytics.

We process account and billing data to provide the service you signed up for (contract). We process lead data and send outreach at the direction of the workspace account holder, who is responsible for having a lawful basis to contact those people (legitimate interests of our customer; you should review our Terms). We process connected-account tokens with your explicit consent, revocable any time by disconnecting the account.

Only the processors needed to run the service: our hosting and database provider (Supabase), email delivery through your own Gmail account (Google), job execution (Inngest), the lead-data and enrichment APIs used during discovery, and the AI provider that drafts sequences and research summaries. We never sell personal data. [LIST SUBPROCESSORS + LOCATIONS]

Outreach emails may include open and click tracking so senders can see engagement. Recipients who want to avoid tracking can disable remote images in their mail client, and every outreach email carries an unsubscribe link that permanently suppresses that address.

Account and lead data are kept while your workspace is active. When you delete your workspace (or ask us to), we delete the account data and its lead data; logged email events are pruned on the retention schedule described in-product. Unsubscribed addresses are kept suppressed so they are not contacted again. [STATE RETENTION PERIODS]

Depending on where you are, you may have rights to access, correct, export, or delete your personal data, and to object to processing. Workspace account holders can export leads from the product and delete their workspace in Settings → Account. For anything else, or if you are a contact who received outreach and want to exercise your rights, email [PRIVACY CONTACT EMAIL] — we will route your request to the workspace that contacted you and confirm what we did.

Data is encrypted in transit and at rest; OAuth tokens are encrypted with a key that is never exposed to the browser. Access to production data by our team is limited and logged.

Privacy questions: [PRIVACY CONTACT EMAIL]. See also our Terms of Service. Back to ReachEm.