Privacy policy

This policy explains what personal data GSM MEDIA S.R.L ("Reachiz", "we") processes when you use the Reachiz product and website, why we process it, and what rights you have. Reachiz is a B2B outreach product: it helps you find business contacts and reach them on LinkedIn and by email.

Who is responsible for your data

For data about you as a Reachiz user (account, billing, usage), Reachiz is the data controller. For data about the leads you upload or find through the product, you are the controller and Reachiz acts as your processor under the data processing addendum.

Data we process

• Account data: name, work email, organization, authentication identifiers.
• Billing data: plan, invoices and payment status. Card details are handled by Stripe; we never see full card numbers.
• Sender connections: email accounts (Gmail, Outlook, SMTP) you authorize, and LinkedIn accounts. Every LinkedIn account runs in Reachiz's cloud browser, through a residential proxy in the account's country. We store the session cookie, and for password sign-in the password and authenticator secret, encrypted, so we can run that session.
• Lead data you process through the product: names, titles, companies, email addresses and phone numbers you search for, import or enrich.
• Campaign and inbox data: sequences, messages, replies and engagement events.
• Usage and device data: product analytics, IP address and approximate location for security checks.

Browser extension

The Reachiz Chrome extension reads your LinkedIn login cookies (li_at and JSESSIONID) and your browser's user agent, and shows them in its popup so you can copy them into Reachiz. It checks for your Reachiz login cookie only to open the app. The extension itself sends no data to Reachiz or anyone else, and it does not read pages you visit. What you paste into Reachiz becomes a sender connection, as described above.

Why we process it

• To provide the service: run sequences, sync senders, deliver replies to your inbox.
• To bill you: subscriptions, credit pools and invoices through Stripe.
• To keep accounts secure: session checks, IP geolocation and abuse prevention.
• To improve the product: aggregated analytics through PostHog.
• To meet legal obligations: tax, accounting and lawful requests.

Legal bases (GDPR)

We process your data to perform our contract with you, for our legitimate interests in securing and improving the product, and where required to meet legal obligations. Where consent is the basis (for example optional cookies), you can withdraw it at any time.

Subprocessors

We share data with the following providers, only as needed to run the service:

• Convex: Application database and backend functions
• Cloudflare: Hosting, CDN and cloud worker compute
• Stripe: Payments and subscription billing
• WorkOS: Authentication and organization management
• Resend: Transactional email delivery
• OpenAI: AI models for drafting and agent features, reached through Cloudflare AI Gateway. OpenAI does not train on API data
• Evomi: Residential proxies for cloud LinkedIn senders
• 2Captcha: Captcha solving for LinkedIn session handling
• IPinfo: IP geolocation for session security checks
• PostHog: Product analytics

International transfers

Some subprocessors process data outside the EEA. Where they do, we rely on adequacy decisions or standard contractual clauses.

Retention

We keep account and billing data while your account is active and as long after as the law requires. Lead data, campaign data and inbox content are deleted when you delete them or when your account is closed, subject to backup cycles.

Your rights

You can request access, correction, deletion, portability or restriction of your personal data, and object to processing based on legitimate interests. Email support@reachiz.com. You also have the right to complain to your local data protection authority.

Contact

GSM MEDIA S.R.L. support@reachiz.com