Privacy Policy

How to read this policy

This is the short version. It is a summary and not a substitute for what follows. Nothing in it overrides the detailed terms.

• We do not sell your personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined by United States (US) state privacy laws.
• Reach acts on the accounts you connect only for the workspace that connected them, and only for steps a person in that workspace started, approved or scheduled.
• Google user data follows the Google API Services User Data Policy, including the Limited Use requirements. It is never sold, never used for advertising and never used to train artificial intelligence (AI) models.
• Keys you save in Connect Vault are encrypted, readable by nobody (Reach staff included), and used only for the call that needs them.
• Payments run through a payment processor. We never receive or store your full card number.
• Deletion is real. You can disconnect an account, remove a key, delete a workspace or ask us to delete everything, and https://reach-usa.com/data-deletion/ shows you how.

1. Who we are and who is responsible for your data

The entity responsible for your personal data, the controller in the language of European law, is Matriarch Solutions Inc, 8735 Dunwoody Place #4412, Atlanta, GA 30350, United States. Company registration: Georgia Secretary of State, Control Number 24108657.

Where we process data on another party's instructions rather than our own, we act as a processor for that party and their privacy notice governs, not ours. On Reach that happens when a business uses Reach to run its own marketing: the email surveys it sends, the replies it collects and the customer lists it uploads belong to that business, and its privacy notice governs them.

2. Where this policy applies

This policy applies to Reach: the website at https://reach-usa.com, the Reach console, Reach's public application programming interface (API), the connections Reach makes to the social platforms and Google services you link, and the support channels through which you reach us. We refer to all of it collectively as the service.

This policy does not cover:

• third-party services you reach through a link from ours, which have their own policies;
• payment card handling by our payment processor, which is governed by its own notice;
• what TikTok, Meta (Facebook and Instagram), LinkedIn, Google (including YouTube) and X do with your data on their own services, which their own privacy policies govern;
• TheOne's other products, which have their own policy at https://theone-eu.org/legal.

3. The data we collect

3.1 Data you give us

3.2 Data generated by your use of the service

• Sign-in sessions and the device and browser they came from.
• An audit log of actions in each workspace: who connected, published, disconnected or changed a setting, and when.
• Publishing results: whether each post reached each platform, and the platform's answer.
• Technical data: internet protocol (IP) address, browser and device type, request logs and error records.

3.3 Data we receive from others

3.4 Data we do not collect

Stating the boundary is as useful as stating the scope. We do not:

• receive or store your full payment card number, CVC, or online banking credentials;
• read files outside what you explicitly select and upload, and in Google Drive we can open only the files you pick;
• ask any platform for permission to read your direct messages;
• buy contact lists to add people who never asked to hear from us;
• purchase personal data about you from data brokers to enrich your profile for advertising.

4. Google user data

When you connect a Google account, Reach uses the Google data you allow only to provide the features you turned on:

Reach's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In practice:

• We use Google user data only to provide and improve the features you can see in Reach, for the workspace that connected it.
• We transfer it to others only when that is needed to provide those features, to comply with the law, or as part of a merger, acquisition or sale of assets after we tell you.
• We do not sell Google user data. We do not use or transfer it for advertising, including retargeting, personalised or interest-based advertising.
• We do not use Google user data to develop, improve or train AI or machine learning models, ICARUS included.
• No person at Reach reads your Google user data unless you ask us to (for example in a support case), it is needed for security or to investigate abuse, the law requires it, or it has been aggregated and made anonymous for internal operations.

You can remove Reach's access at any time in Reach (Settings, Connect Vault, Disconnect Google) or at https://myaccount.google.com/permissions (https://security.google.com/settings/security/permissions). Disconnecting revokes Reach's access at Google and deletes the tokens at once. Reach deletes the Google data it stored within 30 days after you remove access, and within 7 days when you ask us to delete it at [email protected].

YouTube: Reach uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and the Google Privacy Policy (http://www.google.com/policies/privacy) applies.

5. Data from TikTok, Facebook, Instagram, LinkedIn, YouTube and X

When you connect an account, the platform shows you what Reach asks to do. Read that list. Reach acts on that account only for the workspace that connected it, and only for steps a person in that workspace started, approved or scheduled. Reach asks for the fewest permissions each feature needs.

Reach does not read other people's private content through these connections. Reach does not sell platform data and does not use it for advertising. Reach uses it only for the purposes in this table and in section 7.

Access tokens are encrypted, decrypted only on Reach's servers for the call that needs them, never shown on a screen and never written to a log.

When you disconnect an account in Reach (Dashboard, Connect, Disconnect), Reach revokes its access on the platform where the platform allows that and deletes the tokens at once. Scheduled posts pause and are not deleted. Past analytics from that account are deleted when you ask us at [email protected].

When you remove Reach on the platform itself, the connection is marked disconnected and its tokens are deleted. Facebook and Instagram can also send us a data deletion request, which we complete at once. https://reach-usa.com/data-deletion/ explains both.

6. Keys you save in Connect Vault

Connect Vault (Settings, Connect Vault) holds only your own keys and your Google connection: keys for AI providers (Anthropic and OpenAI), video tools (Seedance, Runway and Higgsfield), your own email server or Resend, Bing Webmaster Tools, the Meta Pixel and Conversions API, and a read-only Stripe restricted key.

• Every key and Google token is encrypted with the Advanced Encryption Standard (AES-256) under its own data key, and that data key is sealed by a master key. A copy of the database alone opens nothing.
• No one, Reach staff included, can read a saved key back through any screen or API. The workspace owner sees the last four characters, who set it and when. Other members see only whether a key is set.
• Every change needs a Google Authenticator code from the person making it.
• A feature reads a key only in memory, for the call that needs it. Keys are never logged, never put in an error message or a link, and never in the audit trail.
• We never sell your keys and never share them. A key is sent only to the provider it belongs to, when Reach makes the call you asked for.
• Reach staff can shut a vault down for security. When they do, the workspace sees that it was switched off by Reach support and the date.
• Remove deletes a key and its encrypted copy at once. Disconnect Google also revokes the grant at Google. Deleting a workspace erases its vault at once.

When Reach calls a provider with your key, that provider's own terms and privacy policy govern what it does with what Reach sends it, and the usage is billed to you.

7. How ICARUS uses your data

ICARUS is the part of Reach that predicts how each platform will treat a post before it goes out, and helps make content built for that.

ICARUS uses data from the platforms you connect (TikTok, Facebook, Instagram, LinkedIn and X) and from public sources to train and improve Reach's models.

The one exception is Google user data, YouTube included. It is never used to develop, improve or train generalised AI or machine learning models (section 4).

How ICARUS handles your keys and data:

• You enter no keys in ICARUS. ICARUS reads your workspace's own credentials only on Reach's servers, through one internal route, never from a browser.
• It may read only: Google access for Search Console, Google Analytics 4, YouTube Analytics and Google Ads; the Meta Conversions API token; and the Stripe restricted key. It does not read your AI provider, video, email or Bing keys. We will update this policy before that list grows.
• For Google it gets a short-lived access token (about an hour) and the site, property or account you picked, never the refresh token.
• Nothing is handed to ICARUS unless the record of it was written first. Every read, and every refusal, appears in your workspace's Connect Vault activity in plain words, for example "ICARUS used Stripe (restricted key) for revenue attribution".
• It uses a credential for the call that needs it and does not store or log it. Nothing is handed out while Reach support has the vault shut down, and reads are limited to 60 a minute per workspace and kind.
• ICARUS never stores a platform token. It keeps no commenter identities: comments become an aggregate reaction profile, and audience data is kept only as shares of broad groups.
• ICARUS also reads public pages from approved sources while logged out. It uses no logins and no cookies, and it respects each site's robots.txt rules.
• ICARUS never publishes on its own. A person must confirm, and the post needs an approval in the same workspace.
• Retention: observations 400 days, trend observations 180 days, raw collected pages 30 days, jobs 90 days after they finish.

8. Why we use your data, and on what legal basis

European law requires a lawful basis for every purpose. Article references are to the GDPR.

Where we rely on legitimate interests, we have carried out a balancing assessment weighing that interest against your rights and freedoms, and we have recorded it. You can request a summary at [email protected], and you can object under section 12.

Decisions with a legal or similarly significant effect, such as permanently closing an account, are not made by an automated system alone. A person decides, or reviews the automated decision before it becomes permanent.

9. How and with whom we share data

We do not sell your personal data. We do not share it for cross-context behavioural advertising. We do not disclose it for money or other valuable consideration.

A current list of the specific processors we engage, and the countries they operate in, is available on request at [email protected].

9.1 What we require of processors

Every processor is engaged under a written contract that: limits them to our documented instructions; requires confidentiality; imposes security measures at least equivalent to our own; restricts sub-processing to parties bound by the same terms; requires them to assist with your rights requests and with breach notification; and requires deletion or return of the data at the end of the engagement. We assess each processor before engaging them and review them periodically.

9.2 How we handle government and law-enforcement requests

We assess every request against the law that supposedly authorises it. We require valid legal process. We refuse or challenge requests that are overbroad, procedurally defective, or unlawful. Where the law permits it and there is no ongoing investigation that notice would prejudice, we tell the affected customer before disclosing. An emergency-disclosure request, where there is an imminent risk of death or serious physical harm, is handled on a fast path, and we disclose only what is necessary to address the emergency.

10. International transfers

We are established in the United States and host primarily in the United States. Where we transfer personal data from the European Economic Area (EEA), the United Kingdom or Switzerland, we rely on an adequacy decision where one exists; otherwise on the European Commission's 2021 Standard Contractual Clauses, with the United Kingdom International Data Transfer Addendum and the Swiss annex where relevant; and on the narrow derogations in Article 49 of the GDPR only where that article allows them, never for routine transfers.

Contractual mechanisms alone are not sufficient, so we also apply supplementary measures: encryption in transit and at rest, key management that limits who can decrypt, minimisation of what is transferred, access controls and logging, and a documented policy of assessing, challenging and, where lawful and appropriate, refusing disproportionate government requests. You can request a copy of the transfer mechanism relevant to a specific recipient at [email protected].

11. How long we keep data

We keep personal data only as long as we need it for the purposes in section 8, or as long as the law requires. Where two rules apply, the longer governs, and where an open claim, dispute, investigation or preservation order exists, retention continues until it is resolved.

11.1 What happens when you delete a workspace or close your account

When the owner deletes a workspace, access ends at once: the workspace disappears for its members; its API keys, invitations and share links stop working; scheduled posts pause; and its Connect Vault (keys, Google tokens, picks and consents) is erased.

The rest of the workspace data is purged when you ask us at [email protected], or by Reach's retention process under the table above. The categories we are required or permitted to keep survive it, in the narrowest form that serves their purpose. An audit record of the deletion itself is retained, because a deletion you cannot evidence is a deletion you cannot prove.

To close your personal Reach account, write to [email protected] from the address you sign in with. https://reach-usa.com/data-deletion/ lists every way to delete data.

What we will not do: retain your content for our own use after the purge, or resurrect a deleted workspace for anyone other than its owner.

12. Your rights

Depending on where you live, you have some or all of the rights below.

12.1 How we handle a request

Verification. We will ask you to verify your identity before acting, in proportion to the sensitivity of what you are asking for. For a signed-in request, being signed in is usually enough. We will not ask for a government identity document unless the request cannot be verified any other way, and we delete anything you send for verification once the request is closed.

Timing. We respond within one month. Where a request is complex or you have made several, we may extend by a further two months and will tell you within the first month, with reasons. US state laws generally give 45 days with a 45-day extension; we apply whichever period is shorter for you.

Cost. Free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, in particular where it is repetitive, and we will explain why.

Refusals. We can refuse a request that is unlawful, that we cannot verify, or that would infringe someone else's rights. If we refuse, we will tell you why and how to challenge it.

Appeals. If we refuse, you may appeal by writing to [email protected] with the subject "Privacy Request Appeal". We will respond within the period your law provides. If you are a resident of a US state with a comprehensive privacy law, you may also complain to your state Attorney General; California residents may complain to the California Privacy Protection Agency.

12.2 Complaints

Tell us first if you can: [email protected]. We would rather fix it than litigate it. You may complain to a supervisory authority regardless. We have no establishment in the EEA, so there is no lead authority; you may complain to the authority where you live, where you work, or where you believe the infringement happened. You also have the right to an effective judicial remedy.

13. Cookies and similar technologies

Reach uses a sign-in cookie, a few short-lived cookies that protect sign-in and account connections, and browser storage for your own settings and unsaved work. https://reach-usa.com/cookies/ lists every item, its purpose and how long it lasts, and forms part of this policy. We honour the Global Privacy Control signal where it is presented.

14. Security

We apply technical and organisational measures proportionate to the risk, including:

• encryption in transit for all traffic, and encryption at rest for stored data;
• key management that limits which systems and which people can decrypt what;
• least-privilege access for staff, granted by role, reviewed periodically, and revoked immediately on role change or departure;
• logging of staff access to customer data, with the case that justified it;
• an append-only audit log of every connect, publish, disconnect and settings change;
• separation of duties, code review and change control for anything touching customer data;
• backup and tested restoration, with backups held under the same protections as production.

No system is perfectly secure. Protect your side of it: protect your Google or Apple sign-in with multi-factor authentication, keep your Google Authenticator recovery codes safe, and sign out on shared devices. We will never ask you for your password or for a key you saved.

If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours of becoming aware of it where the law requires, and we will notify you directly, without undue delay, where the breach is likely to result in a high risk to your rights and freedoms.

15. Children and minors

Reach requires you to be at least 16, or the age of digital consent in your country, whichever is higher, and able to enter a binding contract (Terms of Service, section 2).

We do not knowingly collect personal data from anyone below the applicable minimum age. If you believe an underage person is using the service, report it to [email protected]. Reports of this kind are prioritised. If we determine that an account belongs to someone below the minimum age, we close it and delete the data, retaining only what is necessary to prevent the account being recreated and to comply with any reporting obligation.

Where content involving the sexual exploitation of a minor is identified, we remove it, preserve the evidence, terminate the account and report it to the competent authorities, including the National Center for Missing & Exploited Children where applicable.

16. Changes to this policy

We will change this policy over time. When we do, the updated version is published here with a new date. For material changes we notify you before they take effect, in the service, by email, or both, with at least 30 days' notice. Where a change requires your consent, we ask for it, and processing under the new purpose does not begin until you give it.

The previous version is available on request at [email protected]. Continuing to use the service after a change takes effect means you accept it, except where consent is required.

17. How to contact us