Privacy Policy

1. Overview

ReachFlux, Inc. ("ReachFlux", "we", "our", or "us") operates the ReachFlux platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access the Service.

2. Data We Collect

2.1 Information You Provide

When you create an account, use our Service, or contact us, we may collect:

• Account information: Name, email address, company name, job title, and password.
• Billing information: Credit card details and billing address (processed securely via Stripe — we never store raw card numbers).
• Campaign data: Email content, contact lists, templates, and outreach sequences you create.
• Communications: Messages you send to our support team or through our platform.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, time spent, clicks, and navigation patterns.
• Device information: IP address, browser type, operating system, and device identifiers.
• Cookies and tracking: Session cookies, preference cookies, and analytics identifiers (see Section 5).
• Email engagement: Open rates, click rates, and reply data for campaigns you send.

2.3 Information from Third Parties

• Google account and Calendar data: When you voluntarily connect your Google account, Reach Flux may receive OAuth authorization information and access Google Calendar event data as necessary to provide user-authorized scheduling functionality, including creating and managing meeting events.
• CRM integrations: CRM data from Salesforce, HubSpot, or Pipedrive when you connect those integrations.
• Public data: Publicly available professional data used to power the Lead Finder feature.

Data Type	Purpose	Retention
Account data	Service delivery & authentication	Until account deletion
Campaign data	Outreach & reporting	Until account deletion
Usage analytics	Product improvement	24 months
Support messages	Customer service	36 months
Billing records	Legal compliance	7 years

3. How We Use Your Data

We use the data we collect to:

• Provide, operate, and maintain the ReachFlux platform.
• Process transactions and send billing receipts.
• Personalize your experience and improve our product.
• Send product updates, security alerts, and support messages.
• Detect, prevent, and respond to fraud or abuse.
• Comply with legal obligations and enforce our Terms of Service.
• Analyze usage trends to improve platform performance.

4. Data Sharing

We may share your data only in these limited circumstances:

• Service providers: Trusted vendors who help us operate the platform (e.g., Stripe for payments, AWS for hosting, Intercom for support). All vendors are contractually bound to protect your data.
• Integrations you authorize: When you connect Salesforce, HubSpot, or other tools, we share data necessary to power those integrations — only with your explicit authorization.
• Legal requirements: If required by law, court order, or governmental authority, we may disclose data. We will notify you unless prohibited from doing so.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred. We will notify you 30 days in advance and provide opt-out options.
• With your consent: For any other purpose with your explicit permission.

5. Google API Data & AI/ML Use

5.1 Google Calendar Integration

Reach Flux allows users to voluntarily connect their Google account to enable Google Calendar functionality. Google Calendar access is requested only after the user explicitly initiates the connection and grants permission through Google's OAuth consent process.

When authorized, Reach Flux may use the Google Calendar API to create and manage meeting events on behalf of the user. This access is used only to provide calendar and meeting-scheduling functionality requested or enabled by the user.

5.2 Auto-Pilot and AI

Reach Flux includes an AI-powered Auto-Pilot feature. When enabled by the user, Auto-Pilot may analyze outreach conversations and determine that an action, such as scheduling a meeting, should be performed.

Auto-Pilot does not directly access or call the Google Calendar API. When Auto-Pilot determines that a meeting should be scheduled, it dispatches a scheduling action to the Reach Flux application. The Reach Flux backend then performs the authorized Google Calendar API request and creates or manages the calendar event on the user's behalf.

5.3 AI Service Providers

Reach Flux uses third-party AI inference services, including Groq, to provide certain AI-powered functionality. AI models are used for tasks such as analyzing outreach conversations, determining appropriate actions, and generating responses.

Google Workspace API data obtained through the Google Calendar API is not transmitted to our third-party AI service provider. AI determines the appropriate scheduling action from the outreach conversation, while Google Calendar API operations are performed independently by the Reach Flux backend.

5.4 Google API Limited Use Disclosure

Reach Flux does not sell Google user data or use Google Workspace API data for advertising purposes.

Reach Flux's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Users can revoke Reach Flux's access to their Google account at any time through their Google Account settings.

6. Cookies & Tracking

We use cookies and similar tracking technologies to:

• Essential cookies: Required for the platform to function (authentication, sessions). Cannot be disabled.
• Analytics cookies: Help us understand how you use the product (via a privacy-first analytics tool). Can be opted out of in your account settings.
• Preference cookies: Remember your settings and preferences. Can be cleared via your browser.

You can manage cookie preferences in your browser settings or via the Cookie Settings link in the footer. Disabling essential cookies will prevent the platform from functioning correctly.

7. Data Storage & Security

ReachFlux is SOC 2 Type II certified. Our security practices include:

• All data encrypted at rest (AES-256) and in transit (TLS 1.3).
• Data hosted on AWS infrastructure in US-East and EU-West regions.
• Regular third-party penetration testing and vulnerability assessments.
• Role-based access controls — only engineers who need access to data have it.
• Incident response plan with defined notification SLAs.

While we implement industry-standard safeguards, no system is 100% secure. If you discover a security vulnerability, please contact us at security@reachflux.io.

8. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of all data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and all associated data. We will process within 30 days.
• Portability: Export your data in a machine-readable format (JSON or CSV).
• Objection: Object to data processing based on legitimate interests.
• Restriction: Request we limit how we process your data in certain circumstances.

To exercise any of these rights, email us at privacy@reachflux.io or use the Data & Privacy section in your account settings.

9. GDPR & International Transfers

If you are located in the European Economic Area (EEA), UK, or Switzerland, we process your data under the following legal bases:

• Contract performance: To deliver the services you subscribed to.
• Legitimate interests: To improve our product, prevent fraud, and conduct analytics.
• Legal obligation: Where required by applicable law.
• Consent: For marketing communications and optional analytics.

When transferring data outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Data Processing Agreements (DPAs) are available on request.

Our EU representative can be reached at gdpr@reachflux.io.

10. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal information, please contact us and we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Sending an email to the address associated with your account at least 14 days before changes take effect.
• Displaying a prominent notice in the ReachFlux dashboard.
• Updating the "Last updated" date at the top of this page.

Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: