Privacy Policy

Last updated: October 22, 2026

This policy explains how ReachReport collects, uses and protects personal data. We never sell your personal data.

1. Who we are

ReachReport is operated by Laurent Bedubourg EI, 3 avenue des Pyrénées, 44400 Rezé (France), SIREN 539947960 (“ReachReport”, “we”, “us”).

For privacy questions or requests, contact privacy@reachreport.io.

2. Our role

For data about our own users and customers (account, billing and usage data), ReachReport is the controller.
For personal data contained in content that customers add to the Service, ReachReport acts as a processor on behalf of the customer. A Data Processing Agreement is available on request.

3. Data we collect

We collect data directly from you (when you sign up, use the Service, contact us, book a call or fill in a form) and automatically (technical data when you use the website or app).

Account data: name, email address and, where provided, company name and address.
Billing data: company details, VAT number, invoices and credit notes. Card payments are processed by Stripe; we do not store card data.
Technical data: IP address (also used to meet EU VAT rules), browser and device information, pages visited, referring URL, language preference and access times.
Customer content: URLs, clips, uploaded PDFs, text added by customers and reports. ReachReport is designed for reporting on published media coverage.
Contact and sales data: name, email address, company and the content of messages when you contact us, book a call or fill in a form.

4. Why we use it (legal basis)

To provide the Service and manage your account and billing (performance of a contract).
To meet legal obligations such as tax and accounting rules (legal obligation).
To secure and improve the Service and understand how it is used (legitimate interest).
To respond to enquiries, schedule calls and follow up with prospective customers (legitimate interest).
To send you service-related communications and news about ReachReport features (legitimate interest; you can unsubscribe at any time).

5. Sub-processors

We share data only with service providers that help us run the Service, under contracts that require them to protect it:

Sub-processor	Purpose	Location
Scaleway	Hosting and database	France (EU)
OpenAI	Data extraction from uploaded PDFs	USA
Google Workspace	Email	Global (Google data centers, including EU and USA)
Stripe	Payments	Ireland (EU) / USA
Plausible	Website analytics (no cookies)	EU
Amazon SES	Account and notification emails	Europe (Ireland)
Calendly	Scheduling calls	USA
Typeform	Contact and request forms	EU

We may share aggregated, anonymised data that does not identify any person or customer, for example for industry research or benchmarks.

We may also disclose data when required by law or by a competent authority, or to investigate fraud, security issues or breaches of our Terms.

6. International transfers

Customer data is hosted in the EU. Some sub-processors (OpenAI, Google Workspace, Stripe, Calendly) may process data outside the EU, mainly in the USA. These transfers are covered by Standard Contractual Clauses in each provider’s data processing terms.

7. Artificial intelligence

We use AI (OpenAI) only to extract information from PDFs that customers upload. OpenAI retains API inputs and outputs for up to 30 days for abuse monitoring. Customer data is not used to train AI models.

8. How long we keep data

Account data and customer content are kept as long as the account exists.
You can request deletion of your account by emailing privacy@reachreport.io. We verify that the request comes from the account owner, then delete the account and all associated data within 7 days. Deleted data is removed from backups within 7 days.
Accounts without an active paid subscription and with no login for 365 days are deleted, together with all associated data.
Contact and sales data of people who do not become customers is deleted within 24 months of the last contact.
Billing records are kept as long as required by law.

9. Security

Data is hosted by Scaleway in France (EU), which is ISO/IEC 27001 certified. Data is encrypted in transit (HTTPS) and database backups are stored encrypted. Servers are protected by network isolation, databases are not exposed to the internet, and access to customer data is limited to authorised people bound by confidentiality. More detail is available on our Security page.

10. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing. You can withdraw consent at any time. To exercise these rights, email privacy@reachreport.io.

If you believe we have not handled your data correctly, you can also lodge a complaint with a data protection authority, such as the CNIL in France.

11. Cookies

We only use storage that is strictly necessary for the Service to work, such as keeping you signed in. We do not use advertising or tracking cookies. Our website analytics (Plausible) is cookieless and does not collect personal data.

Strictly necessary storage does not require your consent. You can block it in your browser settings, but parts of the Service, such as signing in, will then not work.

12. YouTube

The Service uses YouTube API Services to retrieve data about YouTube videos. Google’s Privacy Policy applies: https://policies.google.com/privacy

13. Changes to this policy

We will notify account owners of material changes at least 30 days before they take effect.