Legal
Privacy Policy
Last updated: October 23, 2026
This policy explains what personal data we process when you visit reachlist.io, book a demo, write to us or use the Reachlist app (app.reachlist.io), why we process it and how to exercise your rights.
1. Who we are
Reachlist is published by RR OAKMONT LLC, a limited liability company registered in the State of New Mexico (United States), with its registered office at 1209 Mountain Rd Pl NE, Ste R, Albuquerque, NM 87110, United States. We are the controller of the visitor, prospect and customer data described in this policy.
For any question about your data or to exercise your rights, write to us at contact@reachlist.io.
2. What this policy covers
It applies to the reachlist.io website, the app.reachlist.io app, the emails we send you and our support.
It does not cover the data our customers import or collect in their own Reachlist workspace (their prospects, contacts and conversations): for that data we act as a processor, see section 5.
3. The data we collect
- Browsing the website and the app: pages viewed, button clicks, device and browser type, where the visit came from. With your consent, a visitor ID is kept in a cookie; without it, measurement is anonymous and cookie-free (see section 10).
- Booking a demo: first name, last name, email address, company, job title, team size, free-text message and the slot you pick.
- Chat and support: your name and email address if you provide them, and the content of your messages and support emails.
- Account: first name, last name, email address, phone number, job title, password (stored hashed, never in plain text), language and preferences.
- Company and billing: legal name, address, company or VAT number, chosen plan, payment history. Card details are entered directly with our payment provider: we only see the card brand, the last 4 digits and the expiry date.
- App usage: a log of sign-ins and important actions (IP address, date, action), used for security and support.
4. Why we use it
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the service and its features | Performance of the contract |
| Organize your demo and follow up about it | Steps taken at your request before a contract |
| Answer your chat and support messages | Legitimate interest in answering you, or performance of the contract if you are a customer |
| Keep you informed about your trial, account and billing | Performance of the contract |
| Invoice, keep accounts, answer requests from authorities | Legal obligation |
| Secure accounts, prevent fraud and abuse | Legitimate interest in protecting the service and its users |
| Measure audience with cookies to improve the website and the app | Your consent, which you can withdraw at any time |
| Measure audience anonymously, without cookies | Legitimate interest in improving our services |
We never sell your data and never use it for targeted advertising.
5. Your prospects’ data
The data you process in Reachlist (leads generated or imported, contacts, calls and their recordings, emails, messages, meetings, quotes and invoices) belongs to you. For that data, you are the controller and we act as a processor, only on your instructions and to provide the service. A data processing agreement (DPA) is available on request at contact@reachlist.io.
The leads Reachlist provides come from public sources (business listings, professional directories, public profiles and websites). You are responsible for having a legal basis to contact these people and for honoring their requests: the app helps with an exclusion list, an unsubscribe link you can add to your emails, and full deletion of a contact.
If you are a prospect contacted by a Reachlist customer, please send your request to the company that contacted you. You can also write to us: we will forward it and help them answer.
6. Who can access it
Only the members of our team who need it (support, engineering, billing) access your data. We also use providers, who only process it to deliver their service to us, under contract:
| Provider | Role | Data location |
|---|---|---|
| Vercel | Website and app hosting | European Union |
| Neon | Database | European Union |
| Stripe | Payments and subscriptions | European Union and United States |
| Twilio | Calling: numbers, calls, recordings | United States and European Union |
| Resend | Sending the app’s emails | United States |
| OpenAI | AI features (scripts, summaries, reply suggestions) | United States |
| Apify | Collecting public data for lead generation | European Union |
| PostHog | Audience measurement | European Union |
| Crisp | Chat and support | European Union |
- The services you choose to connect (Google, Microsoft, WhatsApp, Instagram, LinkedIn, X, HubSpot, Salesforce, Sellsy…) receive the data needed for the connection, under their own terms.
- Data sent to our AI providers is not used to train their models.
- The up-to-date list of our subprocessors is available on request at contact@reachlist.io.
7. Transfers outside the European Union
App data is hosted in the European Union. Some providers, and our company itself, are based in the United States: when data is transferred there, the transfer is covered by the European Commission’s standard contractual clauses, or by the EU–US Data Privacy Framework when the provider is certified.
8. How long we keep it
| Data | Retention |
|---|---|
| Account and workspace | For the duration of the subscription, then 90 days after cancellation (30 days after a trial that isn’t continued) so you can come back, then deleted |
| Invoices and accounting records | The period required by applicable accounting law (up to 10 years) |
| Demo request with no follow-up | 3 years after our last exchange |
| Support conversations | 3 years after our last exchange |
| Security logs | 12 months at most |
| Audience measurement cookies | 13 months at most; the statistics drawn from them, 25 months at most |
You can delete your contacts, leads and other data at any time from the app, or ask us to delete your account.
9. Security
Traffic is encrypted (HTTPS), passwords and access to connected services are stored encrypted, each organization is isolated and access rights depend on each user’s role. Sensitive actions are logged. If a data breach affects you, we will inform you as required by law.
10. Cookies and audience measurement
We use cookies needed for the website and the app to work and, only with your consent, audience measurement cookies (PostHog, hosted in the European Union), shared by reachlist.io and app.reachlist.io. No advertising cookies.
Each cookie, and how to change your choice, is described in our cookie policy.
11. Your rights
You can ask to access, correct, erase or port your data, or to restrict its processing, and you can object to processing based on our legitimate interest. When processing relies on your consent, you can withdraw it at any time.
Write to us at contact@reachlist.io: we answer within one month. We may ask you to prove your identity.
If you believe your rights are not respected, you can lodge a complaint with the data protection authority of your country; in France, the CNIL (www.cnil.fr).
12. Changes
This policy may change, for example when we add a feature or a provider. The date at the top of the page shows the latest update; for any significant change, we let you know by email or in the app.