Privacy Policy

Last updated: July 4, 2026

This policy applies to ReachHighly operated by ReachHighly Ltd ("we", "us", "our"). We are committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA).

1. Data Controller

ReachHighly Ltd is the data controller for personal data processed through this platform and website. Contact: hello@reachhighly.com

2. Information We Collect

Account information: Name, email address, company name, and password (hashed and never stored in plain text) when you register.

Campaign data: Email addresses of recipients you upload, campaign content you create, and sending activity (sent, opened, clicked, replied).

Payment information: Billing is handled by LemonSqueezy. We do not store card numbers or payment details — only your plan status and subscription ID.

Usage data: IP address, browser type, device type, pages visited, session duration, and timestamps. Used for security, debugging, and aggregate analytics.

Communications: Emails you send us, support requests, and feedback.

3. How We Use Your Information

Provide the service — Legal basis: Contract performance. Running your account, campaigns, and email sending.
Security & fraud prevention — Legal basis: Legitimate interest. Detecting abuse, unauthorized access, and spam misuse.
Platform improvements — Legal basis: Legitimate interest. Analysing usage patterns to improve features (aggregated, not individual).
Billing & payments — Legal basis: Contract performance. Processing subscriptions via LemonSqueezy.
Transactional emails — Legal basis: Contract performance. Sending verification emails, password resets, and billing receipts.
Legal compliance — Legal basis: Legal obligation. Retaining records as required by applicable law.
Analytics (with consent) — Legal basis: Consent. Understanding site traffic via Vercel Analytics.

4. Data Sharing & Third Parties

We do not sell your personal data. We share data only with:

CockroachDB (Cockroach Labs) — Database hosting — your data is encrypted at rest and in transit
Vercel — Application hosting and deployment
LemonSqueezy — Payment processing — processes billing data under their own privacy policy
Resend — Transactional email delivery (verification, password reset)
Amazon Web Services (AWS SES) — Campaign email delivery infrastructure
Google (reCAPTCHA) — Bot detection on registration form — subject to Google's Privacy Policy

All processors operate under Data Processing Agreements where required by GDPR.

5. Data Retention

Account data: Retained while your account is active and for 30 days after deletion request
Campaign & send logs: Retained for 24 months for deliverability and compliance records
Billing records: Retained for 7 years as required by financial regulations
Security logs: Retained for 90 days

6. Your Rights (GDPR / UK GDPR)

If you are in the EEA or UK, you have the following rights:

Right to access: Request a copy of all personal data we hold about you
Right to rectification: Correct inaccurate or incomplete data
Right to erasure: Request deletion of your data ('right to be forgotten')
Right to restrict processing: Limit how we use your data in certain circumstances
Right to data portability: Receive your data in a machine-readable format
Right to object: Object to processing based on legitimate interest or for direct marketing
Right to withdraw consent: Withdraw consent at any time for consent-based processing (e.g. analytics cookies)
Right to lodge a complaint: File a complaint with your national data protection authority

To exercise any of these rights, email us at hello@reachhighly.com. We will respond within 30 days.

7. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

Know what personal information we collect, use, disclose, and sell
Delete your personal information (with certain exceptions)
Opt out of the sale of your personal information — we do not sell personal data
Non-discrimination for exercising your rights

To submit a CCPA request, email hello@reachhighly.com with "CCPA Request" in the subject line.

8. Cookies

We use cookies for authentication, security, and optional analytics. You can manage your preferences via our cookie banner or browser settings. See our full Cookie Policy for details.

9. International Data Transfers

Your data may be processed in countries outside the EEA (including the United States) by our service providers. Where this occurs, we ensure adequate safeguards are in place via Standard Contractual Clauses (SCCs) or equivalent mechanisms recognised under GDPR.

10. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, bcrypt password hashing, JWT session tokens with expiry, and regular security monitoring. No transmission over the internet is 100% secure; we cannot guarantee absolute security.

11. Children's Privacy

ReachHighly is a B2B platform intended for users 18 and older. We do not knowingly collect data from children under 16. If you believe a child has provided us personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email and by updating the "Last updated" date above. Continued use after changes constitutes acceptance of the updated policy.

13. Contact & Complaints

Email: hello@reachhighly.com
Website: www.reachhighly.com

If you are in the UK or EEA and are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority (in the UK: the Information Commissioner's Office at ico.org.uk).