Privacy Policy
Last updated 9 November 2026
Reach helps businesses find the right people and send them personal emails from their own mailbox. This policy explains what we collect, why, who helps us and how you can see or delete it. Questions go to privacy@reachcrew.app.
1. Who we are
Reach is run by Grovio Labs Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States ("Grovio Labs", "we"). Grovio Labs is responsible for the data of the people who use Reach. For the people our customers choose to contact, the customer decides who to contact and why, and Reach handles that data on the customer's behalf. Grovio Labs is also responsible for two things Reach keeps across customers: a shared cache of public professional data and the do-not-contact list.
2. What we collect
If you use Reach
| Data | Why |
|---|---|
| Your account: name, work email, profile picture from Google if you sign in with Google, your role and team invites | To sign you in and run your workspace |
| Your workspace: company name, business address, the short line about what your company does (you can let Reach draft it from your website) | Your business address goes in the footer of every first email, as anti-spam laws require. The about line helps write emails that fit your business |
| Your goals and campaigns: who you want to reach, where, and your offer | To find the right people and write to them |
| Drafts, your edits, approvals, and the emails sent and received through your mailbox connection | To send what you approve and show you the replies |
| Calendar connection, if you add one (section 3) | To offer meeting times and send invites you approve |
| Credits and billing: your plan, the credits each action used, invoices. Card details are handled by our payments provider and never reach us | To bill you correctly and show you where credits went |
| Service logs: requests, errors, IP address, browser, security events | To keep Reach running, secure and debuggable |
If a Reach customer contacted you
| Data | Where it comes from |
|---|---|
| Name, job title, employer, work location and public profile links | Professional data providers and public web pages (section 6) |
| Work email address and whether it can receive mail | Email verification providers, plus a check of your company's mail servers |
| Things you said in public, such as posts, articles, talks and your company's pages | Public web pages, so the email can refer to something you actually said |
| The emails sent to you, your replies, and whether an email was opened, clicked, bounced or unsubscribed | The sender's mailbox connection (section 4) |
We never read people-search or data-broker sites about you (home address, relatives, phone), and drafts that cite them are refused.
3. Google user data
Reach asks Google only for what each feature needs:
| Feature | Google scopes | What Reach does with it |
|---|---|---|
| Sign in with Google | userinfo.email, userinfo.profile | Reads your email address, name and profile picture to create and sign in to your account. |
| Connect Google Calendar | calendar.events, calendar.events.freebusy | Reads your busy and free times so a reply draft can offer slots you are actually free, and creates the meeting invite (Google sends it) when you approve a reply with an invite. Reach does not read the content of your other events. |
Reach does not connect to Gmail through its own Google access. Gmail sending goes through Fast Mail Tracker with its own Google consent (section 4).
Reach's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice that means we use Google user data only to provide the features above that you can see. We do not sell it, use it for advertising, or use it to train AI models. We share it only with the subprocessors needed to run those features (for example, the free times offered in a reply draft are part of what our AI provider writes from). People at Grovio Labs do not read it unless you ask us to, it is needed for security or to comply with the law. Calendar tokens are stored encrypted, and you can disconnect at any time in Settings or from your Google Account.
4. Your mailbox connection
Reach sends your emails through Fast Mail Tracker, run by The Seness Company, which connects to your Gmail with your permission. Reach never sees your Gmail password and keeps only an encrypted access grant from Fast Mail Tracker, which ends when you disconnect. Fast Mail Tracker shares with Reach only the threads Reach started: the emails Reach sent for you, and the opens, clicks, replies, bounces and unsubscribes on them. Nothing else in your mailbox is shared with Reach. You agree to this sharing before you connect, and you can disconnect at any time.
First emails are tracked for opens and clicks so you can see what landed. Replies are read so the conversation shows up in Reach and so a "please stop" reply is honoured at once.
5. How Reach uses AI
Reach uses AI models from Anthropic (Claude), with Amazon Bedrock as a backup, to understand your goal, judge whether a person fits, draft emails in the recipient's language and suggest replies. The model sees what it needs for that one task: your goal and offer, the person's professional details and their public words. Our providers do not use this data to train their models under their commercial terms, and neither do we. You review and approve every email before it is sent.
6. Who helps us run Reach (subprocessors)
| Company | What they do for Reach |
|---|---|
| Amazon Web Services | Hosting, database, file storage, backups, logs, and Amazon Bedrock (AI backup) |
| Cloudflare | Network edge, DNS, TLS and hosting of the Reach web app and this site |
| Anthropic | AI models that draft and assess (section 5) |
| Firecrawl | Finding people and companies, web search and reading public pages, and email verification through its data marketplace |
| Hunter | Email verification and professional data (usually reached through Firecrawl) |
| Crustdata | Professional profiles and public posts, when enabled |
| Fast Mail Tracker (The Seness Company) | Sending from your Gmail and reporting opens, clicks, replies, bounces and unsubscribes |
| Resend | Reach's own service emails to you: sign-in codes, invites, receipts and notices |
| Dodo Payments | Checkout, subscriptions, invoices and tax, as merchant of record |
| Slack | Internal alerts to our own team when something in Reach needs attention |
If you connect them, Google (Sign in with Google, Google Calendar) and Cal.com (with your own API key) also receive the requests needed for those features. We will update this list before adding a new subprocessor.
7. How long we keep it
| Data | Kept |
|---|---|
| Your workspace (account, campaigns, people, drafts, messages, replies, credits) | While your workspace exists. Deleted when you delete the workspace or your account. Items you delete inside Reach are hidden at once and removed for good within 90 days |
| Copies of messages waiting in the send queue | 14 days after delivery |
| Log of Reach's own service emails | 6 months |
| Data export archives | 7 days, then deleted. Download links last 15 minutes |
| Shared cache of public professional data | Until it expires or the person asks to be forgotten, so we do not buy the same public data twice |
| Do-not-contact list | Indefinitely, as one-way keyed hashes only (never the address or name), so a forgotten person stays forgotten |
| Service logs | 365 days |
| Encrypted database backups | 35 days, with a copy in a second US region |
| Billing and invoice records | As long as tax and accounting law requires |
8. Your choices and rights
- Download your data: workspace owners can download everything in their workspace from Settings, Data & privacy, as one archive.
- Delete: you can delete your account, and owners can delete the whole workspace, from Settings, Data & privacy. Deleting a workspace also disconnects its calendar and mailbox grants, cancels its subscription and removes its files.
- Forget a person: owners and admins can forget anyone by email address. Reach deletes what the workspace holds about them, stops queued emails and adds them to the do-not-contact list.
- Everything else (access, correction, objection, restriction, portability, or a complaint): email privacy@reachcrew.app. We answer within 30 days. You can also complain to your local data protection authority.
9. If you received an email sent with Reach
Every first email names the sender's business and address and includes an easy way to opt out. You can:
- Unsubscribe with your mail app's unsubscribe button, or simply reply "stop" or "unsubscribe". That sender's workspace will not email you again.
- Ask to be forgotten from the unsubscribe page. Once you confirm from your own inbox, Reach deletes what it holds about you, cancels any queued email to you from any Reach customer and adds you to the do-not-contact list, so no one using Reach finds or emails you again.
- Email us at privacy@reachcrew.app for anything else. If a Reach customer contacted you, you can also ask them directly, since they chose to contact you.
10. Cookies
The Reach app uses only the cookies it needs to keep you signed in and to protect forms. There are no advertising or cross-site tracking cookies. This website sets no cookies at all.
11. Where your data is processed
Reach runs in the United States (AWS, us-east-1, with backups in us-west-2). Our subprocessors may process data in other countries. Where data about people in the EU, EEA, UK or Switzerland leaves those regions, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.
12. Legal bases (EU, EEA and UK)
We process your account data to perform our contract with you, and service logs and security data for our legitimate interest in running a safe service. For people our customers contact, the customer relies on its own legitimate interest in relevant business-to-business outreach and is responsible for respecting objections, which Reach makes easy and automatic.
13. Security
Data is encrypted in transit and at rest, each workspace is isolated in the database, and access grants are encrypted. More on our Security page.
14. Children
Reach is a business tool and is not meant for anyone under 16. We do not knowingly collect children's data.
15. Changes
When this policy changes we update the date at the top, and for material changes we tell workspace owners by email before the change takes effect.
16. Contact
Grovio Labs Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Email privacy@reachcrew.app.