Data processing addendum

This addendum ("DPA") forms part of the terms of service between you (the controller) and GSM MEDIA S.R.L ("Reachiz", the processor). It covers personal data you upload, search for, enrich or message through Reachiz ("Customer Data"). It does not cover data Reachiz controls itself, such as your account and billing records, which the privacy policy describes.

Roles

You decide why and how lead and campaign data is processed. Reachiz processes that data only to provide the service: lead search and enrichment, LinkedIn and email sequences, inbox sync, webhooks, the API and the MCP endpoint. Reachiz does not sell Customer Data. Drafting and agent features send text to OpenAI through Cloudflare AI Gateway. OpenAI does not train on API data. Both are listed with the other subprocessors below.

Your instructions

Using the product, including connecting senders, importing lists, running searches and sending sequences, is your instruction to process Customer Data for those purposes. Extra written instructions must be agreed in writing and must be lawful.

What we process

• Business contact data: names, titles, companies, email addresses, phone numbers and profile URLs.
• Campaign data: sequences, messages, send events and replies.
• Sender credentials you connect, used only to send and sync on your behalf. Every LinkedIn account runs in Reachiz's cloud browser, through a residential proxy in the account's country. We store the session cookie, and for password sign-in the password and authenticator secret, encrypted, so we can run that session.

Data subjects are the business contacts in your lists and the people who reply to your outreach.

Security

Reachiz limits access to people and systems that need it to run the service. Customer Data stored with Convex and Cloudflare is covered by the controls those providers publish, including the encryption they provide. Traffic to the product uses HTTPS. LinkedIn session secrets are stored encrypted, as described above. You are responsible for who you invite into your workspace.

Subprocessors

Reachiz uses these subprocessors to deliver the service. Each processes Customer Data only as needed:

• Convex: Application database and backend functions
• Cloudflare: Hosting, CDN and cloud worker compute
• Stripe: Payments and subscription billing
• WorkOS: Authentication and organization management
• Resend: Transactional email delivery
• OpenAI: AI models for drafting and agent features, reached through Cloudflare AI Gateway. OpenAI does not train on API data
• Evomi: Residential proxies for cloud LinkedIn senders
• 2Captcha: Captcha solving for LinkedIn session handling
• IPinfo: IP geolocation for session security checks
• PostHog: Product analytics

We will update this list before adding a subprocessor that processes Customer Data in a new way. Continued use of the service after that update is acceptance. You may object on reasonable data-protection grounds by emailing support@reachiz.com; if we cannot accommodate the objection, you may cancel.

International transfers

Where a subprocessor processes Customer Data outside the EEA, Reachiz relies on an adequacy decision or on standard contractual clauses.

Assistance and rights requests

If a data subject contacts Reachiz about Customer Data, we will forward the request to you. We will help you answer access, deletion, correction and portability requests, and help with data-protection impact assessments, to the extent the product already lets you export or delete that data.

Incidents

If we learn of a personal-data breach affecting Customer Data, we will notify you without undue delay, with what we know about the nature of the breach, the data involved and the steps we are taking.

Deletion

You can delete leads, campaigns and connected senders in the product. When you close your account, we delete Customer Data after a short backup window, except where the law requires us to keep a record (for example invoices).

Audits

You may ask for an audit on reasonable request, at your cost. We will answer reasonable questions about how we process Customer Data. We do not grant open-ended access to production systems.

Contact

GSM MEDIA S.R.L. support@reachiz.com