Privacy Policy

01 Who we are

Reachly is a Danish company that offers two AI-driven services: Reachly Marketing (automatic publishing of content on social media platforms) and Reachly Build (an operations system for trade businesses with an associated job marketplace where homeowners can get quotes).

Data controller:
Reachly
Bryggerivej 11
4622 Havdrup, Denmark
CVR (Danish company reg. no.): 33122543
Email: support@reachlyai.dk

02 What data we collect

We process the following categories of information — some are stored on our server, others only locally in your browser:

• Account information (server): Name and email address when you create an account. Your password is never stored in plain text — only as a cryptographic hash (scrypt with salt) that cannot be turned back into the password.
• Business data in Reachly Build (server): The information your business enters itself to run the business — projects, quotes, customers, scheduling, hours, invoice overviews, conversation notes and the like. Data is separated per business and can only be seen by your own account.
• Replies to quotes (Reachly Build): If a business sends a quote with a link, the recipient can see the quote and reply to it without logging in. The reply, the name the recipient writes when accepting, any message and the time are stored with the quote on the business's account, and the business is notified by email. An issued invoice likewise has a link where the recipient can see the invoice and the payment details without logging in.
• Office logins (Reachly Build): If a business gives a person an office login, we store the person's name and email address and send an invitation to that email. The invitation expires after 7 days. If the person starts using the login, the password is stored as a salted hash like other accounts. The login is deleted when the business removes it, when the person is removed from the business's employee list, when the person deletes it themselves, or when the business's account is deleted.
• The job marketplace (server): If you create a job as a homeowner, we store your job description, your name and phone number (and your email, if given). Your phone number is never shown publicly or to bidding tradespeople — it is only given to the one tradesperson you choose yourself. Tradespeople's bids are private and are only shown to the owner of the job.
• Images for AI assessment: Images you upload for a quote assessment are sent to our AI provider to make the assessment, but are not stored on our server.
• Content data in Reachly Marketing (server): Your business profile and the texts for your posts are stored on our server, linked to your business. This is necessary so your content follows you when you switch device or clear your browser — and so scheduled posts can be published on time. Your browser keeps a local copy so the app is quick to use.
• Platform access (server, encrypted): Access tokens for the social media accounts you connect (e.g. Facebook Pages) are stored on our server in encrypted form (AES-256-GCM). This is necessary so scheduled posts can be published at the agreed time, even when your browser is closed. They are used only to publish the content you approve. If you disconnect an account — or delete your account — the token is removed from the server immediately.
• Payment information: Card details and billing address are handled and stored exclusively by our payment provider Stripe and are never stored by us.
• Technical data: Your IP address is processed briefly on the server to protect against abuse (rate limiting). It is not stored permanently and is not linked to your account.
• Enquiries (server): If you write to us via the contact form, we store your name, your email address and your message on the server so we can answer and document the enquiry.
• Reachly Startup (server): If you sign up for Startup, we store your email address, your password as a salted hash, and the business idea and plan you choose to save — so you can come back to it. Startup has its own login cookie (reachly_startup, 180 days), separate from Marketing and Build. Your idea is only used to create your own plan; it is not shared with other users, and it is not used to train AI.

03 How we use your data

We use your personal data for the following purposes:

• To provide and operate our service, including publishing content on your behalf when you ask us to.
• To generate AI texts and recommendations: the text and profile information you enter is sent via our server to our AI provider and is used only to generate your answer.
• To handle payment and billing via Stripe.
• To answer enquiries and provide support.
• To protect the service against abuse.
• To meet legal obligations.

04 Sharing with third parties

We only share your data with third parties in the following cases:

• Social media platforms: When you ask Reachly to publish content, the relevant content is shared with the selected platforms (e.g. Facebook, Instagram and TikTok) via their official APIs.
• AI provider: Anthropic (Claude API) is used to generate texts and recommendations. Content is sent encrypted and is not used for model training.
• Telephony (AI Reception in Reachly Build): If your business activates AI Reception, incoming phone calls are handled via Twilio (USA). Twilio processes the caller's phone number and speech so the call can be answered automatically, and the content of the conversation is sent to Anthropic (Claude) so the caller can be answered. The conversation is not recorded as audio — it is converted to text as it happens. The summary and message are stored on your Reachly Build account and sent to the business owner by email (via Resend). The caller is told that it is a digital assistant.
• Payment provider: Stripe handles all payment transactions securely and in accordance with the PCI DSS standard.
• Card payment on invoices (Reachly Build, optional): If a business connects its own Stripe account, its customers can pay invoices by card on a payment page at Stripe. Reachly sends the invoice number, the amount and the customer's email address to Stripe to create the payment page; the card details are entered at Stripe and are never seen by Reachly. The payment is made to the business's own Stripe account, and Stripe processes payment data under Stripe's privacy policy. Reachly stores that the invoice was paid by card, the amount, the time and Stripe's reference to the payment.
• Hosting provider: Our server and database are hosted by Railway Corporation (USA), which processes the traffic and data that pass through the platform.
• Email provider: Transactional emails (e.g. welcome and password reset emails) are sent via Resend (USA). If you ask to receive the result of our free Business Check by email, that one email is also sent via Resend; the address is used only for that email and is not stored by Reachly.
• Backup: A daily backup of the database is stored with Cloudflare, Inc. (R2 object storage with EU jurisdiction), so your data can be restored if our hosting provider loses it. The copies are encrypted in transit and are deleted automatically after 30 days.
• Accounting (Reachly Build, optional): If you connect your e-conomic accounts, Reachly sends the invoices you ask for as drafts to Visma e-conomic (Denmark) via their official API: the customer's name, address, email and CVR/EAN number, the invoice lines, amounts and dates. The access token is stored encrypted by us and is removed when you disconnect.
• Email and domain: Our employees' mailboxes and our domains are hosted by Simply.com (Denmark). If you write to us, your enquiry may therefore be processed there.
• Fonts: Our pages load fonts from Google Fonts, which technically means your IP address is shared with Google when the page loads.

Transfers to third countries: Several of our data processors (Railway, Anthropic, Stripe, Resend, Twilio, Cloudflare) are based in the USA. Transfers take place on the basis of the European Commission's Standard Contractual Clauses (SCC) and/or the EU-U.S. Data Privacy Framework, where the provider is certified.

We never sell, rent or trade your personal data.

05 Social media and API access

When you connect your social media accounts to Reachly, you give us access to publish content on your behalf. Specifically:

• We only request the permissions that are necessary to publish content and show your pages.
• Access tokens are stored on our server in encrypted form (AES-256-GCM) and are used only to publish the content you approve. Server storage is necessary so scheduled posts can be published at the agreed time, even when your browser is closed. The token is never shown again in any user interface.
• You can disconnect your social media accounts from your Reachly profile at any time; this deletes the token from our server immediately. The same happens if you delete your account.
• You can also always revoke Reachly's access directly in each platform's own settings (e.g. Facebook's "Apps and websites").

YouTube. When you connect a YouTube channel, Reachly uses YouTube API Services. By connecting the channel, you also agree to the YouTube Terms of Service, and Google's processing of your data is covered by the Google Privacy Policy.

• What we access: the channel's name, ID and profile picture, so you can see which channel is connected (the youtube.readonly permission), and the videos with title, description and visibility that you yourself choose to publish via Reachly (the youtube.upload permission). We do not read your comments or your statistics, and we do not delete or change your existing videos.
• How we use and store it: The access token is stored encrypted as described above and is used only to upload the content you have approved and to show the channel's name in Reachly. We store the IDs of the videos Reachly has published so you can find them again; no other YouTube data is stored.
• Sharing: YouTube data is not shared with anyone other than Google/YouTube and our hosting provider (see “Sharing with third parties”). Reachly does not show ads.
• Revoking access: If you disconnect YouTube in Reachly, we delete the token immediately and other YouTube data within 7 days. You can also revoke access in Google's security settings; we then delete the associated YouTube data within 30 days.
• Questions: write to support@reachlyai.dk.

Google Business Profile. When you connect your Google Business Profile (your business's profile on Google Search and Maps), Reachly requests the business.manage permission via Google's login. Google's processing of your data is covered by the Google Privacy Policy.

• What we access: the name of your Business Profile account and your business profiles (locations), so you can choose which profile is connected; the reviews customers have written on the profile (stars, text, the reviewer's display name and the date); and the posts you yourself choose to publish on the profile via Reachly.
• How we use it: The reviews are shown only to you in Reachly, so you can read them in one place and reply to them. A reply is only published when you yourself click Send reply — Reachly never replies automatically. Posts are only published when you yourself click Publish.
• How we store it: The access token is stored encrypted as described above. Reviews are fetched from Google each time you open the page and are not stored permanently by us. We store the name of the connected profile and the IDs of the posts Reachly has published.
• Sharing: Data from Google Business Profile is not shared with anyone other than Google and our hosting provider (see “Sharing with third parties”). If you yourself choose to let Reachly's AI suggest a reply to a review, the text of the review is sent to our AI provider (Anthropic) to make the suggestion; it is not stored there. Reachly does not sell data and does not show ads.
• Revoking access: If you disconnect Google Business Profile in Reachly, we delete the token immediately and other Google data within 7 days. You can also revoke access in Google's security settings.

Reddit. When you connect your Reddit account, Reachly requests the identity and submit permissions via Reddit's login. Reddit's processing of your data is covered by the Reddit Privacy Policy.

• What we access: your Reddit username (identity), so you can see which account is connected and so posts without a chosen subreddit can go to your own profile; and the right to create the posts you yourself choose to publish via Reachly (submit). We do not read your messages, comments, votes or other users' content, and we do not fetch data from Reddit for analysis or AI training.
• How we use and store it: The access token is stored encrypted as described above and is used only to publish the content you have approved. We only store your username while the connection is active. IDs, titles and other content from your Reddit posts are not stored by us.
• Sharing: Reddit data is not shared with anyone other than Reddit and our hosting provider (see “Sharing with third parties”). Reachly does not sell data and does not show ads.
• Revoking access: If you disconnect Reddit in Reachly, we delete the connection (token and username) immediately. If you instead revoke access under apps in Reddit's settings, or delete your Reddit account, we detect it in our daily check and delete the connection within 24 hours.

LinkedIn company pages. When you connect your business's LinkedIn page, Reachly requests the rw_organization_admin and w_organization_social permissions via LinkedIn's login. LinkedIn's processing of your data is covered by the LinkedIn Privacy Policy.

• What we access: the name and ID of the LinkedIn pages you are an administrator or content administrator of, so you can choose which page Reachly publishes on; and the right to publish the posts you yourself choose, as the page. We do not read the page's followers, comments, messages or statistics, and we do not change the page's information, settings or administrators.
• How we use and store it: The access token is stored encrypted as described above and is used only to publish the content you have approved. We store the names and IDs of your pages while the connection is active.
• Sharing: LinkedIn data is not shared with anyone other than LinkedIn and our hosting provider (see “Sharing with third parties”). Reachly does not sell data and does not show ads.
• Revoking access: If you disconnect the LinkedIn page in Reachly, we delete the connection (token and the pages' names) immediately. You can also revoke access in LinkedIn's settings under permitted services.

Threads. When you connect your Threads profile, Reachly requests the threads_basic and threads_content_publish permissions via Threads' login. Meta's processing of your data is covered by the Threads Privacy Policy.

• What we access: your Threads username and ID (threads_basic), so you can see which profile is connected; and the right to publish the posts you yourself choose (threads_content_publish). We do not read your replies, followers, messages or statistics.
• How we use and store it: The access token is stored encrypted as described above, is renewed before it expires and is used only to publish the content you have approved. We store the username and ID while the connection is active.
• Sharing: Threads data is not shared with anyone other than Meta and our hosting provider (see “Sharing with third parties”). Reachly does not sell data and does not show ads.
• Revoking access: If you disconnect Threads in Reachly, we delete the connection immediately. If you remove Reachly in Threads' settings or ask Meta for deletion, we are notified and delete the connection immediately.

TikTok

When you connect your TikTok account, Reachly uses TikTok's Login Kit and Content Posting API (Direct Post) and requests the user.info.basic and video.publish permissions via TikTok's login. TikTok's processing of your data is covered by the TikTok Privacy Policy.

• What we access: your TikTok ID (open_id), your display name and your avatar (user.info.basic), so you can see which account is connected; and the right to publish the videos you yourself choose to publish via Reachly (video.publish). When you are about to post a video, we fetch the account's current information from TikTok (creator_info): nickname, username, avatar, the privacy levels the account may choose, whether comments, Duet and Stitch are turned off, and how long a video the account may post. We do not read your videos, comments, followers, messages or statistics, and we do not delete or change anything on your TikTok account.
• How we use and store it: The access token and the refresh token are stored encrypted (AES-256-GCM) as described above. The access token is valid for 24 hours and is renewed automatically with the refresh token, which is valid for up to 365 days. While the connection is active, we store your TikTok ID, your display name and the address of your avatar. The creator_info data is used only to show the posting panel and is not stored — except that we update the address of your avatar, because TikTok's image addresses expire. When a video has been sent, we store TikTok's publish ID (publish_id) with the post, so Reachly can show whether TikTok has published the video.
• The video: The video you upload is stored under https://www.reachlyai.dk/media/ with a random file name that cannot be guessed, so TikTok can fetch it from there. Together with the address, we send the text of the post and the choices you yourself have made in the panel (who can see the video, comments, Duet, Stitch and the commercial content disclosure). The video is deleted together with your other Marketing data when you delete your account (see “Storage and deletion”).
• Nothing is posted without you: Reachly only posts to TikTok when you yourself click the post button in the TikTok panel — never automatically and never as a scheduled post. You choose who can see the video yourself; nothing is preselected.
• Sharing: TikTok data is not shared with anyone other than TikTok and our hosting provider (see “Sharing with third parties”). Reachly does not sell data, does not show ads and does not use TikTok data for advertising or AI training.
• Revoking access: If you disconnect TikTok in Reachly, we delete the connection (tokens, TikTok ID, display name and avatar) from our server immediately and at the same time ask TikTok to revoke Reachly's access. The same happens when you delete your Reachly account. Backups of the database are deleted automatically after 30 days. You can also remove Reachly yourself in the TikTok app under Settings and privacy › Security › Manage app permissions.
• Questions: write to support@reachlyai.dk.

We comply with the platforms' developer terms and data policies, including Meta's Platform Terms, the YouTube API Services Terms of Service, the Google API Services User Data Policy (including the Limited Use requirements), TikTok's and Pinterest's developer terms, Reddit's Developer Terms and Data API Terms, LinkedIn's API Terms of Use and Threads' developer terms.

06 Cookies

Reachly uses one strictly necessary cookie and your browser's local storage:

• Session cookie (necessary): When you log in, the cookie reachly_token is set, which keeps you logged in for up to 30 days. It is HttpOnly (cannot be read by scripts), contains only a random session ID and is not used for tracking. It is deleted when you log out.
• Local storage (necessary functionality): Your settings and your saved Marketing content — this is simply how the app works.
• The employee mobile (Reachly Build): So that the mobile link works without a network connection out on site, the phone stores the page, the latest plan and what the employee does without a connection (done, hours, conversation cards and photos) until it has been sent to the business. The photos are kept in the browser's database (IndexedDB) and are deleted from the phone as soon as they have been added to the job. If the mobile link is removed, the phone clears it all the next time the page is opened.
• Consent: Your choice in the cookie banner, so we don't ask again.

We do not use analytics or marketing cookies from third parties. Should that change, we will update this policy and ask for your consent first.

07 Storage and deletion

You have direct control over the deletion of your data:

• Your account and all Build data can be permanently deleted by you: Reachly Build → Integrations → "Delete my account" ("Slet min konto"). This immediately removes your user, your business, all business data and the bids you have made from our server.
• Jobs on the marketplace can be deleted by you via your private job link ("Delete my job", "Slet min opgave") — this removes the job, your contact information and all bids received. Open jobs are also deleted automatically no later than 90 days after they were created.
• Marketing content data (posts, profile and uploaded images) is stored on our server, linked to your business, and is deleted in full when you delete your account. Images uploaded before 13 September 2026 were stored without a link to your account and are therefore not removed automatically — write to support@reachlyai.dk and we will delete them manually.
• Scheduled posts are stored on our server until the publishing time, so they can be published even if your browser is closed. You can cancel a scheduled post in the app, and all scheduled posts are deleted when you delete your account.
• AI requests are processed only at the moment they are made and are not stored on the server.
• Billing information at Stripe is kept for 5 years in accordance with the Danish Bookkeeping Act.
• Support enquiries by email are deleted no later than 24 months after the case has been closed.

7b How to delete your data (including Facebook/Meta data)

You can delete all data Reachly has received at any time — including data received via Facebook/Meta:

1. Disconnect Facebook in Reachly: Go to Platforms in Reachly and click "Disconnect" ("Frakobl"). This deletes your access token and your page information from our server immediately.
2. Remove Reachly at Facebook: Go to Facebook → Settings → Apps and websites → find Reachly → Remove. This revokes all access at Meta.
3. Disconnect TikTok in Reachly: Go to Platforms in Reachly and click "Disconnect" ("Frakobl") on the TikTok card. This deletes your TikTok tokens, your TikTok ID, your display name and your avatar from our server immediately, and Reachly asks TikTok to revoke the access. You can also remove Reachly in the TikTok app: Settings and privacy → Security → Manage app permissions.
4. Delete your account and all server data: Go to Reachly Build → Integrations → "Delete my account" ("Slet min konto"). This removes your user, your business, all business data and all connected platform accounts from our server immediately — and also cancels any subscription.
5. Clear your local data: Clear the site data for reachlyai.dk in your browser's settings. This removes the content stored locally on your device (post drafts and business profile in Reachly Marketing). Note that this does not in itself delete your access token — step 1, 3 or 4 does.

Note: Data received from Facebook/Meta (access tokens and page information) is stored on our server in encrypted form. This is necessary so scheduled posts can be published at the agreed time, even when your browser is closed. It is deleted on disconnection and on account deletion. If you would like help or confirmation of deletion, write to support@reachlyai.dk — we reply within 30 days.

7c Requests from authorities

Reachly only discloses personal data to public authorities when we are legally obliged to. We follow this procedure for every request:

• Lawfulness is assessed first: every request is reviewed for legal basis, scope and sender before anything is disclosed.
• We object to requests we consider unlawful or too broad, and ask for them to be narrowed or for a decision.
• Data minimisation: if anything is disclosed, it is only the information the request specifically and lawfully requires — never entire accounts or databases.
• Documentation: the request, our assessment and our response are recorded, so we can account for them afterwards.

We have not received any such requests. Where the law permits, we inform the customer concerned.

08 Your rights

Under the GDPR you have the following rights:

• Right of access: You can at any time ask to see what data we hold about you.
• Right to rectification: You can ask us to correct inaccurate information.
• Right to erasure: You can ask us to delete your personal data ("the right to be forgotten").
• Right to data portability: You can download all your data yourself in a machine-readable format (JSON) under Settings → Your data ("Indstillinger → Dine data") — or request it from us.
• Right to object: You can object to certain types of processing of your data.
• Right to restriction: You can ask us to restrict the processing of your data.

To exercise your rights, contact us at support@reachlyai.dk. We reply within 30 days.

09 Security

We take the security of your data seriously and use the following measures:

• All communication with our server and with third-party APIs is encrypted via SSL/TLS.
• Passwords are never stored in plain text — only as a scrypt hash with an individual salt.
• Login sessions are handled with HttpOnly cookies that cannot be read by scripts in the browser.
• Business data is separated per business, and bids on the marketplace are never disclosed to anyone other than the owner of the job.
• API keys and app secrets are kept only on the server and are never exposed in the browser.
• The server is protected against abuse with measures including rate limiting and CSRF protection in login flows.

10 Contact and complaints

If you have questions about this privacy policy or about how we process your data, you are always welcome to contact us:

Email: support@reachlyai.dk
Post: Reachly, Bryggerivej 11, 4622 Havdrup, Denmark

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
dt@datatilsynet.dk · datatilsynet.dk