Privacy Policy

Last updated: 5 November 2026

This policy explains how Reachvoy ("Reachvoy", "we", "us") handles personal data when you visit reachvoy.com, use the Reachvoy app at app.reachvoy.com, connect your social media and Google accounts to it, or click a short link created with it.

1. Who we are

Reachvoy is a product of Atdrive Infotech Pvt Ltd ("AtDrive"), a company registered in India with its registered office at A-1802, Sector 77, Noida, Uttar Pradesh 201301, India. AtDrive operates Reachvoy and is responsible for it.

• Controller for account data. We decide how and why we process the data we need to run your Reachvoy account: your name, email address, sign-in details, and how you use the app.
• Processor for customers' marketing data. When a business or agency (our customer) connects its social accounts, websites and analytics, we process that data on the customer's behalf and on its instructions. This includes posts, comments, metrics, analytics reports and short-link clicks. The customer is the controller of that data. If you are, for example, someone who commented on a brand's Page or clicked a brand's link, please contact that brand first about your data. We will help them answer you.

2. What we collect

2.1 Account data

• Name, email address and, if you set one, a password (stored only as a one-way hash).
• If you sign in with Google: your name, email address and profile picture from your Google account.
• Multi-factor authentication settings, organisation and workspace memberships, roles, and workspace settings such as time zone and currency.
• Security and audit records: sign-ins, connections and disconnections, publishing, deletions, role changes and exports, with the time, IP address and browser type.
• Messages you send us, for example support or access requests.

2.2 Data from platforms you connect

When you connect an account, you sign in on that platform and approve specific permissions. We receive an access token (and, where the platform provides one, a refresh token) and use it to read and publish only what those permissions allow. Depending on the platforms you connect:

Platform data can include personal data about other people, such as the public names and text of people who comment on your posts.

2.3 Content you create

Post drafts, captions, scheduled posts, images and videos you upload to the media library, alt text, tags and campaign labels.

2.4 Short-link click data

Links in posts published through Reachvoy, and links you create with the link builder, are replaced with a short link. When someone clicks one, we record:

• the time of the click;
• the country, as provided by our network provider (Cloudflare);
• the device type, from the browser's user agent;
• the referring website, if the browser sends one;
• whether the click looks automated (bot filtering).

The click record does not include the visitor's IP address or name. The redirect sets no cookies and runs no tracking script. The visitor is then sent on to the destination website, whose own privacy policy applies.

2.5 Technical data

Our servers and network provider keep standard request logs (IP address, time, requested page, browser type) for security and troubleshooting. When the app hits an error, our error-monitoring service receives technical details about it. We configure it not to receive passwords or access tokens.

2.6 This website

reachvoy.com is a static website. It sets no cookies, runs no analytics or advertising scripts, and loads nothing from third parties.

3. How we use it

• To provide Reachvoy: sign you in, publish and schedule posts, sync metrics, show dashboards, post performance and funnels, and produce exports.
• To connect clicks, visits, conversions and revenue to the posts that drove them, using short links and UTM tags.
• To generate AI caption and hashtag suggestions when you ask for them.
• To send service emails: invitations, password resets, failed-post and connection alerts, and export notices.
• To keep Reachvoy secure: prevent abuse, detect fraud and bots, investigate incidents, and keep audit records.
• To fix problems and improve the service.
• To meet legal obligations and respond to lawful requests.

We do not sell personal data. We do not use it for advertising, and we do not share it for cross-context behavioural advertising.

4. Legal bases

Where laws such as India's Digital Personal Data Protection Act, 2023 or the EU/UK GDPR apply, we rely on:

• Contract: to provide the service you or your organisation signed up for, including the platform connections you set up.
• Consent: where you give it, for example when you approve a platform's permission screen. You can withdraw it at any time by disconnecting the account (see section 12).
• Legitimate interests and other legitimate uses the law allows: security, preventing abuse, bot filtering, and improving the service, balanced against your rights.
• Legal obligation: where the law requires us to keep or disclose data.

For marketing data we process on a customer's behalf, the customer is responsible for having a legal basis for its own use of that data.

5. Google user data and YouTube

Reachvoy's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, data we receive from Google APIs (Google sign-in, Search Console, Google Analytics and YouTube):

• is used only to provide and improve the features you can see in Reachvoy;
• is not sold, and is not used or transferred for advertising, including personalised or retargeted ads;
• is not transferred to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with notice to you;
• is not read by people at Reachvoy unless you ask us to (for example, for support), it is needed for security or to comply with the law, or it is aggregated and anonymised;
• is not used to develop, improve or train generalised AI or machine-learning models;
• is never sent to an AI provider.

YouTube. Reachvoy uses YouTube API Services. By connecting a YouTube channel to Reachvoy, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. Section 2.2 explains what YouTube data we access and section 3 how we use it. You can revoke Reachvoy's access to your Google and YouTube data at any time on the Google security settings page.

6. Meta and LinkedIn data

We use data received from Meta (Facebook and Instagram) and LinkedIn only to provide Reachvoy's features to the customer who connected the account, as their platform terms allow. We refresh or delete stored platform data within the time limits those terms set, and we honour Meta's data deletion requests (see the data deletion instructions).

7. Sharing and sub-processors

We share personal data only with service providers that help us run Reachvoy, under contracts that limit their use of it, and when the law requires it. Our current providers:

Reachvoy also sends data to the platforms you connect when you ask it to, for example when it publishes a post to your Facebook Page. Inside a workspace, other members can see its data according to their role.

We will update this list before adding a new sub-processor.

8. Where data is stored

Reachvoy runs on our own servers in India, and your data is stored there. Some of the providers listed above may process data in other countries, such as the United States. Where data protection law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

9. Retention

• Account data: kept while your account is open, and deleted within 30 days after it is closed.
• Platform data: kept while the account stays connected, refreshed or deleted as each platform's terms require, and deleted within 30 days after you disconnect it. Search Console history is kept beyond Google's 16-month window for as long as the property stays connected.
• Access tokens: deleted as soon as you disconnect the account.
• Content and short-link click data: kept while the workspace exists, and deleted within 30 days after the workspace or account is deleted.
• Backups: daily encrypted backups are kept for up to 30 days, so deleted data disappears from all backups within 30 days of deletion.
• Server logs: rotated automatically and usually overwritten within a few weeks.
• Security and audit records (sign-ins, security settings and admin actions, without message content or tokens): kept for up to 2 years to protect the service and meet legal obligations, or longer where the law requires.

10. Security

• Access tokens for connected platforms are encrypted with AES-256-GCM, using a separate key for each record. They are never sent to your browser and never written to logs.
• We request the narrowest permissions each feature needs.
• Each customer's data is kept separate by rules enforced in the database itself.
• Passwords are hashed with Argon2id. Multi-factor authentication is required for owners and admins.
• All connections use HTTPS. Uploaded media is served only through short-lived signed links.
• Off-site backups are encrypted, and access to systems is limited to staff who need it.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

11. Your rights

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023, the EU/UK GDPR and California privacy law (CCPA/CPRA), you may have the right to:

• know what personal data we hold about you and get a copy of it;
• correct or update it;
• delete it;
• withdraw consent or object to some processing;
• receive your data in a portable format;
• nominate someone to exercise your rights if you die or become unable to (India);
• not be discriminated against for using your rights.

To use any of these rights, email [email protected]. We may need to confirm your identity first, and we will reply within the time the law requires. If your data is in a customer's workspace, we may pass your request to that customer. You can also complain to your data protection authority, such as the Data Protection Board of India or your local supervisory authority in the EU or UK.

12. Disconnecting and deleting

• Disconnect a channel in Reachvoy at any time. We delete its access tokens immediately, stop syncing, and delete the data stored from it within 30 days.
• Revoke access on the platform in your Facebook, Instagram, Google or LinkedIn settings.
• Delete your account by emailing [email protected].

Step-by-step instructions are on the data deletion page. Posts already published to a platform stay there until you delete them on that platform.

13. Cookies

The Reachvoy app uses only strictly necessary cookies: a secure session cookie that keeps you signed in, and a security token that protects forms. They are not used for tracking or advertising. This website and our short links set no cookies.

14. Children

Reachvoy is a business tool. It is not meant for anyone under 18, and we do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We will post any changes on this page and update the date above. If a change is significant, we will also tell account holders by email or in the app before it takes effect.

16. Contact

For privacy questions or requests, email [email protected].

Grievance officer (Digital Personal Data Protection Act, 2023): Emmanual Reddy, Atdrive Infotech Pvt Ltd, at the address below, email [email protected]. We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

Atdrive Infotech Pvt Ltd
Registered office: A-1802, Sector 77, Noida, Uttar Pradesh 201301, India