Privacy Policy

Last updated: October 24, 2026

1. Who we are

DoReach (doreach.io) is operated by DoReach ("DoReach", "we", "us"). For the personal data described in this policy about our own customers and website visitors, we are the controller. For the data our customers upload and process with DoReach, we are their processor (a "service provider" under US state laws); see section 4.

2. What we collect

Information you give us

• Account details: your name, email address and password (stored only as a secure hash), your workspaces, and the teammates you invite (their email and role).
• Billing details: your plan, invoices and payment status. Card and PayPal details are entered with Stripe or PayPal directly; we never see or store full card numbers.
• Connected accounts: the mailboxes, LinkedIn accounts, Microsoft 365 tenants, calendars and other tools you connect, and the credentials or access tokens needed to use them. These secrets are stored encrypted.
• Support and feedback: what you write to us by email, in the live chat (if you allow it), or in a feature or bug request.
• Affiliate programme: if you join, the details needed to track referrals and pay commissions.

Information collected automatically

• Usage and device data: IP address, browser and device type, pages visited, actions taken in the app, and timestamps. We use this to run, secure and improve DoReach and to keep an audit trail of account activity.
• Cookies: strictly necessary cookies, and optional ones only with your consent. See our Cookie Policy.

Information from others

• If you sign in with Google or Microsoft, we receive your name, email address and account identifier from them.
• If a teammate invites you to a workspace, we receive your email address from them.

We don't ask for or knowingly collect sensitive data (such as health, religion or biometric data). Please don't upload it.

3. How we use it, and why

We do not use your data or your customers' data to train our own or third-party AI models. When you use an AI feature, the text needed for that request is sent to the AI provider listed below, which processes it under its business terms (these do not allow training on API data).

4. Data you upload about others

DoReach is used to manage outreach. Our customers upload and process data about other people: lead lists, prospects, CRM contacts, emails and LinkedIn messages. For that data, the customer is the controller and decides why and how it is used; we process it only on their instructions and to provide the service. Customers are responsible for having a lawful basis to contact the people in their lists, for honouring unsubscribes, and for following anti-spam and data protection laws (see our Anti-Spam Policy).

If your details are in a DoReach customer's list and you want them removed, please contact that company. You can also send us a request and we'll pass it on and help where we can. Customers who need a Data Processing Agreement can request one at support@doreach.io.

5. Who we share it with

We share personal data only with the service providers that help us run DoReach, under contracts that limit their use of it, when the law requires it, or with your consent. We don't sell personal data. Our main providers:

We may also disclose data to comply with the law or a valid request from public authorities, to protect the rights and safety of DoReach and others, or as part of a merger or sale of our business (you'd be told before your data falls under a different privacy policy).

6. Cookies

We use strictly necessary cookies to sign you in and keep DoReach secure. Optional cookies (live chat and referral credit) are used only if you allow them in the cookie banner, and you can change your choice at any time with Cookie settings. We use no advertising or analytics cookies. Details are in our Cookie Policy.

7. International transfers

Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum), or a provider's certification under the EU-US Data Privacy Framework.

8. How long we keep it

• Account and content data: while your account is active. After you delete your account or ask us to, we delete it within 30 days, except what we must keep by law. Backups are overwritten within a further 35 days.
• Billing records: as long as tax and accounting law requires (often up to 7 years).
• Security and audit logs: as long as needed to protect the service, normally no more than 12 months.
• Cookie consent records: for as long as your choice applies plus 12 months, so we can show what you agreed to.
• Support messages: up to 24 months after the conversation ends.

9. How we protect it

We protect data with encryption in transit (HTTPS only), encryption of stored secrets such as mailbox passwords and access tokens, hashed passwords and API keys, role-based access inside workspaces, audit logs, and limited staff access. No method of transmission or storage is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

10. Your rights

Depending on where you live, you may have the right to:

• access your personal data and get a copy (portability);
• correct inaccurate data;
• delete your data ("right to be forgotten");
• object to or restrict some processing, including direct marketing (always free);
• withdraw consent at any time, without affecting earlier processing;
• complain to your data protection authority (in the EU, the authority in your country; in the UK, the ICO).

To use these rights, make a privacy request, use Settings › Profile & security when signed in, or email support@doreach.io. We reply within one month (or 45 days where US state law applies), may ask you to confirm your identity, and don't charge for this.

11. California and other US states

If you live in California or another US state with a privacy law, you have the rights to know, access, correct and delete your personal information, and to opt out of its "sale" or "sharing" for targeted advertising. We do not sell or share personal information and don't use it for targeted advertising. We honour the Global Privacy Control signal. We won't treat you differently for using your rights. An authorised agent may make a request for you with your written permission. The categories we collect are described in section 2, the purposes in section 3, and the recipients in section 5.

12. Children

DoReach is a business tool for people aged 18 and over. We don't knowingly collect data from children. If you believe a child has given us personal data, contact us and we'll delete it.

13. Changes

We'll post any change here with a new date. If a change materially affects how we use your personal data, we'll tell you by email or in the app before it takes effect.

14. Contact us

DoReach
Email: support@doreach.io
Privacy requests: doreach.io/privacy/request