Privacy notice
Last updated 9 November 2026
[Company name], [Registered address], is the controller of the personal data described here. Write to privacy@reachlist.app with any question or request.
This notice has two parts: one for people whose professional details Reachlist returns, one for our customers.
If Reachlist has returned your professional details
We tell you this because we did not get your details from you (GDPR article 14).
What we process
- Professional details that are public: your name, job title, employer, location, public LinkedIn profile and posts, and work contact details such as your work email and phone.
- We do not look for personal email addresses, and we don't process special categories of data on purpose.
Where it comes from
From data providers who collect public professional information, reached through treg and Bright Data. We don't collect it ourselves and never log in to LinkedIn.
Why, and on what basis
To answer our customers' business questions: finding the right person at a company to contact about a job or a product, and checking that a work email works. The basis is legitimate interests (GDPR article 6(1)(f)), ours and our customers'. We weighed them against yours: we use only professional data, keep it briefly, and stop at once when you object.
Who receives it
The customers who ask about you, under terms that forbid spam and harassment, and the service providers listed below.
How long we keep it
- Answers from providers are kept at most 30 days, so that the same question doesn't go to a provider again, then deleted.
- A search a customer runs from their dashboard is kept in their account at most 30 days, so they can reopen it and download it, then deleted. If you ask to be removed, you are left out of it from then on.
- An answer a customer may need to collect again after a network error is kept 24 hours.
- Our usage logs record which tool was used, never what it returned.
- If you ask to be removed, we keep a one-way hash of your identifiers, so that we can keep you out: not your details themselves.
Your rights
You can object, and we will stop returning your data to anyone, at once: https://reachlist.app/remove. You can also ask for access, correction or erasure at privacy@reachlist.app, and complain to your data protection authority.
If you have a Reachlist account
- What: your email, your API keys (stored as hashes), the apps you connect, your credit history, and logs of your calls (tool, time, credits, never the answers).
- Why: to run your account and bill you (contract, article 6(1)(b)); to keep the service safe and prevent abuse (legitimate interests); to keep accounting records (legal obligation).
- How long: call logs 730 days; the account until you ask us to delete it; payment records as long as tax law requires.
- Cookies: one cookie keeps you signed in. No tracking or advertising cookies.
Service providers
| Provider | What for | Where |
|---|---|---|
| treg | Routes data lookups to public-data providers | [To confirm] |
| Bright Data | Fallback provider for public LinkedIn data | Israel and the United States |
| [Hosting provider] | Runs the service and its database | European Union |
| [Email provider] | Sends sign-in and confirmation emails | [To confirm] |
| [Billing provider] | Merchant of record: takes payments and files sales tax | [To confirm] |
Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses or an adequacy decision.