Privacy

1. Who we are

ReachKit (“ReachKit”, “we”, “us”) is operated by [[imprint: owner fills legal entity, address, VAT id]]. This notice explains how we handle personal data when you use the website and product at reachkit.app. For any question about it, or to exercise any of the rights below, write to the address in our Imprint.

2. What we collect

We collect as little as the product needs.

• Scan inputs. The website address you submit, and the report we build from it: its Visibility Score, the searches and AI answers we measured, and the three problems we count. A free report is public at its own address from the moment it finishes and stays there; anyone holding the link can read it. Search engines are told not to index it.
• Your network address, hashed. Free scans are limited per network. We keep a salted one-way hash of the address the scan came from, never the address itself.
• Your email address. We receive it when you ask for the free page — that is your opt-in to receiving that page and up to three short follow-ups about that domain, sent at 24, 72 and 168 hours, which stop the moment you subscribe or opt out. Every one of those mails carries a working opt-out link. We also receive it when you pay: it is where your sign-in link and receipts go. There is no password; you sign in with a one-time emailed link.

• Billing data. Stripe collects and holds your card details. We store your subscription status, a Stripe customer reference, the billing country you gave and, if you entered one, your VAT number.
• Your site and market. Your domain, the market and up to five competitor domains you confirm, your publishing settings, the voice note and never-claim list you write, and — if you connect one — the WordPress credentials you give us, encrypted at rest, never logged, and revoked when you disconnect.
• The pages we write for you, their drafts, and the record of every publish: the search it targets, when it went live, and where.
• Visits to pages we host for you. When someone opens a page we host for a customer, we count, by page and by day, visits that arrive from an AI answer or from Google or Bing search, and fetches by AI and search engines; we keep only the count, the engine and the day — never the visitor’s network address, browser details, or the page or search they came from — and we place nothing on their device. For these pages we act for the customer who publishes them, whose own privacy notice applies to their visitors.

3. How we use it

To run scans and render reports; to write and deliver the free page you asked for and its follow-ups; to sign you in; to take payment and run your subscription; to write, publish and verify your pages; to scan your market every week and tell you what moved; to limit free scans per network; and to protect the service from abuse. We do not sell personal data, and we send no marketing beyond the follow-ups described above.

4. Language models

ReachKit uses Anthropic’s language models for two things: to label your market and propose the questions it asks, and to write the pages we publish for you — each grounded in facts read from your own live pages, with the source of each fact recorded. Every word ReachKit says in its own voice — on a screen or in a mail — is written by a person, never by a model.

5. Service providers

Each receives only the data its job needs.

We also send the addresses of the pages we host for you to Google Search Console and Bing Webmaster Tools, so that Google and Bing can find them.

6. International transfers

Some of these providers process data outside the EU and EEA. Each transfer is covered by a safeguard the GDPR recognises: the European Commission’s Standard Contractual Clauses in the provider’s data processing agreement, or the provider’s certification under the EU-U.S. Data Privacy Framework.

• Supabase — United States. Standard Contractual Clauses.
• Vercel — United States. EU-U.S. Data Privacy Framework.
• Stripe — United States. EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as the fallback.
• Resend — United States. EU-U.S. Data Privacy Framework.
• Anthropic — United States. Standard Contractual Clauses.
• Inngest — United States. Standard Contractual Clauses.
• PostHog — United States. Standard Contractual Clauses.

DataForSEO is based in Estonia, inside the EU. Google Search Console and Bing Webmaster Tools receive only the public addresses of your hosted pages. To ask for a copy of a safeguard, write to the address in our Imprint.

7. Public reports and their removal

A free report is public at its address. If you own a site and want its report taken down, write to remove@reachkit.app. A granted request takes the report offline within five working days, and the domain is not scanned again unless you ask us to make it scannable.

8. Legal basis and retention

Where the GDPR applies, we process your data to perform our contract with you — measuring, writing and publishing — and on our legitimate interest in limiting abuse and in following up on an action you started: the free page you asked for and its capped follow-ups. Free reports stay public until their owner asks for removal. The email address you give for a free page stays with that report until you ask us to remove it. Account, site and billing data stay for as long as your account exists. When you delete your account, your pages are exported to you first and taken down, and the account is closed at once: you are signed out and no one can sign in to it. Its data is then removed within 30 days, except for records the law requires us to keep, such as invoices.

9. Your rights

You can ask for access to, correction of, deletion of or a copy of your personal data, and object to or restrict certain processing. Settings lets you export your data and delete your account yourself; for anything else, write to the address in our Imprint and we will handle it by hand. If you are in the EU or EEA you can also complain to your local data protection authority.

10. Cookies

We set one cookie, to keep you signed in. When it grows too large for one, your browser stores it in numbered parts. When you download your export before deleting your account or unpublishing every page, we set a second cookie for 30 minutes, so that only your browser can confirm that step. When you ask for a sign-in link or a change of email, we set a cookie for up to 24 hours, so that opening the link in the same browser signs you in without a second step. It holds no personal data and is removed once you are signed in. We set no analytics cookies, no advertising cookies and no cross-site trackers. Product analytics runs on our servers and stores nothing in your browser.

Your browser also keeps two settings for this site in its own storage: light or dark mode, and whether the app’s side menu is open. They never leave your device.

11. Changes

We update this notice as the product changes; the date above is always the current version’s.