Privacy Policy

This policy explains what personal data Reachira collects when you use it, why we use it, which service providers process it for us, how long we keep it and what rights you have. In short: we collect what we need to create, schedule and publish your short-form videos; we never show or hand out the access tokens of your social accounts; when you delete your account we wait 30 days so you can change your mind, then purge your content, and we keep only the financial records the law requires, with the personal details in them replaced by pseudonyms.

Who we are

Reachira is a product of Novlasoft OÜ, an Estonian private limited company (osaühing) registered in Estonia under registry code 16751108 ("we", "us"). For your account data we are the controller. For questions about this policy or your data, write to privacy@reachira.com.

The data we collect

Account and workspace data

• Your name, email address and sign-in details, handled by our authentication provider. We do not see or store your password.
• Your workspaces (one per brand), the people you invite to them and their roles.
• Your settings, such as timezone and notification preferences.

Your website and brand

During onboarding you give us your website address. We read the public pages of that site to build a brand profile (what you sell, your audience, your tone), and we store the resulting profile, the angles and the brand settings you choose.

What you upload and create

• Demo recordings, images, audio and other media you upload.
• Characters you create. If you create a character from photos of a real person, we store those photos and the consent you gave that the person's likeness may be used. If you clone a voice, we store the voice sample and the consent you gave for it.
• Scripts, captions, hooks, videos and slideshows generated for you, and the record of what each video was rendered with.
• Your confirmation that you own the rights to audio you upload.

Connected social accounts

When you connect a social account (for example TikTok, Instagram, YouTube, Facebook or LinkedIn) we receive the account's identifier, handle, display name and profile details, and the permission to publish on your behalf.

• Access tokens are encrypted before they are stored and are never displayed — not to you, not to your team, and not to our own support staff. Depending on how an account is connected, the token is held either by us (encrypted) or by our publishing provider.
• We store the posts we schedule and publish for you, their links, and their performance figures (views, likes, comments, shares, follower counts), which we save as daily snapshots so you can see history.

Billing data

Payments are processed by our payment provider. We store your plan, billing interval, subscription status, credit balance and credit ledger (every reservation, charge and refund of credits) and your invoices. We do not store your full card number.

Technical and usage data

Our servers record logs to run and secure the service: request details such as IP address and browser user agent, error reports, and identifiers of the workspace and job involved. We try to keep personal data out of logs and record identifiers instead.

Communications

Emails we send you (such as "video ready", "post published", "reconnect your account" and low-credit notices), their delivery status, and any messages you send to us.

Trend data about other people's public videos

Our trend library shows public short-form videos that are performing well. For these we keep only public metadata — the video's link, view and engagement counts, hashtags, sound, duration and thumbnail. We do not keep the creator's name, username, follower counts, mentions, comments or location, and we do not download or re-host the footage.

Why we use it, and on what legal basis

Where applicable law, such as the GDPR, requires a legal basis, we rely on the following:

We do not sell your personal data, and we do not use it for advertising.

AI processing

Reachira uses AI services to write text (brand analysis, angles, hooks, scripts, captions, hashtags) and to generate images, video, speech and lip-sync. To do this, the relevant input — for example your brand profile, a prompt, a character's images or a voice sample — is sent to the AI provider engaged for that task (see the processor categories below), and the result is returned to us. Whether a post is labelled as AI-generated on a platform is your choice; see our Terms of Use.

Who processes your data for us

We use a small set of specialist service providers (subprocessors). Each processes personal data only to provide its part of the service to us. The categories below describe every one of them; we will provide the current named list, with each provider's safeguards, on written request to privacy@reachira.com.

When you publish, your content is also sent to the social platforms you chose. Once published, it is governed by that platform's own terms and privacy policy.

We may also disclose data where the law requires it, to protect our rights or the safety of others, or to a successor if our business is transferred, in which case this policy will continue to apply to your data.

How long we keep it

• While your account is active, we keep your data for as long as you use the service. You can delete individual videos, uploads, characters and connected accounts at any time.
• When you delete your account, it is blocked at once: nobody can sign in to it, nothing is published and no credits are spent. For 30 days you can cancel the deletion. After that we purge your content from our systems and from our providers: videos, uploads, voices, character images, social account tokens and connections, analytics, and the email data we hold about you.
• Financial records are kept for 7 years (per the Estonian Accounting Act — to be confirmed by our accountant) after the purge because accounting and tax law requires it. This covers the credit ledger, invoices and the billing records held by our payment provider.
• Logs and audit records are kept for security and accountability.
• In everything we keep, personal fields are pseudonymised: your email address, name, IP address and user agent are replaced by a stable pseudonym, so the records still add up but no longer identify you.
• Some copies disappear on the provider's own schedule, for example backups that expire after a short period. Posts you already published remain on the social platforms until you remove them there.

Step-by-step instructions are on our Data Deletion page.

Your rights

Depending on where you live, the law — such as the GDPR — may give you the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is wrong;
• delete your data (you can do most of this yourself in Settings);
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive the data you gave us in a portable format;
• withdraw consent at any time, without affecting processing that already took place;
• complain to a data protection authority, in particular where you live or work.

To use any of these rights, write to privacy@reachira.com. We may need to confirm your identity first. We will answer within the time the applicable law sets.

Cookies

We use cookies that are strictly necessary to keep you signed in. Analytics cookies are used only if you agree to them, and we use no advertising cookies. Details and how to change your choice: Cookie Policy.

International transfers

Our providers may process data in countries other than yours, including countries whose data protection laws differ from those where you live. Where applicable law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses or an adequacy decision. You can ask us for more information at privacy@reachira.com.

Security

Social account tokens are encrypted before storage and never shown in the product. Secrets and API keys are kept on the server and never sent to your browser. Access to production data is limited to people who need it to run the service, and administrative actions are recorded in an audit log. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

YouTube API Services

Reachira uses YouTube API Services to connect YouTube channels, publish videos you schedule and show their performance. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's use of data is described in the Google Privacy Policy.

• What we access: your channel's identifier and name, permission to upload videos to it, the videos we publish for you, and their public performance figures (views, likes, comments) and your channel's subscriber count.
• Why: to publish the videos you schedule, show you whether they were published, and display their performance in Reachira.
• How it is shared: only with the providers that publish for us and store our data, as listed above. We do not sell YouTube data or use it for advertising.
• Revoking access: you can disconnect the channel in Reachira at any time, or revoke Reachira's access in your Google security settings at https://myaccount.google.com/permissions (also reachable at https://security.google.com/settings/security/permissions).
• Cookies: Reachira does not place cookies or similar technology on your device on YouTube's behalf; see our Cookie Policy.

More detail, including deletion timelines, is on our YouTube API Services disclosure.

Children

Reachira is a business tool and is not directed at children. You must be old enough to enter a binding contract, and in any case at least the minimum age the social platforms you connect require. We do not knowingly collect data from children; if you believe a child has given us data, contact privacy@reachira.com and we will delete it.

Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you by email or in the product before it takes effect.

Contact

Novlasoft OÜ. Privacy questions and requests: privacy@reachira.com.