Privacy Policy

1. Introduction

Reachly ("we", "our", or "us") is a product of Shift IA LLC, a technology company specializing in artificial-intelligence-powered marketing automation. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Reachly platform (reachly.shiftia.io).

By accessing or using Reachly, you agree to the terms of this Privacy Policy.

2. Information We Collect

2.1 Account Information

Name, email address, and password when you register. If you sign in via LinkedIn OAuth, we receive your LinkedIn profile data (name, email, profile picture, LinkedIn member ID).

2.2 Company Information

Business name, CNPJ (Brazilian tax ID), website, niche, and tone of voice you provide when onboarding your company.

2.3 Social Media Tokens

When you connect a social media account (e.g., LinkedIn), we store OAuth access tokens and refresh tokens securely to publish content on your behalf. We do not store your social media passwords.

2.4 Campaign Content

Text, images, and metadata of marketing campaigns you create, approve, and publish through Reachly.

2.5 Usage Data

Log data, browser type, IP address, pages visited, and feature interactions for security and product improvement purposes.

3. How We Use Your Information

• To provide, operate, and improve the Reachly platform
• To publish social media content on your behalf on platforms you authorize
• To generate AI-powered marketing campaigns tailored to your business
• To send transactional communications (account, billing, security alerts)
• To detect and prevent fraud or unauthorized access
• To comply with legal obligations

4. LinkedIn Data Usage

Reachly uses LinkedIn's OAuth 2.0 API to connect your LinkedIn account. We use your LinkedIn access token solely to publish content that you explicitly approve within the platform. We do not:

• Read your LinkedIn messages or connections
• Post content without your explicit approval
• Share your LinkedIn data with third parties
• Use your LinkedIn data for advertising purposes

You can revoke Reachly's access to your LinkedIn account at any time via LinkedIn's Permitted Services page or within Reachly's Settings → Integrations.

5. Data Sharing

We do not sell your personal data. We may share data with:

• Anthropic — AI content generation (campaign text is sent to Claude API)
• Railway — cloud hosting and database infrastructure
• LinkedIn — to publish posts via their API on your behalf
• GitHub — if you configure GitHub integration for image hosting
• Law enforcement or government bodies when required by law

6. Data Retention

We retain your data as long as your account is active. Upon account deletion, we delete your personal data within 30 days, except where retention is required by law. OAuth tokens are deleted immediately when you disconnect an integration.

7. Security

We use industry-standard security measures including HTTPS, bcrypt password hashing, and JWT-based authentication. OAuth tokens are stored encrypted in our database.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access and receive a copy of your personal data
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Withdraw consent to data processing
• Lodge a complaint with a supervisory authority

To exercise these rights, contact us at privacy@shiftia.io.

9. Cookies

Reachly uses an HTTP-only session cookie for authentication. We do not use tracking or advertising cookies. No third-party analytics cookies are used.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or an in-app notification. Continued use of Reachly after changes constitutes acceptance.

11. Contact

Shift IA LLC — EIN 37-2232633
Email: privacy@shiftia.io
Website: shiftia.io