Privacy Policy

Effective: 15 May 2026 · Last updated: 9 October 2026

Reachlee provides Instagram and Facebook messaging automation built on Meta's official Instagram Graph API and Messenger Platform. This Privacy Policy explains what we collect when you use Reachlee, how we use it, who we share it with, and the controls you have over your data.

1. Information We Collect

We collect only the information needed to operate the service:

• Account information — name and email address you provide when you sign up (via Google OAuth).
• Instagram account information — handle, profile details, and the access token Meta issues when you connect your Instagram Business or Creator account. The access token is stored encrypted and is never logged in plaintext.
• Facebook Page information — the name, ID, category, profile picture and follower count of each Facebook Page you connect, plus the Page access token Meta issues. We receive the list of Pages you manage in order to show you the picker; we store only the Pages you choose to connect.
• Contacts and messages— Instagram users and Facebook users who interact with your account or Page through automations you set up (comments and messages), along with the messages exchanged. We receive these via Meta's Instagram and Facebook Page webhooks.
• Automation configuration and run logs — the triggers, keywords, and DM templates you create, plus a record of when each automation fired.
• Usage and device data — IP address, browser type, and pages visited. Collected via Google Analytics (anonymized) and our server logs.
• Billing information — handled by our payment processor, Dodo Payments. We do not store your full card details.
• Signup attribution — on your first visit we store one first-party cookie (rl_attr) recording the utm_source, utm_medium, utm_campaign, utm_term and utm_content tags in the link you clicked, the referring website (if any), and the first page you landed on. We keep it only to know which of our own pages and articles bring us customers. It is written once and never overwritten, expires after 90 days, and is attached to your account only if you go on to create one. Readable solely by reachlee.co — it is not shared with third parties, sold, or used to track you across other websites, and it contains no name, email, IP address, or device identifier.

2. How We Use Your Information

• To run the automations you have configured.
• To bill your subscription via Dodo Payments (Pro plans only).
• To detect and prevent abuse and keep the platform compliant with Meta's terms.
• To respond to your support requests.
• To send product updates and important account notices to your email.

We do not sell or rent your data. We do notuse your data or your contacts' messages to train AI models.

3. Who We Share Data With

We share data only with the processors necessary to run Reachlee:

• Meta (Instagram and Facebook)— every API call to read comments, send messages, reply to comments and receive webhooks is made directly to Meta's Instagram Graph API and Messenger Platform on your behalf.
• Dodo Payments — for subscription processing on Pro plans.
• Amazon Web Services (AWS) — our hosting infrastructure (compute, database, file storage).
• Google Analytics — for aggregate, anonymized traffic analytics on the marketing site.
• AI assistants you connect — if you connect an AI assistant such as ChatGPT or Claude to Reachlee, the data that assistant requests is sent to its provider (for example OpenAI or Anthropic). See section 11.

We may disclose information when required by law, valid legal process, or to protect the rights and safety of users.

4. Data Retention

• Account information: kept while your account is active.
• Instagram and Facebook Page access tokens: kept until you disconnect the account or Page, delete your Reachlee account, or remove our app from your Instagram or Facebook settings.
• Contacts, messages, and automation run logs: kept while your account is active. Deleted within 30 days of account closure.
• Server access logs: retained for 90 days.
• AI assistant connections: kept until you disconnect the assistant or delete your account. Tokens expire automatically and are stored only as hashes.
• Signup attribution: the rl_attr cookie expires after 90 days. If you created an account, the record stays attached to it while the account is active and is deleted along with it.

5. Your Rights

• Access and export — request a copy of your data by emailing us.
• Correction — update profile details from Settings, or email us.
• Deletion — see our Data Deletion page for full instructions.

6. Security

• All traffic is served over HTTPS/TLS.
• Instagram access tokens are encrypted at rest. They are never written to logs.
• Webhook payloads are HMAC-verified against Meta's app secret before any processing.
• Database and file storage live in Amazon Web Services data centers.

No system is perfectly secure. We follow industry best practices but cannot guarantee absolute security.

7. International Transfers

Your data is processed and stored on AWS infrastructure, which may operate data centers outside your country of residence. By using Reachlee you consent to this transfer.

8. Children's Privacy

Reachlee is not directed to anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has signed up, please contact us so we can remove their account.

9. Cookies

The Reachlee app uses HttpOnly authentication cookies to keep you signed in. The marketing site uses Google Analytics cookies for aggregate traffic statistics. We do not use third-party advertising cookies.

10. Links to Other Websites

Reachlee may link to third-party websites (for example, Instagram). We are not responsible for the privacy practices of those sites.

11. AI Assistants and the Reachlee Connector

You can connect AI assistants such as ChatGPT, Claude and other MCP clients to your Reachlee account so they can work with your workspace on your behalf. The connection is optional, works only for accounts you own or belong to, and uses OAuth: the assistant never receives your Reachlee password or your Instagram or Facebook access tokens.

Data the assistant can access.Only what you ask it for, and only from workspaces you are a member of: your connected accounts and their follower counts; your automations and their settings; performance figures such as DMs sent, replies, link clicks and leads; your conversations, including message text and the contact's handle and name; and your captured leads, including any email address or phone number a contact shared with you. The assistant can also create, update, pause and resume automations, re-send DMs to recent commenters and reply in conversations, and each of those actions is shown to you for confirmation first.

Purpose. To answer your questions about your own workspace and to carry out the actions you ask for. We do not use this connection to train AI models, to profile you, or for advertising.

Who receives the data. The provider of the assistant you chose to connect (for example OpenAI for ChatGPT, or Anthropic for Claude). What they do with it is governed by their own privacy policy and your settings with them. No other third party receives data through the connector.

What we store. For each connection we keep the name of the assistant, the permissions you granted, hashed access tokens with their expiry dates, the time of the last request and a count of requests. We do not keep the content of what the assistant asked or what it received. Requests appear in our server logs, which are retained for 90 days.

Retention and your controls. A connection stays active until you disconnect it under Settings → AI apps in Reachlee or remove Reachlee inside the assistant; either one revokes access immediately. Tokens expire on their own and are deleted when revoked. Deleting your Reachlee account deletes all connections. You can email us at any time to ask what connections exist on your account or to have them removed.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app at least 14 days before they take effect.

13. Contact

For privacy questions or to exercise any of the rights above, email tusharkapil@reachlee.co.