Privacy Policy

We serve as an independent data controller when managing website analytics, incoming marketing inquiries, and personal user account credentials. In that role, we determine processing purposes for prospect submissions, promotional outreach, and administrative login details across our systems.

We act as a Data Processor for operational records that our Customers upload to or generate through the Services. The Customer agreements govern these operational records, meaning each Customer controls how we process its data. We require our Data Sub Processors to protect Personal Data under written agreements with confidentiality and security obligations consistent with our commitments to Customers.

We collect Personal Data directly from Users, from our Customers (for example, when a Customer adds its drivers or technicians to the platform), and automatically through cookies and device permissions. We collect Personal Data for the purposes described in this Policy and limit collection to what is reasonably necessary for those purposes.

We process Personal Data to manage customer platform accounts and coordinate urgent maintenance dispatches across the REACH platform. Concurrently, we track platform usage patterns to direct in-app guidance, build new features, and evaluate tier upgrade opportunities. We do not sell Personal Data, and we do not share it for cross-context behavioral advertising.

We use Users’ data for:

• Authenticating user login sessions and verifying administrative permissions across company accounts.
• Routing service requests and live User coordinates directly to assigned service facilities.
• Delivering automated dispatch updates, emergency service alerts, and technical platform notices.
• Evaluating platform feature adoption and transaction volume to deliver guided product workflows and propose relevant service tier upgrades.
• Analyzing how the Services are used to improve them and develop new features, including AI-based features.
• Delivering direct sales outreach, educational email newsletters, product release bulletins, and marketing notices to prospects and contacts who have consented or where otherwise permitted by law.
• Evaluating aggregate visitor paths to refine digital marketing funnels and respond to sales inquiries.

Where we use data from the Services to improve our products, including AI-based features, we do so as permitted by our Customer agreements and, where feasible, using de-identified or aggregated data.

We share Personal Data only as described below. Corporate business metrics—including equipment repair logs, telematics fault codes, and company billing records—remain governed by commercial customer contracts.

• Service Participants: We share relevant details, such as name, phone number, and incident location, with the service facility and technician assigned to a service event, and with the requesting Customer.
• Data Sub Processors: We disclose identifiers, contact details, geolocation, and technical data to vendors that provide hosting, email and SMS delivery, CRM, analytics, and customer support, under contracts limiting their use of the data.
• Customers: Our Customers access their authorized Users’ application activity, dispatch records, and incident status histories in their portal.
• Legal Disclosures: We may disclose Personal Data to comply with law or legal process, to protect the rights, safety, or property of any person, to prevent fraud or security incidents, or in connection with a merger, acquisition, or sale of assets.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We deploy functional cookies to maintain persistent user sessions, enforce security protocols, and record administrative navigation choices. Concurrently, our marketing website uses conversion analytics tags to measure campaign performance and evaluate prospect interaction patterns.

We don't sell browsing history or share individual tracking records with external ad exchanges for cross-site behavioral targeting. We honor Global Privacy Control signals. You can manage non-essential cookies through our cookie settings link or your browser. Our website uses Google Analytics, LinkedIn Insight Tag, etc.

We send commercial marketing communications, service updates, and product announcements to prospects and contacts who have consented or where otherwise permitted by law. Users can opt out of commercial marketing emails at any time by clicking the unsubscribe link in our messages. You can opt out of text messages by replying STOP, or reply HELP for help. Message and data rates may apply.

Transactional service messages—such as live breakdown dispatches, emergency driver notifications, and billing invoices—continue without interruption when Users unsubscribe from marketing lists. These operational communications remain essential to managing active customer accounts across the REACH Platform.

We use industry-standard safeguards, including TLS encryption in transit, AES encryption at rest, salted password hashing, multi-factor authentication for internal access, and periodic access reviews. No method of transmission or storage is completely secure.

We mandate multi-factor authentication for internal system access, and we restrict database maintenance to authorized engineering staff. Our technical team conducts verified access audits and security reviews to protect our infrastructure against unauthorized access.

We store and process operational dispatch records within verified United States data center facilities across our core infrastructure network. Personal Data is stored and processed in the United States. If you access the Services from outside the U.S., including Canada or Mexico, your data will be transferred to the U.S., where it may be accessible to U.S. authorities under U.S. law. We apply uniform encryption controls and strict access governance to all incoming platform data regardless of origin.

When a Customer’s account ends, we delete or de-identify associated User data within 90 days of the Customer’s request or as set out in the Customer agreement, except where retention is required by law. We retain prospect lead records until Users request deletion.

Our systems preserve shared transaction records and equipment service logs as defined in our Customer agreements. This practice ensures all transacting Customers maintain accurate historical records for prior platform service events.

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your Personal Data, and to opt out of certain processing. We will not discriminate against you for exercising these rights. You may use an authorized agent. We will verify your identity before responding. If we process Users’ Personal Data on behalf of a Customer, we route their request directly to that Customer.

Users can disable mobile device location and motion permissions at any time within Users’ smartphone hardware settings. We review and resolve verified individual privacy requests within the time required by applicable law (generally within 30-45 days).

We collect precise geolocation, which is sensitive personal information under California law, only to provide the Services, and we do not use it to infer characteristics about you. We don't sell Users’ personal data, and we don't share user records for cross-context behavioral advertising campaigns. California users can submit formal access, correction, or deletion requests directly by emailing help@reach24.net with verified identification details.

Contact our compliance team by email at help@reach24.net for any questions regarding our data practices. We handle all privacy questions, data requests, and platform inquiries directly through our compliance desk.