Privacy Policy

Who we are

Reachavo is operated from the United Arab Emirates, and we are the controller of the personal data described here. For anything privacy-related, email hello@reachavo.com.

This policy is written to comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

The free tools upload nothing

Worth stating before anything else, because it is unusual. The tools at /tools — the snippet preview, the hreflang generator, keyword clustering and the Search Console tools — run entirely in your browser. What you paste or upload is processed on your own machine and never sent to us. There is no account, no upload and no server-side copy of your keyword list or your performance export.

The only data we receive from those pages is the ordinary web analytics described below, which records that a page was viewed and not what you typed into it.

What we collect

Account information

Your email address, an optional name, and a password which we store only as a cryptographic hash — we cannot read it and cannot tell you what it is. If you sign up for a feature waitlist we store the email address you gave and which feature it was for.

Billing information

Card details are handled entirely by our payment processor and never reach our servers. We store the identifiers that processor gives us — your customer and subscription references, the plan you are on, and when the current period ends — so we know what you are entitled to.

What you do in the product

The projects you create, the domains and competitors you analyse, the keywords you track, the reports and audits you run, and a usage ledger recording each external data request made on your behalf and its cost. The ledger is how plan limits and budgets are enforced.

Security and abuse-prevention records

We record IP addresses and email addresses against sign-in, sign-up, waitlist and checkout attempts, purely to rate-limit them. Without this a password-guessing attack against your account would be unlimited. These records are automatically deleted after 24 hours.

Analytics and cookies

On the public marketing site we use Google Analytics 4 to understand which pages people find useful. It sets cookies and collects a truncated IP address, device and browser information, and the pages visited. It runs only on the production site — not in development or on preview deployments.

We also set a session cookie when you sign in, which is strictly necessary and cannot be turned off while you are logged in. Your light/dark theme preference is kept in your browser’s local storage and is never sent to us.

We do not currently show a cookie consent banner. If you would rather not be measured, browser-level tracking protection or an ad blocker will stop the analytics script loading, and the site works normally without it.

Why we use it

• To provide the service — running your reports, holding your projects, enforcing the limits on your plan. This is necessary to perform our contract with you.
• To take payment and manage subscriptions.
• To keep accounts secure and prevent abuse. This is our legitimate interest and yours.
• To email you about the service — trial expiry, failed payments, material changes. These are operational messages and you cannot opt out of them while you hold an account.
• To understand how the site is used, in aggregate, so we know what to build next.

We do not sell personal data, and we do not use your data to train machine-learning models.

Who else sees it

We keep the list of third parties short. Each one receives only what it needs:

• Our hosting and database providers, which run the application and store its data.
• Our payment processor, which handles card details and subscriptions.
• Third-party search-data providers, which supply the ranking, keyword, backlink and AI-mention data behind reports. We send them the query — a domain, a keyword, a location — not your identity.
• Our analytics provider, as described above.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If we are ever involved in a sale or merger, data may transfer to the buyer under the same protections, and we would tell you.

We can provide the current list of named providers on request — email hello@reachavo.com.

Where your data is processed

Our providers operate infrastructure outside the United Arab Emirates, including in the European Union and the United States, so your data is transferred and processed there. We use providers that offer appropriate contractual protections for those transfers.

How long we keep it

• Account data — for as long as your account is open. If you close it, we delete or anonymise your personal data within 90 days, except where we must retain records for tax or accounting purposes.
• Rank tracking history— as long as your plan’s retention allows: 30 days on Starter, 90 on Growth and 365 on Scale.
• Cached data-provider responses — up to 37 days, then automatically deleted. This cache is keyed by the query rather than by the person, and is shared between accounts so the same lookup is not bought twice.
• Security and rate-limit records — 24 hours.
• Billing records — as long as UAE tax and accounting law requires.

How we protect it

Traffic is encrypted in transit. Passwords are stored only as hashes. Access to production data is limited to those who need it. Every record belonging to an account is scoped to that account at the database level, so one customer cannot read another’s projects or reports.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

Your rights

Under UAE data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete your data, where we have no obligation to keep it;
• restrict or object to certain processing;
• transfer your data to another provider in a structured, machine-readable format;
• withdraw consent, where processing relies on it.

Email hello@reachavo.com and we will respond within 30 days. You can also complain to the UAE Data Office if you think we have handled your data improperly.

Most of these you can do yourself: your projects, keywords and reports can be exported to CSV at any time, and closing your account from settings starts the deletion process.

Children

Reachavo is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy. If a change materially affects how we handle your data we will email you before it takes effect. The date at the top shows when it last changed.

Contact

Email hello@reachavo.com, or use the contact page.