Privacy Policy

Who is responsible

ReachDart is a product of Avryxa Technologies Private Limited, CIN U62011DC2026PTC473164, registered at Plot 82, F/F, Flat No. 103, Sukhiram Park, Uttam Nagar, New Delhi, Delhi 110059, India. We determine the purposes of our account, security, support and billing processing.

When a customer uploads or connects data about other people, the customer generally determines the purpose and instructions for that workspace data. ReachDart processes that data to carry out those instructions. This policy does not replace the customer’s own notice or permission obligations.

What we process and why

We limit processing to the information needed for the service or operation you request.

• Account and profile: name, email address, authentication credentials or verification information, and account/workspace preferences to create, verify, secure and administer access. Passwords are stored as password hashes, not as readable passwords.
• Workspace records: fields, imports, source URLs, notes, formulas, permissions and approved workflow content to organise and process your business data.
• Connected-service information: account identifiers, granted scopes and protected connection credentials to carry out operations you authorise.
• AI inputs and results: the prompt and selected source fields, tool permissions, model identity, source/version evidence and usage records needed for the task you approve.
• Operational and security records: session/device or network information, request and audit events, errors, consent/acceptance receipts and usage records to protect accounts, investigate incidents, demonstrate choices and operate the service.
• Purchases and support: billing identity, transaction references/status, applicable tax or invoice information, and correspondence needed to manage purchases, resolve requests and meet legal duties. Payment providers process payment details; do not enter full card details into workspace records or support messages.

Your choices and the basis for processing

We present the account-processing purpose when requesting your consent. Account terms, acknowledgement of this notice and consent to a stated processing purpose are recorded distinctly. We do not treat an account agreement as blanket permission for marketing, every integration or every use of your contacts.

Certain processing may be required or permitted by applicable law, including security, legal compliance or responding to a request you voluntarily make. We do not use the label “consent” to override requirements for a valid legal basis.

AI sharing, sending, CRM changes and other external actions have their own permission and review controls. Review the actual data and destination before approving. You must also respect rights and withdrawal instructions from people whose data you control.

Who may receive information

We use service providers for hosting, database services, authentication email and AI tasks. The implemented service uses Cloudflare, Neon, Resend and, for approved AI tasks, OpenRouter and the selected model provider. Which connected CRM, mailbox or advertising provider receives data depends on the connection and action you authorise. A configured destination is not evidence that data has been transferred.

Providers receive information needed for the relevant operation under the applicable arrangements. Ask our privacy contact for information about recipients involved in your processing. We may also disclose information when legally required, to protect security or legal rights, or in a lawful business transfer subject to appropriate safeguards.

We do not sell account data or workspace content as a standalone data product. We do not use your workspace content to train our own foundation models. Third-party AI processing remains subject to the selected provider’s applicable terms and retention controls.

Processing locations

ReachDart serves teams globally. Cloud infrastructure and service providers may process data outside the country where you live. We must observe applicable transfer restrictions and any contractual safeguards required for the relevant processing. Contact us if you need information about processing locations or a specific contractual requirement before sharing data.

How long information is kept

We keep information for the service purpose, your documented instructions and applicable legal retention obligations. Relevant periods depend on the record type; we do not promise immediate destruction of evidence that law requires us to retain.

Temporary browser-capture drafts expire after ten minutes; capture review payloads expire after fifteen minutes. Transfer files and staging data expire after seven days. Several task/report and local capture-history views use ninety-day operational retention. These operational windows do not override statutory retention, security-log, accounting, dispute or legal-hold requirements.

Account acceptance and consent evidence records the policy version, purpose and time. Minimal records may be retained to demonstrate your choices, investigate abuse or meet legal duties even when other account data is erased. We restrict retained records to those purposes. Ask us about the applicable retention schedule and any exception affecting your request.

Deletion requests also need to address processors, connected services, backups and records under legal hold. We will explain material exceptions rather than describe a local history deletion as deletion from every external system.

Security

We use access controls, workspace boundaries, encrypted connection credentials, transport safeguards and audit controls appropriate to the service. Credentials should be provided only through the relevant secure connection flow. No service can guarantee absolute security.

If you suspect a compromise or personal-data breach, contact us promptly. We investigate, contain and respond to incidents and notify affected people and competent authorities as applicable law requires.

Access, correction, erasure and nomination

Subject to applicable law and identity verification, you can request a summary of information processed about you and relevant sharing, correction/completion/update, erasure where no continuing purpose or legal requirement applies, and nomination of another individual to exercise applicable rights in the event of death or incapacity.

Use the privacy controls in your account or contact Ravi Prakash at [email protected]. Provide enough information to identify the account and request; do not send passwords, full payment details or unnecessary identity documents. We verify requests proportionately and explain any lawful exception or information needed to complete them.

If a customer controls the workspace data in question, we may need to coordinate with that customer. This does not remove our responsibility for processing for which we determine the purpose. Additional rights may apply where you live.

Withdrawing consent

You can withdraw consent for a processing purpose through the account privacy controls or by contacting us. Withdrawal must be as accessible as giving consent. You may ask for help without accepting new service terms.

Withdrawal does not invalidate processing lawfully completed before withdrawal. We must stop consent-based processing and instruct relevant processors within a reasonable time unless another applicable law permits or requires continued processing. Where account processing is necessary to provide a feature, withdrawing that consent can prevent continued use of that feature; it is not permission to continue unrelated processing.

Privacy and grievance contact

Contact Ravi Prakash at [email protected], or write to Avryxa Technologies Private Limited, Plot 82, F/F, Flat No. 103, Sukhiram Park, Uttam Nagar, New Delhi, Delhi 110059, India. This is the person authorised to answer questions and handle requests about ReachDart’s personal-data processing.

We acknowledge and handle privacy grievances within the applicable legal timeframe, with a maximum grievance-resolution period of ninety days under the DPDP grievance process when applicable. If you remain dissatisfied after using our grievance process, you may approach the competent Data Protection Board or other authority under the applicable law. We do not require you to waive statutory complaint rights.

Children and people with lawful guardians

ReachDart accounts are intended for adults aged eighteen or older acting for themselves or an authorised business. We do not offer a child account. Do not upload personal data about children for prospecting or profiling.

If a person has a lawful guardian and the law requires verifiable guardian consent, contact us before providing that person’s data. An ordinary account checkbox does not establish verifiable parental or guardian consent. If you believe such information has been provided without a valid basis, tell the privacy contact so it can be reviewed and handled appropriately.

Cookies and communications

We use essential authentication and session mechanisms to sign you in and secure the application. These are not optional advertising trackers. We do not bundle consent to marketing or non-essential tracking into account acceptance. If we introduce optional analytics or marketing processing, it requires a separate appropriate choice before that processing begins.

Transactional account, security, service and support communications are distinct from marketing subscriptions. Any optional subscription must provide its own consent and withdrawal route.

Language and policy changes

This notice is available in English. You may request access to the notice in a language specified in the Eighth Schedule to the Constitution of India by contacting the privacy contact. We will arrange an accessible response; do not send sensitive data to request a translation.

We publish a version and effective date when this policy changes. Where a new purpose or law requires fresh consent, we ask separately. Past receipts remain tied to the document versions and purposes actually presented.