Privacy Policy

Last updated: 2026-08-11

This is a working draft prepared for B2Reach. It has not been reviewed by a licensed attorney and should not be relied on as binding until it has been.

This Privacy Policy explains how B2Reach ("B2Reach," "we," "us") collects, uses, and shares personal data. B2Reach is established in Sweden, so this Policy — and the processing it describes — is governed by the EU General Data Protection Regulation (GDPR) regardless of where you are located.

This Policy applies to three groups of people, differently:

Site visitors — anyone browsing our website before creating an account.
Customers— the person who creates a B2Reach account and their teammates ("you," "Customer"), read together with our Terms and Conditions.
Recipients— the individuals at the businesses your campaigns target, whose name, mailing address, and (where applicable) phone number we process on your behalf to run your campaigns. For Recipients, B2Reach acts as a data processor, you (the Customer) are the data controller, and Section 10 of our Terms and Conditions — not this Policy — is the primary document governing that processing. This Policy nonetheless describes it below for transparency. A Recipient who wants to exercise a right described in Section 8 should start with the Customer whose letter they received; if that isn't possible, contact us using Section 11 and we will route the request to the relevant Customer or handle it directly where required by law.

1. Personal Data We Collect

Account data (from you) — name, email, business name and return address, password (hashed), billing details (processed by Stripe — we do not store card numbers), and your communications with us.
Usage data (from your browser) — pages visited, device and browser type, IP address, and the cookies described in Section 4.
Campaign and Recipient data (from you, or found on your behalf) — the target-list criteria you set, and the names, business names, mailing addresses, and phone numbers of the Recipients your campaigns identify or contact, plus response data (call and QR-scan events) tied to a specific letter.

2. How We Use Personal Data

Purpose	Legal basis
Create and administer your account, provide the Service	Performance of our contract with you
Bill you and process payments	Performance of our contract with you
Find, research, and write personalized letters to Recipients on your behalf	Performance of our contract with you (as your processor); legitimate interest in direct-to-business marketing (as to Recipient data)
Print, mail, and track responses to letters	Performance of our contract with you
Detect fraud, enforce our Acceptable Use Policy, and keep the Service secure	Legitimate interest
Send you service and billing communications	Performance of our contract with you / legal obligation
Send you marketing about B2Reach, if you opted in	Consent, revocable at any time
Remember your login and your cookie choice	Consent (non-essential cookies) / legitimate interest (strictly necessary cookies)

We do not sell personal data, and we do not use Customer or Recipient data to train AI models for any purpose beyond providing the Service to that Customer.

We share personal data with the service providers below, each acting under a data processing agreement, only for the purpose stated:

Supabase — account authentication and database hosting.
Stripe — payment processing and billing.
Anthropic — drafts personalized letter content from your targeting criteria and Recipient research.
Firecrawl, SerpAPI, Parallel, and Apify — research and identify prospective Recipients matching your target profile.
PostGrid — prints and mails letters.
Twilio — powers call tracking for inbound responses.
Resend — sends transactional email to Customers (receipts, digests, account notices).
Cal.com — powers meeting scheduling, if you book a call with us.

We may also disclose personal data if required by law, to protect the rights, property, or safety of B2Reach or others, or as part of a merger, acquisition, or sale of assets (with notice to you where required).

4. Cookies

We use a small number of cookies:

Strictly necessary— keeps you signed in (set by Supabase auth) and remembers the choice you make in our cookie banner. These cannot be disabled and don't require consent under applicable law.
We do not currently use analytics, advertising, or tracking cookies. If that changes, we will update this Policy and the cookie banner shown on your first visit.

Refusing cookies in the banner does not affect the strictly necessary session cookie needed to sign in; you can remove it at any time by clearing your browser's cookies for this site.

5. International Transfers

We are established in the EU, but several of the providers listed in Section 3 (Stripe, Anthropic, Firecrawl, SerpAPI, Parallel, Apify, PostGrid, Twilio, Resend, and Cal.com) process data in the United States. Each transfer is covered by the EU Standard Contractual Clauses or, where the provider is self-certified, the EU-US Data Privacy Framework.

6. Retention

Account data — retained while your account is active, and deleted or anonymized within 90 days of account closure, except where we must keep it longer to comply with law (e.g., billing records) or resolve a dispute.
Campaign and Recipient data — retained as described in Section 14 of our Terms and Conditions.
Cookies — the consent-choice cookie expires after 12 months; the auth session cookie expires when you sign out or after a period of inactivity.

7. Security

We maintain reasonable technical and organizational measures to protect personal data, including encryption in transit, access controls limiting who at B2Reach can view Recipient and Customer data, and requiring equivalent protections from the providers in Section 3. No system is completely secure; if we become aware of a breach affecting your data, we will notify you without undue delay, consistent with Section 10 of our Terms and Conditions.

8. Your Rights

Subject to the conditions and exceptions under applicable law, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten").
Restrict or object to certain processing, including processing based on legitimate interest.
Port your data to another provider in a machine-readable format.
Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal.
Lodge a complaint with a supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se), or your local data protection authority if you’re located elsewhere in the EU/EEA.

To exercise a right, contact us using Section 11. We will respond within one month, extendable by two further months for complex requests, as GDPR permits. Where B2Reach is acting only as a processor for Recipient data (see the introduction above), we will forward or assist with your request as the Customer's processor rather than responding to it directly, unless the Customer cannot be identified or has ceased operating.

If you are a California, Colorado, Connecticut, Virginia, Texas, or other US state resident with equivalent rights under state privacy law, you can exercise them through the same contact in Section 11; we do not sell personal data or use it for targeted advertising, so most of those statutes' opt-out rights do not apply to our processing in the first place.

9. Children

The Service is a business tool and is not directed to, and we do not knowingly collect personal data from, anyone under 18.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified to active Customers with reasonable advance notice, consistent with Section 16 of our Terms and Conditions. Continued use of the Service after a change takes effect constitutes acceptance of the revised Policy.

11. Contact

Questions about this Policy, or requests to exercise a right described above, can be directed to us at [email protected].