Privacy Policy

Welcome to RakuReach. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we look after your personal data when you use our services, what your privacy rights are, and how the law protects you.

We collect the following types of information:

• Account information: Name, email address, and profile information from your Google account.
• Contact data: LinkedIn profile information you choose to import — names, headlines, job titles, company information, education, skills, URLs, and public context returned by web research, CSV upload, or manual entry.
• Resume autofill: If you paste or upload resume text to autofill your profile, the text is parsed in memory to suggest profile fields and is not persisted. Only the fields you keep and save reach our database.
• Email data: Email content, recipients, and metadata for outreach you approve, along with follow-up sequences, scheduled sends, response classifications, and email verification history.
• Calendar data: Calendar events and availability used for scheduling and for generating meeting prep briefs.
• Agent activity: Drafts, campaign plans, and the actions the agent takes on your behalf, kept so you can review and override them.
• Billing data: Paid checkout is currently disabled. If paid plans return, we may store subscription state and limited customer information returned by the payment processor disclosed at checkout. Card details would not be stored on our servers.
• Support and feedback: Messages you send us, including feedback submitted from the product. Feedback is forwarded to our issue tracker so we can act on it.
• Usage data: Information about how you use the service, including features accessed, actions taken, and onboarding progress.

We use your information to:

• Provide and maintain our networking automation service
• Generate personalized outreach emails using AI, on your behalf
• Manage follow-up sequences and scheduled sends, classify responses, and surface them to you
• Run the agent flow that drafts, plans, and proposes next steps for your approval
• Sync with your calendar for scheduling and to generate meeting prep briefs from your availability
• Look up and verify professional contact details using third-party data providers
• Send transactional and product email — receipts, weekly digests, and product notifications you have opted in to
• Improve our service and develop new features
• Communicate with you about service updates and support
• Process payments and manage subscriptions if paid checkout is re-enabled

We do not sell your personal data. We share specific, scoped data with the processors that run the product:

• Hosting and database: Supabase (database, authentication, storage) and Vercel (web hosting).
• Payments: Paid checkout is currently disabled. If it is re-enabled, the payment processor disclosed at checkout would process subscriptions and store payment-method details on its own systems.
• Email delivery: Resend sends our transactional and notification email (receipts, digests, account messages). Outreach you approve is sent through your own Gmail account via the Gmail API.
• Contact lookup and research: Hunter.io for email lookups and Exa for web research, used only with inputs you provide.
• AI providers: Model providers used for drafting and agent actions — currently OpenRouter (routing to Google Gemini), Google Gemini directly as a fallback, and Google Gemini for post-call audio transcription. We share only the data necessary for the request.
• Rate limiting: Upstash Redis stores short-lived counters tied to account identifiers, not message content.
• Support and feedback: Feedback you submit from the product is forwarded to our issue tracker (Linear) so we can respond and act on it.
• Legal requirements: When required by law or to protect our rights.

We implement appropriate technical and organizational security measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Secure cloud infrastructure (Supabase, Vercel)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data
• Withdraw consent at any time
• Object to processing of your data

To exercise these rights, please contact us at support@rakureach.net.

We retain your personal data only for as long as necessary to provide our service and fulfill the purposes outlined in this privacy policy. Specific windows we apply:

• Account deletion: When you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to retain it by law.
• Subscription cancellation: Paid checkout is currently disabled. If paid subscriptions return, any paid data-retention terms will be presented before checkout.
• Contact overage: If your saved contacts exceed the included contact limit, we warn you in-product. After the grace period in the warning passes, contacts beyond the limit and their associated sent emails, responses, and verification history are removed, with the most recently used contacts kept.
• Logs and operational data: Operational and security logs are retained for a limited period for debugging and abuse prevention.

RakuReach’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect your Google account, we request the minimum scopes needed for the feature you are using:

• Gmail send— to send outreach you have approved.
• Gmail read— to detect replies and classify responses to your outreach.
• Gmail modify— to label and organize messages we send or that reply to your campaigns. We do not delete other email in your inbox.
• Calendar events and Calendar read— to read your availability for scheduling and to create the events you confirm.

You can revoke these permissions at any time from your Google account’s security settings.

The RakuReach Opportunity Capture browser extension detects job postings and, only when you ask it to, researches relevant people for that role. It is designed to stay passive until you act:

• On-device detection: Job-page detection runs entirely inside your browser. The extension does not send page content, browsing history, or visited URLs to our servers while you browse.
• Research you initiate:When you click “Find people”, the extension sends that job posting’s URL, title, company, location, and a short description snippet to RakuReach to run people research. Nothing is sent before you click.
• Contacts you save: Saving a person from research results creates a normal contact in your RakuReach account, covered by the sections above.
• Sign-in:The extension connects to your existing RakuReach account through a one-time authorization. Short-lived access tokens are stored in the extension’s local storage on your device and are never exposed to the pages you visit. Signing out removes them.
• Local caching:Research results are cached on your device for up to seven days so reopening a job page is fast. You can clear them with the extension’s Reset control or by removing the extension.

The extension does not sell your data, does not collect analytics from the pages you visit, and uses the data above only to provide the features you invoke.

We use cookies and similar tracking technologies to improve your experience, analyze usage, and maintain your session. You can control cookies through your browser settings.

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the “Last updated” date.

If you have any questions about this privacy policy or our data practices, please contact us at support@rakureach.net.