Privacy policy

1. Who we are

Perpetio OÜ is the controller of the personal data this policy describes as ours. For any question about privacy, or to use your rights, write to hello@reachpool.ai.

Company

Perpetio OÜ

Registry code

14661567

VAT number

EE102136393

Address

Harju maakond, Tallinn, Kesklinna linnaosa, Kaupmehe tn 7-120, 10114, Estonia

Email

hello@reachpool.ai

2. Our two roles

As a controller, we decide how to use the data of the people who use Reachpool for our customers, of people who contact us, and of visitors to our website. Sections 3, 10 and 13 cover this data.

As a processor, we handle data for our customers, usually agencies, who use Reachpool to run LinkedIn outreach for themselves or their clients: the leads they contact, the conversations their LinkedIn accounts have, and those accounts themselves. The customer decides why and how that data is used, our Data processing agreement governs what we do with it, and the customer’s own privacy notice applies to it. Section 4 describes this data, and section 5 is for people who were contacted through Reachpool.

3. What we collect and why

We collect this data from you, from your organization’s owners and admins who invite you, and from your use of the Service:

We send service emails: sign-in links, the notifications you choose, and important notices about the Service. We do not send marketing newsletters, and if we start to, we will ask you first or let you opt out as the law requires. We do not use advertising trackers or analytics cookies, and we do not sell personal data.

4. Data we process for our customers

As a processor, on our customers’ instructions, we handle:

• Leads’ data: name, headline, current role and company, location, LinkedIn profile address and identifiers, and the public profile content an AI first line is written from; business email addresses that the customer imported or that “Find email” found; and any other fields the customer imports.
• Conversations: connection requests, messages and InMails sent and received through the customer’s LinkedIn accounts, with their times, and the labels, notes and tags the customer’s team adds.
• Campaign activity: which steps were sent to whom and when, invitations accepted, replies, meetings booked.
• The LinkedIn accounts connected (see section 6).

We use this data only to provide the Service to the customer it belongs to. Each customer’s data is kept apart from every other customer’s, and we never use it for our own marketing or combine it across customers. We may count events across all customers in ways that identify no one, as in our public account safety report.

5. If you were contacted through Reachpool

If someone reached out to you on LinkedIn using Reachpool, the business that contacted you, or the agency acting for it, is the controller of your data: it chose to contact you and is responsible for having a lawful basis to do so (in business outreach this is usually its legitimate interest) and for telling you about it. Its data comes from your LinkedIn profile as LinkedIn showed it to the account that contacted you, from lists it imported, and, if it used “Find email”, from email finding services.

To find out what it holds about you, to object to being contacted, or to have your data deleted, reply to the person who contacted you or contact their business. You can also write to us at hello@reachpool.ai: we will pass your request on to the customer concerned and help it answer. A customer can add you to its exclusion list, so that none of its LinkedIn accounts contacts you again.

6. LinkedIn accounts connected to Reachpool

If a customer connects your LinkedIn account to Reachpool, you sign in on LinkedIn’s own page, inside your account’s cloud browser. We never ask for your LinkedIn password and never store or log it, and we do not complete security checks for you.

We keep the account’s session (its LinkedIn cookies) encrypted, readable only by the parts of Reachpool that operate the browser, and its browser profile encrypted in storage. The account always connects through one fixed proxy in its own country. We use the session only to do what the customer sets up, within our daily and weekly limits. When the customer removes the account, its session and browser profile are deleted and its proxy is released.

7. AI features

Two features use AI models, when the customer turns them on:

• AI first lines: the model reads the lead’s public LinkedIn profile and writes an opening line for a message.
• Reply labels: the model reads the words of a conversation’s latest messages (at most eight) to label a reply, for example as interested or not now. It is sent no names, profiles, campaigns or account details.

Both go through OpenRouter to Anthropic’s models, with data collection refused, so the data goes only to a provider that does not use it to train models. Labels only sort the inbox: people decide what to do, and no decision with legal or similarly significant effects is made about anyone by automated means.

8. Who we share data with

We share personal data only with these subprocessors, each for what is listed, and under contracts that bind them to protect it:

Beyond them, we disclose personal data only to authorities when the law requires it, to professional advisers bound by confidentiality, and to a successor if our business is sold or merged, in which case we will tell you.

9. Transfers outside the EEA

Our servers and storage are in Germany. Some subprocessors, such as OpenRouter, Anthropic, Resend and Google, process data in the United States or elsewhere outside the European Economic Area. Such transfers rely on a European Commission adequacy decision (including the EU–US Data Privacy Framework, for recipients certified under it) or on the Commission’s Standard Contractual Clauses, with further safeguards where needed. Write to us for a copy of the safeguards that apply.

10. How long we keep data

• Account details are kept while your organization uses the Service and for up to 60 days after it ends or after you are removed from it.
• Billing records are kept for seven years, as Estonian accounting law requires.
• Technical logs never hold LinkedIn cookies, proxy credentials, message text or leads’ email addresses, and are kept only as long as needed to secure and troubleshoot the Service.
• Messages with us are kept while they are needed to help you, and at most until your organization stops using the Service.
• Records of staff actions are kept while your organization uses the Service.
• Data we process for customers is kept as the customer instructs while it uses the Service. When it stops, the customer can ask for an export for 30 days, after which we delete the data; our backups that still hold it are replaced within a further 14 days.

11. Security

We protect personal data with measures that include encryption in transit; encryption of LinkedIn sessions and proxy credentials under keys per customer; encryption of browser profiles, support captures and backups before they leave our servers; database rules that keep each customer’s data apart; sign-in without passwords; API keys kept only as hashes; and staff access that is limited, needs a recorded reason and is logged. Annex II of our Data processing agreement describes them in full.

12. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have data deleted when there is no longer a reason to keep it;
• restrict how we use it, or object to our use of it based on legitimate interest;
• receive data you gave us in a portable format; and
• withdraw any consent you gave, without affecting earlier use.

Write to hello@reachpool.ai to use them. We may ask you to confirm who you are, and we answer within one month. For data we process for a customer, we pass your request to that customer, as section 5 describes.

You can also complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee, or you can turn to the authority where you live or work.

13. Cookies

Our public pages set no cookies. The console sets only the cookies it needs to work, so it asks for no consent. Over HTTPS, the sign-in cookies’ names carry a __Secure- or __Host- prefix. A sign-in link works once, for 15 minutes.

14. Children

Reachpool is a service for businesses and is not meant for anyone under 18. We do not knowingly collect children’s data.

15. Changes to this policy

We will update this policy when what we do changes. The date at the top shows the last update, and we will tell your organization’s owners about material changes by email or in the console before they apply.

16. Contact

Write to hello@reachpool.ai with any question about this policy or your data, or by post to Perpetio OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Kaupmehe tn 7-120, 10114, Estonia.