Privacy Policy

How ReachClaw handles account data, integrations, analytics, and security.

Privacy Policy•Terms of Use

Last updated: October 26, 2026

ReachClaw ("ReachClaw", "we", "us", or "our") provides AI-assisted email software for support and outbound sales, and a chat box customers can add to their own websites. This Privacy Policy explains what we collect, how we use it, and the choices you have.

By using ReachClaw, you agree to this Privacy Policy.

1. Information We Collect

1.1 Account and authentication data

  • Name and email address. You can change your name in Settings → Account.
  • Encrypted authentication/session data managed by our auth provider.
  • If you log in with Google, we use Google only to confirm who you are. We don't keep the access tokens Google sends at login. Gmail access comes only from connecting an inbox (see section 5).
  • Login metadata such as IP address and user agent.
  • If you ask to reset your password, a one-time reset code that expires after one hour. We email the reset link to your account address through our email provider (Resend). Setting a new password signs you out of every other session.
  • When your password changes (in Settings or with a reset link), we email your account address to say so, with a link to reset it if the change wasn't you.
  • If an account was created with a password and its email address was never confirmed (by a reset link), the first time someone logs in to it with Google for that address we remove the old password, sign out every other device and email the address. Using a reset link marks the address as confirmed.
  • In Settings → Account you can see the browsers where your account is logged in (browser, device type and dates, read from the login metadata above) and sign any of them out. Expired login sessions are deleted automatically each night.

1.2 Workspace/customer data

  • Company name and website URL.
  • Onboarding and subscription status.
  • Plan, billing status, and Stripe customer/subscription identifiers.

1.3 Gmail connection data

  • Connected mailbox address and profile display name.
  • Encrypted OAuth tokens for the connected Gmail account.
  • When you unlink a Gmail account (Settings → Email), we delete its saved tokens, stop Gmail's new-mail notifications for it and ask Google to revoke ReachClaw's access, so it no longer appears under third-party access in your Google Account. Google revokes access for the whole Google account: if you also sign in to ReachClaw with it, Google asks for your permission again next time. Emails already synced stay in your Inbox unless you also choose to delete them. You can remove ReachClaw's access yourself at any time in your Google Account's security settings.
  • Email data needed to run the product, including sender/recipient info, subject lines, message content, thread/message IDs, draft/approval states, and send status.

1.4 Outreach and engagement data

  • Leads data you add or generate (for example: name, email, company, role, status, notes, score).
  • Campaign configuration and generated/sent outreach emails.
  • Engagement events (opens, clicks, replies), including event metadata and anti-bot fields.
  • For engagement events we may store hashed IP values and user-agent strings for abuse/bot detection.
  • When someone unsubscribes from a customer's outreach emails, we keep their email address on that customer's do-not-email list, even if the lead is later deleted or edited, so they are not added back and emailed again. The list belongs to that customer's workspace and is deleted with it. The unsubscribe link in each outreach email carries the recipient's address in encrypted form, which only ReachClaw can read, so the request still counts if the lead was deleted in the meantime.

1.5 Knowledge base data

  • Website pages crawled from URLs you provide.
  • Content you add manually to knowledge.
  • Uploaded documents (such as PDF, TXT, CSV), including filename, MIME type, size, and storage URL. The storage URL is never put in AI replies, outbound emails or chat answers. Before storing a file we check that its contents match its name (a real PDF, or plain text for TXT and CSV).
  • AI file references linked to your configured AI provider key.

1.6 AI configuration data

  • Encrypted customer AI API keys when you provide them.
  • If you connect MCP servers: each server's name and the features it may be used for, plus its address and access token, both stored encrypted (an address can contain an access key).
  • AI usage metrics (for example token counts and cost tracking) for billing/operations.

1.7 Notification settings

  • The notification channels you choose (dashboard, email, Telegram) and an optional notification email address.
  • If you connect Telegram: the numeric ID of your private chat with the ReachClaw bot, so alerts can reach you. It is removed when you disconnect, or automatically if you block the bot.

1.8 Usage, diagnostics, and analytics

  • Product usage and operational logs.
  • In-app rate limiting and security telemetry.
  • Website analytics via Google Analytics and Ahrefs analytics scripts on public pages. Besides page views, Google Analytics records interactions on our own site such as clicks on sign-up buttons, pricing views, checkout steps, opening our website chat and use of our free tools. These records carry the page, plan or tool name only, never your email address, name or anything you typed.

1.9 Website chat (Live chat) data

When a ReachClaw customer adds the ReachClaw chat to their website, we process the following for that customer:

  • Messages visitors type into the chat and the answers it gives.
  • The email address, name and message a visitor enters when they ask for a person or leave a message.
  • The website and page address where the chat was opened.
  • A random visitor ID stored in the browser (see section 6), so a conversation continues across pages.
  • Feedback on answers (thumbs up or down), answer timing, and usage counts.

If the customer turns on email or Telegram notifications, we send them a copy of a visitor's first message when a chat starts, and the visitor's note when they ask for a person, so they can follow up.

We use this data to show the customer chat analytics, such as how many chats there were, what visitors asked about and which questions the chat couldn't answer. If the customer writes an answer to one of those questions, it is saved as a note in their knowledge base, like any other note they add, and used for future chat and email replies.

If the customer's own website signs visitors in to the chat, the website sends us the signed-in visitor's email address with each message. We check it, store it with the conversation and show it to the customer.

If the customer lets the chat look things up in their own systems (MCP servers the customer connects), the visitor's question and the conversation so far are sent through Anthropic to those servers, which the customer runs or chooses. The customer is responsible for what those systems return. We store only the names of the tools that were used with each answer, not what they returned.

If the customer lets visitors talk to the chat instead of typing, a visitor who uses the microphone gives their browser permission to listen. The visitor's own browser turns their speech into text using the browser maker's speech service (for example, Chrome uses Google, Safari uses Apple and Edge uses Microsoft), under that company's terms. ReachClaw never receives or stores the audio. We receive only the text, which is handled like a typed message and marked as spoken so the customer can see it. Answers may be read aloud by the browser's built-in voices; some browsers use their maker's online voices for this. During a voice call the microphone stays on while an answer is read aloud, so the visitor can interrupt by speaking; it turns off when the visitor ends the call or closes the chat.

IP addresses of chat visitors are used only briefly, in memory, to limit abuse (rate limiting). They are not stored with conversations.

For website chat data, the customer who added the chat to their website decides how it is used and is responsible for it. ReachClaw processes it on the customer's behalf to provide the chat. Visitors with questions about their chat data should contact the website owner.

The chat on reachclaw.com itself is the same product, run by a ReachClaw demo account. If you use it, your messages and the answers are stored and handled as described in this section, with ReachClaw as the website owner responsible for them. That chat can also look up live facts about the product (plans, limits, service status and the chat's own usage counts) through a read-only ReachClaw endpoint; nothing you type is stored by that look-up beyond the conversation itself.

2. How We Use Information

We use your information to:

  • Provide and operate ReachClaw features.
  • Authenticate users and secure accounts.
  • Connect and process Gmail activity you authorize.
  • Generate, track, and send drafts/campaigns.
  • Crawl and index knowledge sources you select.
  • Process billing/subscription events.
  • Maintain reliability, prevent abuse, and improve performance.
  • Communicate service updates and account notices.
  • Send the notifications you turn on in Settings → Notifications, such as a daily summary email with counts of drafts to review, unopened emails and website chats (counts and links only, no email or chat content).
  • If you connect Telegram, send alerts to your Telegram chat: a new AI reply draft (the sender, subject, the start of their message and the draft, with buttons to approve and send it or reject it), a visitor's first website chat message, and a visitor's request to talk to a person.
  • Comply with legal obligations.

3. Legal Basis (where applicable)

Depending on your location, we process data based on:

  • Contract performance (providing the service you request).
  • Legitimate interests (security, diagnostics, product improvement).
  • Consent (where required, including certain integrations/cookies).
  • Legal obligations.

4. Sharing and Disclosure

We do not sell your personal information.

We share data only with providers needed to run the service, such as:

  • Google APIs (for Gmail features you authorize).
  • Stripe (billing and subscriptions).
  • Anthropic (AI processing when enabled). If you connect MCP servers, Anthropic sends the relevant email or chat content to those servers so the AI can use their tools.
  • Cloudflare R2 (document storage, if enabled).
  • Resend (transactional email delivery).
  • Telegram (only if you connect it: the alerts described in section 2 are delivered through Telegram's Bot API).

We may disclose information if required by law or to protect rights, safety, and service integrity.

5. Google API Data

If you connect Gmail, our use and transfer of information received from Google APIs is limited to providing and improving user-facing features in ReachClaw and follows applicable Google API policy requirements, including the Google API Services User Data Policy (including Limited Use requirements).

6. Cookies and Similar Technologies

ReachClaw uses cookies and similar technologies for:

  • Authentication/session management.
  • Security and fraud prevention.
  • Product and website analytics on public pages. Analytics scripts are not loaded on the password reset page, whose address carries the reset code.
  • Remembering dashboard display choices, such as whether you hid or collapsed the setup checklist. These cookies hold only that choice.

The website chat does not set cookies. It stores a random visitor ID in the browser's local storage within the chat frame (served from reachclaw.com) so a visitor's conversation continues across pages. ReachClaw's own website analytics scripts are not loaded inside the chat.

You can manage cookies through your browser settings, but essential auth cookies are required for core login functionality.

7. Data Retention

We retain data for as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. Retention duration varies by data type and account status.

Addresses on a customer's do-not-email list (people who unsubscribed from their outreach) are kept while the customer's account exists, so the opt-out keeps working.

Website chat conversations are deleted automatically 180 days after their last message. The customer who added the chat can also delete any conversation sooner from their dashboard; it is then removed for good.

To recover from a failure, we copy our databases each night to backups kept on our own server, readable only by its administrator account, for 14 days. Data you delete, or that is deleted automatically, stays in those copies until they expire, at most 14 days later.

When feasible and requested, we delete or anonymize data that is no longer required.

8. Security

We apply technical and organizational safeguards, including:

  • Encryption for sensitive stored secrets (for example OAuth/API credentials).
  • Access controls and customer data isolation by workspace.
  • Encrypted connections only: reachclaw.com is served over HTTPS, and tells your browser to keep using HTTPS for it for a year.
  • Monitoring and rate limiting for abuse protection.
  • Limits on wrong passwords: after 10 wrong passwords for one email address within 15 minutes, password login for that address pauses for the rest of that time. Wrong current passwords typed into Settings → Account → Change password count toward the same 10, and changing the password there pauses too (a reset link still works). The count is saved under a one-way code made from the address, never the address itself, so a restart of our servers doesn't reset it, and it is deleted once the 15 minutes are over.
  • Limits per network address on login, sign-up and password reset requests (for example, at most 10 sign-ups an hour from one address) are counted the same way: under a one-way code of the network address and page, deleted when that limit's time window ends (at most an hour). So are the limits on actions that cost something, such as checking an AI key or testing an MCP server: a one-way code of your account or network address, deleted when the window ends.
  • Limits on password reset emails: one address gets at most 3 reset links an hour, however many times a reset is requested. Requests over that limit get the same answer but no email. This count is also kept only under a one-way code of the address, for that hour.
  • The website reader (ReachClawBot) only reads public web addresses. It refuses addresses on private or local networks, including after a redirect, so a typed address can't make it read ReachClaw's own servers.
  • Server logs identify emails, inbox connections and accounts by internal id, not by email address. Addresses typed into a failed login are masked before the log line is written.
  • When our staff change your subscription or plan from our admin tools (cancel it, change the plan, or give or end complimentary access), we keep a record of what changed, when, and any reason given, so we can answer questions about your account later. It is visible only to ReachClaw administrators.

No security system is perfect, and we cannot guarantee absolute security.

9. International Transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for cross-border data transfers.

10. Your Rights and Choices

Depending on your location, you may have rights to:

  • Access personal data we hold about you.
  • Correct inaccurate data.
  • Delete data.
  • Object to or restrict certain processing.
  • Request portability of certain data.

To make a request, contact us at [email protected].

11. Children's Privacy

ReachClaw is not directed to children under 13 (or equivalent minimum age in your jurisdiction), and we do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, when required, provide additional notice.

13. Contact

Questions about this Privacy Policy: [email protected]