Privacy

Who we are

ReachKit (“ReachKit”, “we”, “us”) is operated by [[imprint: owner fills legal entity, address, VAT id]]. This notice explains how we handle personal data when you use the website and product at reachkit.app. For any question about it, or to exercise any of the rights below, write to the address in our Imprint.

What we collect

We collect as little as the product needs.

• Scan inputs. The website address you submit, and the report we build from it: its Discoverability Score, the searches and AI answers we measured, and the three problems we count. A free report is public at its own address from the moment it finishes and stays there; anyone holding the link can read it. Search engines are told not to index it.
• Your network address, hashed. Free scans are limited per network. We keep a salted one-way hash of the address the scan came from, never the address itself.
• Your email address. We receive it when you ask for the free page — that is your opt-in to receiving that page and up to three short follow-ups about that domain, sent at 24, 72 and 168 hours, which stop the moment you subscribe or opt out. Every one of those mails carries a working opt-out link. We also receive it when you pay: it is where your sign-in link and receipts go. There is no password; you sign in with a one-time emailed link.
• Billing data. Stripe collects and holds your card details. We store your subscription status, a Stripe customer reference, the billing country you gave and, if you entered one, your VAT number.
• Your site and market. Your domain, the market category and up to five rival domains you confirm, your publishing settings, the voice note and never-claim list you write, and — if you connect one — the WordPress credentials you give us, encrypted at rest, never logged, and revoked when you disconnect.
• The pages we write for you, their drafts, and the record of every publish: the search it targets, when it went live, and where.

How we use it

To run scans and render reports; to write and deliver the free page you asked for and its follow-ups; to sign you in; to take payment and run your subscription; to write, publish and verify your pages; to re-measure your market every week and tell you what moved; to limit free scans per network; and to protect the service from abuse. We do not sell personal data, and we send no marketing beyond the follow-ups described above.

Language models

ReachKit uses Anthropic’s language models for two things: to label your market and propose the questions it asks, and to write the pages we publish for you — each grounded in facts read from your own live pages, with the source of each fact recorded. Every word ReachKit says in its own voice — on a screen or in a mail — is written by a person, never by a model.

Service providers

Each receives only the data its job needs.

• Supabase — our database and the sign-in link system.
• Vercel — hosting for every request to reachkit.app and for the pages we serve for you.
• Stripe — checkout, subscription billing, invoices and the billing portal.
• Resend — delivery of every email we send.
• DataForSEO — search rankings, search volumes and AI-answer data used while measuring.
• Anthropic — the language models described above.

Public reports and their removal

A free report is public at its address. If you own a site and want its report taken down, write to remove@reachkit.app. A granted request takes the report offline within five working days, and the domain is not scanned again unless you ask us to make it scannable.

Legal basis and retention

Where the GDPR applies, we process your data to perform our contract with you — measuring, writing and publishing — and on our legitimate interest in limiting abuse and in following up on an action you started: the free page you asked for and its capped follow-ups. Free reports stay public until their owner asks for removal. Account, site and billing data stay for as long as your account exists. When you delete your account, your pages are exported to you first and then removed, and we act on the deletion at once, except for records the law requires us to keep, such as invoices.

Your rights

You can ask for access to, correction of, deletion of or a copy of your personal data, and object to or restrict certain processing. Settings lets you export everything you have and delete your account yourself; for anything else, write to the address in our Imprint and we will handle it by hand. If you are in the EU or EEA you can also complain to your local data protection authority.

Cookies

We set one cookie, to keep you signed in. We run no analytics cookies, no advertising cookies and no cross-site trackers.

Changes

We update this notice as the product changes; the date above is always the current version’s.