Privacy Policy

Who we are

Reach is operated by Upward Technologies B.V., Minister Kanstraat 16 F, 4815 HG Breda, the Netherlands, registered with the Dutch Chamber of Commerce under number 42169743. We decide what goes into the investor list, how long it stays, and who may read it, which makes us the controller for that data. Where you connect your own mailbox and send your own campaigns, you decide who you contact and what you say, and we act on your instructions.

To ask anything about this policy, or to ask us to remove your details, write to us and we will answer.

The investor list

We hold business contact details of people who invest: name, employer, job title, work email address, LinkedIn profile, and where we have it, location, sector and investment stage. We hold no home addresses, no personal phone numbers, and no special category data.

These are business details of individuals acting in a professional capacity. They are still personal data and we treat them as such.

Customers with access can read and search the list inside Reach, and can save individual records into their own workspace so they can write to them. Everything stays inside Reach: there is no download, no export, and no copy leaves the platform. We do not sell or hand over the underlying data. Reach is free while it is in beta, and we intend to charge for access to the list in future; what would be sold is the ability to use it here, never the data itself.

Why we may hold it

We rely on legitimate interests. Ours is operating a business directory that helps companies reach investors who are, by profession, in the business of being reached. We consider this proportionate because the details are professional rather than private, being approached is an ordinary part of the role, objecting is straightforward and permanent, and nothing leaves the platform, so a deletion still reaches every copy of a record, wherever a customer has saved it.

We have written down that assessment, including the arguments against, and we review it when the way we use the data changes.

Where you send campaigns using Reach, you rely on your own basis for contacting the people you choose. We do not make that decision for you.

Where the records come from

Most records were compiled by us from public sources, professional networks, events and referrals. A smaller number are people we have dealt with directly. We also accept contacts contributed by customers, who confirm they may lawfully share them; we check a contributed record before anyone else can see it.

We record which account contributed a record and when. We do not show that to other customers.

How long we keep it

For as long as the record is accurate and the list is running. We re-check email addresses automatically and remove addresses that are proven dead rather than leaving them to rot.

If you ask us to remove you we keep your email address, and nothing else, on a suppression list. That is so a customer cannot add you back later and undo your request. If you would rather we kept nothing at all, say so and we will delete it outright, but we will not then be able to stop somebody re-adding you.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. Because we rely on legitimate interests, an objection is enough, you do not have to give a reason.

The quickest way is the unsubscribe link in any email you receive through Reach. If you are on our investor list, using it removes you from the list itself, not only from the sender who wrote to you: your details go from every workspace at once and cannot be added back.

We will action a removal request without argument. It deletes every record of your address everywhere in Reach at once, the shared list and any copy a customer has saved into their own workspace, because those copies stay on our systems rather than leaving with anyone. What we cannot do is reach customers who have already read your details, written them down elsewhere, or already written to you.

If you are unhappy with how we have handled a request you can complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority.

Telling people we hold their details

Where we obtain details other than from the person themselves, we are required to tell them, unless doing so would take disproportionate effort. We have assessed that question for the list as it stands, written down the reasoning, and published this policy as the standing notice.

This section is under review and may change: it is the part of our position we consider least settled.

Your own data as a customer

We hold your email address, your password as a hash we cannot reverse, your workspaces, and what you do in the product. Where you connect a mailbox we hold the credentials or access token needed to send and read on your behalf, encrypted. You can disconnect a mailbox at any time and we delete those credentials.

Payments are handled by Stripe. We never see or hold your card details.

Where your data sits

On our own server in Europe. We use a small number of third parties to run the service, including Stripe for payment and providers for AI features and email verification. We do not send the investor list to any of them for their own purposes.