Scope and controller
This policy covers the public Reach website, brand and creator accounts, workspaces, web and hybrid applications, API requests and data received when a user connects a social account or an external sign-in provider.
Reach is a product of Tag.it Coding Experts, Lda. Privacy requests can be submitted through the public contact form, identifying the request as a privacy matter.
Personal data we process
Depending on the feature used, Reach may process identity and contact details, authentication and security events, brand or creator profiles, campaign content, files, prompts, calendars, collaboration records, connected-channel identifiers, protected OAuth tokens, metrics, device information and operational logs.
Google user data and YouTube API Services
Reach uses YouTube API Services only after a user chooses to connect a YouTube channel and grants the requested permissions. Reach accesses, collects and stores the channel identifier and title; the authorized OAuth scopes and protected access and refresh tokens; aggregate channel statistics such as subscriber, video and view counts; and aggregate YouTube Analytics audience breakdowns by age group, gender and country, including viewer percentages and view counts. For an upload, Reach also processes the video file, title, description, tags and private visibility setting supplied or approved by the user. Reach never receives or stores the user's Google password.
This Google user data is used only to identify and display the selected channel, maintain its authorized connection, upload a private video following an explicit or scheduled publication action configured by the user, show channel and audience insights, refresh authorization and diagnose connection or publication failures. It is not sold, used for advertising, surveillance or unrelated profiling.
Reach sends the video, its approved metadata and the necessary API requests to Google/YouTube to perform the requested action. Authorized members of the same workspace may see the connected channel, approved content and resulting metrics according to their permissions. Contracted hosting, database, backup, security and observability providers may process the minimum data necessary as service providers. Google user data is not disclosed to data brokers, advertisers or other unapproved third parties.
Google user data is protected in transit with HTTPS/TLS. OAuth access and refresh tokens are protected at application level before storage. Server-side authorization, owner and workspace isolation, role-based permissions, restricted operational access and security monitoring are used to prevent unauthorized access, use or disclosure.
OAuth tokens are retained only while the YouTube channel remains connected and are deleted from Reach when the connection is removed. YouTube API data kept for active insights is refreshed and authorization is revalidated regularly and at least every 30 days. After revocation, an account deletion or a verified deletion request, Google/YouTube Authorized Data is deleted or anonymized as soon as possible and no later than 7 calendar days. Any records that must be retained by law are kept separately and do not contain YouTube Authorized Data. Deleting data from Reach does not delete data held by YouTube; that data must be managed in YouTube. The links below provide the Reach deletion-request route, Google's revocation settings and the applicable Google/YouTube policies.
Purposes and legal bases
Data is used to create and secure accounts, operate content and campaigns, connect chosen services, prevent abuse, diagnose failures and send requested operational communications. Contract, pre-contractual steps, legitimate interests, legal duties or consent apply according to the purpose and applicable law.
Recipients, providers and transfers
Authorized workspace members and configured infrastructure, observability, AI, authentication, social-network, email, payment and notification providers may receive only the data needed for their role. International transfers use the safeguards required by applicable law.
Retention, security and your rights
Data is retained while the account or contractual relationship is active and for any additional period required for security, support, legal duties and the defence of rights. Reach uses access control, protected credentials, session controls and security monitoring. Applicable rights may include access, correction, deletion, restriction, portability, objection and withdrawal of consent.
Children, contact and complaints
Reach is intended for professional use by people with legal capacity to create an account or represent an organization. Privacy requests can be sent through the public contact form, without limiting the right to complain to the competent supervisory authority.
Visit analytics
On the public website, Google Analytics measures visits only after you give permission in cookie preferences. We send the page path without address parameters or fragments, and do not use this integration for advertising. Your choice and analytics cookies have a configured lifetime of 180 days. You can withdraw permission in cookie preferences.