● Legal

Privacy Policy

We hold two quite different kinds of personal data: information about the people who use reacho, and information about the creators in our index. This policy covers both, because they deserve different treatment.

Last updated 21 August 2026

The short version. We collect what we need to run your account and your campaigns, and nothing we can’t justify. We never sell personal data. We never see your card details — our payment gateway handles those. Creators can ask us to correct or remove their profile.

1. Scope

This policy applies to the reacho platform and website. reacho is the data controller for the information described here.

2. Data about you (brand users)

What	Where it comes from
Name, work email, company name, role	You, at sign-up
Password (stored only as a salted hash)	You
Campaign briefs, budgets, deliverables, shortlists	You, as you use the product
Subscription plan, invoices, payment status	Generated by us and our payment gateway
Session records, IP address, timestamps	Automatically, when you sign in

We do not collect card numbers, CVVs or bank credentials. Those go directly to our payment gateway.

3. Data about creators

Creators do not hold accounts with us. Their profiles are compiled from publicly available sources — public social profiles, public posts and publicly stated business contact details — together with our own research and estimates.

A creator profile may include:

name or handle, profile image, public biography;
niche, city, country, languages;
follower counts, engagement rate, average views and likes — all estimates;
aggregated, non-identifying audience breakdowns;
links to public content and indicative rate ranges.

We process this on the basis of legitimate interest: operating a business-to-business discovery service where creators are being evaluated in their professional capacity. We do not publish private contact details to customers, and we do not compile data about private individuals who are not active creators.

4. Why we use it

To run your account — authentication, plan entitlements, support.
To run your campaigns — approaching creators, negotiating, tracking deals.
To bill you — subscriptions, invoices, commission records.
To meet legal obligations — tax, accounting, and responding to lawful requests.
To improve the product — aggregated usage patterns, never sold on.

5. Payments

Subscription payments are processed by our payment gateway. When you check out you are handed to the gateway’s own hosted page; your card, UPI or netbanking details are entered there and never reach our servers. We receive only the outcome — paid, failed or refunded — plus an order reference we store against your invoice.

Collaboration payments to creators are arranged separately, per deal, and do not pass through the subscription gateway.

Creators and their managers — the parts of your brief needed to negotiate. Not your internal notes, and not your other requests.
Our payment gateway — to take subscription payments.
Infrastructure providers — hosting, database and email, under contract and only to run the service.
Authorities — where we are legally required to disclose.

We do not sell personal data, and we do not share it for third-party advertising.

7. Cookies

We use one essential cookie, reacho_session, to keep you signed in. It is HTTP-only, same-site, and expires after 30 days or when you sign out. We do not run third-party advertising or tracking cookies.

8. How long we keep it

Account and profile data — while your account is open.
Requests, deals and internal notes — while your account is open, and then for as long as needed to resolve disputes.
Invoices and payment records — eight years, as required by Indian tax and accounting rules.
Session records — until expiry or sign-out.

9. Security

Passwords are stored as salted scrypt hashes and are never recoverable in plain text. Sessions are opaque server-side tokens delivered in HTTP-only cookies. Access to production data is limited to staff who need it. No system is perfectly secure, but we will notify affected users without undue delay if a breach materially affects them.

10. Your rights

Subject to applicable law, including India’s Digital Personal Data Protection Act, you may ask us to access, correct, export or delete your personal data, and to withdraw consent where we rely on it. Write to privacy@reacho.pro and we will respond within 30 days.

Deleting your account does not delete records we must keep for tax or legal reasons.

11. If you are a creator

You can ask us to correct anything inaccurate on your profile, to add information, or to remove your profile from the index entirely. Email creators@reacho.pro from an address or handle we can verify against your public profile, and we will action it within 30 days. You do not need an account, and there is no cost.

12. Contact

Privacy questions and requests: privacy@reacho.pro. General enquiries: support@reacho.pro. See also our Terms of Service.

Please have this reviewed. This is a working draft written for this product. Have a qualified privacy practitioner review it against your actual entity, data flows and jurisdiction before you publish it.