Skip to content
Reachype
TR EN
Log in Start free

Privacy Policy

Last updated: 13 October 2026

This Privacy Policy is issued by Reachype ("we", "us") as data controller, to meet our disclosure obligations under Turkish Personal Data Protection Law no. 6698 ("KVKK") and — for users established in the European Union — the General Data Protection Regulation ("GDPR").

1. Data controller

Reachype
Turkish tax number (Vergi No): 9790649140
Email: support@reachype.com
Phone: +90 850 302 39 13

2. Data we collect

Account and organisation data

Name, email address, an irreversible hash of your password, time zone, language preference, organisation name and your role within the organisation.

Usage and session data

Sign-in time, IP address and browser information (user agent) — for account security and session management; you can view and end your active sessions from your account settings.

Product usage analytics

We keep anonymous usage data to measure which of your registration and setup steps were completed (e.g. viewing the sign-up form, creating an account, verifying email). Before you create an account this data is tied to a random identifier generated in your browser's local storage; it contains no identity, email address or other personal data. It is held only by us — it is not shared with any third-party analytics or advertising network.

Content you generate and upload

Your chat history, brand profile, prompts, the images, video and text you generate, and the reference files you upload. This content is passed to the relevant AI provider for generation (see section 4).

Payment data

Your payments are processed through iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), a payment institution licensed by the Central Bank of the Republic of Türkiye. Your card number never reaches or is stored in our systems; for renewals your card is stored by iyzico to PCI-DSS standards and we receive only a card reference (token). What we hold is limited to your plan, your credit balance, your invoicing details (name, email and, where given, billing address and tax ID) and the transaction identifier iyzico passes back to us. Because we are the seller, your invoice is issued by us.

Third-party accounts you connect

If you connect a YouTube, Meta, X or TikTok account, we store the access token within the scope that platform grants you, and the profile/statistics data covered by the scopes you select. You can remove that connection at any time — see Deleting your data for how, and for exactly what is removed when you do.

YouTube API Services

Our YouTube features are built on YouTube API Services. Whether a channel is added by its handle or by authorising Reachype through your Google account, what we read is that channel's videos, their public statistics and their comment threads — and, where you grant the analytics permissions, the channel's own YouTube Analytics figures. We use this solely to produce the dashboards and replies you see inside Reachype. We do not sell it and we do not disclose it to advertisers.

Two features do send part of it to the AI providers described in section 4, and we would rather name them than write a sentence the product contradicts. Comment text is scored for sentiment, so a channel with hundreds of comments can be read at a glance. And when you paste a video's URL into our thumbnail research tool, that video's title, channel name and the opening of its description are used to draft a prompt for a new image. Statistics, watch time and YouTube Analytics figures are never sent to a provider.

Reachype also asks for permission to upload videos to a channel you connect. This permission is optional: declining it leaves everything above working, and only publishing from Reachype becomes unavailable. Where you grant it, we upload a video only when you explicitly publish one, with the title, description and visibility you chose in Reachype. The permission does not let us edit or delete videos already on your channel, and we never upload anything you did not compose yourself.

Connecting a channel also means accepting the YouTube Terms of Service. Google's own handling of your data is described in the Google Privacy Policy.

How long we keep what we read follows YouTube's own rules, and they differ by kind of data. A video's statistics and its YouTube Analytics figures stay for as long as your channel is connected: at least every 30 days we re-confirm that the permission behind them is still in place, and where it is not, they are deleted. Everything else — a video's title and description, its thumbnail, and the text of comments — is either refreshed within 30 days or removed from our database — and a thumbnail you import from another channel as a style reference is a copy of YouTube's image rather than of your own work, so it is deleted 30 days after import while anything you generate from it stays. When you withdraw access, all of it goes — the statistics, the analytics figures and the identifiers that key them included.

You can withdraw Reachype's access to your Google account at any time from Google's security settings, or from the Integrations screen inside Reachype. Either route stops all further reading, and everything gathered under that permission is deleted within 7 days. Disconnecting a YouTube channel inside Reachype deletes what we synced from it straight away, which also means a later reconnection starts with an empty history. What is removed is listed in Deleting your data.

Deleting data held by Reachype does not delete anything on YouTube. Your videos, your comments and your channel stay exactly as they are and are managed from YouTube itself.

Meta advertising data

If you connect a Meta (Facebook/Instagram) advertising account, we read that account's reporting data through the Meta Marketing API: the ad accounts you grant us access to, together with their name, currency and time zone; your campaign, ad set, ad and creative structure; and the performance figures reported against them — impressions, reach, clicks, amount spent, conversions and conversion value, along with the breakdowns you select (such as date, age, gender, country, placement or device). Where your ad accounts sit under a Meta Business Manager, we also read the list of Business Managers you administer and the ad accounts they own, solely so that we can show you which accounts are available to connect.

This access is read-only. We cannot create, edit, pause or spend against your campaigns, and we do not request the permissions that would allow it. We use this data solely to produce the dashboards and reports you see inside Reachype. We do not sell it, we do not disclose it to advertisers, and we do not send it to the AI providers described in section 4.

You can withdraw Reachype's access at any time from your Facebook business integrations settings, or from the Integrations screen inside Reachype. Either route stops all further reading; what is deleted afterwards is set out in Deleting your data.

Google Ads data

If you connect a Google Ads account, we read that account's reporting data through the Google Ads API: the advertising accounts your sign-in can reach, together with their name, currency, time zone and status; your campaign, ad group, ad and keyword structure; and the figures reported against them — impressions, clicks, amount spent, budget, conversions, conversion value, video views and the auction impression-share figures — along with the breakdowns you select (such as date, age, gender or country). Where your accounts sit beneath a manager (MCC) account, we also read the list of accounts that manager holds, solely so that we can show you which ones are available to connect.

Google offers a single Google Ads permission that covers both reading an account and managing it; there is no reporting-only variant to request. Reachype only reads. We issue reporting queries and nothing else: we do not create, edit, pause or delete campaigns, budgets, keywords or ads, and we never spend against your account. We use this data solely to produce the dashboards and reports you see inside Reachype. We do not sell it, we do not disclose it to advertisers, and we do not send it to the AI providers described in section 4.

You can withdraw Reachype's access to your Google account at any time from Google's security settings, or from the Integrations screen inside Reachype. Either route stops all further reading; what is deleted afterwards is set out in Deleting your data.

Google Play data

If you connect a Google Play developer account, we read the reports Google Play publishes for it into its Cloud Storage report bucket — the monthly CSV files Play Console offers under Download reports. Today that is two report families: the installs report (daily user and device installs and uninstalls, per app, split by country, device and app version) and the store performance report (daily store listing visitors and acquisitions, per app and country); we open no other report family in the bucket. We do not read the Play Developer Reporting API, and we do not read any bucket other than the one named after the developer account id you enter when connecting.

You choose which apps. When you connect, we list the apps the account publishes and you tick the ones Reachype may read; the report files of an app you leave unticked are never opened and nothing about it is stored. Leaving every app ticked connects the whole account, including apps you publish later. You can change the selection at any time from the Integrations screen: an app you remove has everything we stored about it deleted at that moment, and an app you add is read from the beginning.

The permission Google offers for this — view your data in Google Cloud Storage — is broader than what we use: there is no permission limited to Play reports. Reachype reads exactly one bucket, pubsite_prod_<your developer id> (or pubsite_prod_rev_… on older accounts), and never lists or opens another. The Google account you sign in with must itself have report access on that developer account in Play Console; we cannot read what it cannot. We use this data solely to produce the dashboards you see inside Reachype. We do not sell it, we do not disclose it to advertisers, and we do not send it to the AI providers described in section 4.

You can withdraw Reachype's access at any time from Google's security settings, or from the Integrations screen inside Reachype. Either route stops all further reading; what is deleted afterwards is set out in Deleting your data.

ChatGPT Ads (OpenAI) data

If you connect a ChatGPT Ads account, we read that account's reporting data through the OpenAI Advertiser API: the ad account itself (its name, website, currency, time zone, status and review states); your campaign, ad group and ad structure together with their settings such as budget, bid and destination URL; and the performance figures reported against them — impressions, clicks, amount spent, conversions and conversion value — with the breakdowns you choose (country, device, the platform ChatGPT was used on, or product).

The connection is made with an API key, not a consent screen. OpenAI publishes no authorisation screen for this access: you create the key in your own Ads Manager account (Settings → API keys) and paste it into Reachype. One key belongs to one ad account; if you have several, you create a key for each and make a separate connection. We encrypt the key at rest and use it only for the reads described here.

This access is read-only. We cannot create, edit or pause your campaigns, and we cannot spend through your account. We have no access to who saw your ads and request none: OpenAI gives us no individual, user-level data at all — only aggregated figures.

This is not the same relationship as the AI provider in section 4. OpenAI appears in this policy in two separate roles, and they run in opposite directions: in section 4 your prompts go to an AI provider for content generation; here your advertising figures come from a source. We use what we read from your ChatGPT Ads account solely to produce the dashboards and reports you see inside Reachype. We do not sell it, we do not disclose it to advertisers, and we do not send it to the AI providers described in section 4 — OpenAI's own model API included.

You can end the connection at any time from the Integrations screen inside Reachype, which stops every further read including scheduled ones. To cut access from the platform's side as well, you delete the key in OpenAI's Ads Manager (Settings → API keys) — Reachype has no endpoint that can revoke it on your behalf, because OpenAI offers none. What is deleted after disconnecting is set out in Deleting your data.

Store platforms: Shopify, ikas, Shopier, Ticimax

If you connect an online store, we read its order book — the orders placed in the period you are looking at, with their date, totals, currency, status, refunds, and the products and quantities on each line — and its product catalogue (product ids and names). Each day's orders are rolled up into the figures you see in Reachype: orders, revenue, units, average order value, refunds and distinct buyers. We read no other resource from the store, and we write nothing to it.

What we do not read. We do not store buyer names, phone numbers or street addresses from any store. From Shopify we read no contact field at all: the only buyer field we request is the customer's platform identifier, which is used to count distinct buyers on a day and is not kept with the order afterwards; a request from Shopify to erase or hand over a shopper's data therefore finds nothing held about that shopper. From ikas and Shopier a buyer identifier (an account id or, on Shopier, the order's e-mail address) serves the same count. The shipping country is read where the store provides it, so a day's sales can be split by country; from Shopify it is not, because there the country sits on the address.

We use this data solely to produce the dashboards you see inside Reachype and to set your store's results beside your advertising figures. We do not sell it, we do not disclose it to advertisers, and we do not send it to the AI providers described in section 4. Store data is encrypted at rest and in transit, and is read through each platform's own authorisation: Shopify's, by installing the Reachype app on your store with the three read-only permissions it asks for (orders, products, customers).

You can end the connection at any time from the Integrations screen inside Reachype, which for Shopify also uninstalls the app from your store, or by uninstalling it from your Shopify admin. Either route stops all further reading. Everything we synced from the store is deleted as set out in Deleting your data; for a Shopify store the deletion also runs on the store-data erasure request Shopify sends 48 hours after an uninstall.

AI assistants (MCP)

If you choose to connect Reachype to an AI assistant such as ChatGPT, Claude, Claude Code or Cursor (an optional feature that workspace management can switch off), the assistant acts on your behalf, only in the workspace you pick when connecting and only within the permissions you grant (read, edit, generate). This processing is necessary to provide the Reachype service you asked for.

  • What the assistant receives. The assistant receives what the tool it calls returns — for example the brand profile, content calendar, ideas, campaigns, products, a research report, performance figures or the credit balance. That data is processed by the assistant's provider (OpenAI, Anthropic or your editor's maker) under its own terms and privacy policy; Reachype is not responsible for that processing.
  • What Reachype receives. Reachype does not see or store your conversation. It receives only the requests the assistant sends to its tools (for example a project id, a date range, or the text to be edited).
  • Connection record. We record which assistant is connected to which workspace with which permissions, when it was created and when it was last used. Access tokens are short-lived; refresh tokens are stored only as hashes.
  • Call log. For each tool call we log the tool name, workspace, user, connection, outcome and duration — and a hash of the arguments, never the argument values themselves.
  • Edits and generations. Edits you make and generations you start through an assistant are recorded in the change history and audit trail exactly as when you do them in Reachype, together with which connection made them. That is what lets you undo an edit.
  • What is never shared. The access tokens for the social, ad and store accounts you connected to Reachype are never given to the assistant.

Demo call requests

When you send the demo form on reachype.com, we keep what you typed: your website or Instagram address, the kind of business you run, your team size, your monthly advertising and marketing budget band, your name, your email address, your company or brand name and — if you gave them — your phone number and message. Alongside these we record the page you sent the form from, the source that first brought you to the site (for example the UTM tags of an ad link), your IP address and your browser details (user agent).

Only the Reachype team sees the request, and we use it only to assess it and to contact you about the demo; the IP address and browser details are there to tell abuse of the form apart, and those two are erased from the request automatically after 90 days. We do not add you to a newsletter or any marketing list.

Callback requests and the newsletter

When you send the "Leave your details and we'll get back to you" form on the home page, we keep your first name, surname, email address and phone number, together with the page you sent it from, the source that first brought you to the site, your IP address and your browser details. Only the Reachype team sees the request, and we use it to call you; the IP address and browser details are erased automatically after 90 days.

The form's "I'd like to receive newsletters and marketing emails from Reachype" box is optional and comes unticked. Only if you tick it do we add your email address and name to our newsletter list, recording when you agreed and the wording of the box. You can withdraw at any time through the unsubscribe link in every email or by writing to us; your callback request is not affected.

Performance report recipients

A workspace may list up to ten e-mail addresses to receive a weekly or monthly performance report for one of its brands. Those addresses are added by the workspace's authorised users; informing the recipients, and having their consent or another legal basis for sending them reports, is the responsibility of the workspace that adds them. We keep the addresses only to send the report. Each e-mail carries a link to the report (valid for 30 days); recipients get no access to the app.

Every report e-mail carries a "Stop sending me this report" link. An address that leaves through it is permanently excluded from that brand's reports and cannot be re-added by the workspace. We record which report was sent to which addresses in the workspace's report history.

3. Purposes and legal bases

We process your personal data for the following purposes, on the bases stated:

  • To create your account and provide the Service — formation and performance of a contract (KVKK art. 5/2-c),
  • To carry out payment transactions — performance of a contract,
  • To read and report the advertising performance data of the ad accounts you connect — performance of a contract (KVKK art. 5/2-c),
  • To keep your account secure (sessions, detecting unauthorised access) — legitimate interest (KVKK art. 5/2-f),
  • To assess your demo call request and contact you about it — a step towards a contract, taken at your request (KVKK art. 5/2-c); to prevent abuse of the demo form — legitimate interest (KVKK art. 5/2-f),
  • To call you back when you ask us to — a step towards a contract, taken at your request (KVKK art. 5/2-c); to send newsletters and marketing emails — only on the explicit consent you give with the separate box on the form (KVKK art. 5/1; Law No. 6563),
  • To meet our legal obligations (invoicing, accounting records) — legal obligation (KVKK art. 5/2-ç),
  • Anonymised/aggregated usage analysis to improve the product and service quality — legitimate interest.

4. Parties we share data with

We share your data, only to the extent needed to provide the Service, with:

  • AI providers — your generation request (the prompt and its context) is passed to the relevant provider for production. These providers may be established abroad; where that is the case, the transfer is made within the framework of KVKK art. 9 and the relevant Board decisions.
  • iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.; a payment institution licensed by the Central Bank of Türkiye) — for card collection, card storage and refunds. Established in Türkiye.
  • Cloudflare — for content delivery, bot/abuse protection (Turnstile), and cookieless, aggregated visit statistics on reachype.com (Web Analytics). Web Analytics sets no cookies and does not track you across sites.
  • Amazon Web Services (Amazon SES) — our email infrastructure provider: account verification, password resets and (if you enable it) delivery of your email campaigns. The DNS records the app shows you when you verify your own sending domain belong to this provider.
  • Social platforms you connect — only when you connect an account, and only within the scope you authorise.
  • The AI assistant provider you choose to connect (OpenAI, Anthropic or the editor's maker) — only when you connect an assistant, and only the data returned by the tools the assistant calls. These providers may be established abroad; the transfer follows your instruction to set up the connection, within the framework of KVKK art. 9 and the relevant Board decisions and, where the GDPR applies, under the transfer safeguards the provider offers (such as standard contractual clauses).

We never sell your data to third parties for marketing purposes.

5. Retention and deletion

We keep your account data for as long as your account is active, and after it is closed for as long as our legal obligations require (for example, the period prescribed by applicable law for billing records). At the end of those periods the data is deleted or anonymised.

You can delete your account yourself, from Settings → Data → Delete account. You are shown what the deletion takes with it before it runs, and the step is confirmed with your password (or, on an account without one, by typing a confirmation). It cannot be undone. Deletion is blocked in two cases, and the screen says which: you are the sole owner of a workspace that still has teammates in it, or a paid subscription is still running — hand over ownership or cancel the subscription first.

If you cannot delete it in the app, or you would rather ask us in writing, write to support@reachype.com from your registered address; we complete verified requests within 30 days, which is the response period set by KVKK art. 13/2 and GDPR art. 12(3).

Data imported from a connected social account is deleted separately from your account, and can be deleted without closing it. Deleting your data sets out both routes step by step, including what a deletion request from Meta covers.

Performance report PDFs are deleted 180 days after they are produced (team previews after 14 days). Report recipients' addresses are kept until the workspace removes them or is closed; an address that opted out is kept on that brand's record so it cannot be re-added. You can ask for the record to be erased entirely by writing to support@reachype.com.

We keep a demo call request for as long as it takes to assess it and to be in touch with you about it; its IP address and browser details are erased automatically after 90 days. To have the whole record deleted, write to support@reachype.com from the address you sent it with; we delete the request in full.

An AI assistant connection record is kept until you remove the connection or the workspace is closed or deleted; the record of a removed connection is deleted after 12 months. Tool-call logs are kept for 90 days. When you remove a connection under Settings → MCP → Connected AI assistants, access ends immediately; workspace managers can remove any connection, or switch the feature off, under Settings → MCP. Data that remains with the assistant's provider is governed by that provider's policy, and deleting it means asking that provider.

6. Security

Your password is stored as an irreversible hash (bcrypt); traffic is encrypted with TLS; your session access tokens are short-lived and refresh tokens are protected by rotation (single-use, with reuse detection).

7. Your rights

Under KVKK art. 11 you may apply to us to:

  • learn whether your personal data is processed,
  • request information if it has been processed,
  • learn the purpose of processing and whether it is used in line with that purpose,
  • know the third parties to whom it is transferred, in Türkiye or abroad,
  • request correction if it is incomplete or inaccurate,
  • request deletion or destruction within the conditions set by law,
  • request that corrections/deletions be notified to the third parties it was transferred to,
  • object to a result reached against you through analysis carried out solely by automated systems,
  • claim compensation if you suffer loss because of unlawful processing.

If you are established in the EU, you may additionally exercise your GDPR rights to data portability and to object to processing. Send applications to support@reachype.com. For the deletion right specifically, Deleting your data gives the procedure, what each route deletes and how long it takes.

8. Cookies

reachype.com uses your browser's local storage only for essential functionality (such as your theme preference); we use no third-party advertising or tracking cookies. The Cloudflare Web Analytics we use for visit statistics is also cookieless (see section 4). The application (app.reachype.com) manages your session through browser memory and local storage rather than cookies.

If you reached the site from an ad or another website, we keep that source — the UTM tags and the referring site's name — in a cookie of our own domain, rc_attr, for 30 days, and only on your first visit. It assigns you no identifier, does not follow you across sites and goes to no third party; it is read only when you submit the sign-up form or the demo form.

9. Changes

We may update this policy; for material changes we will send a notification to your registered email address.

10. Contact

For privacy questions, reach us at support@reachype.com.