Privacy Policy

This Privacy Policy applies to REACH Projects, Inc. (“REACH,” “we,” “our,” or “us”) and governs the collection, use, and disclosure of information obtained through REACH Forms, including the workspace application used by our personnel to build forms and the publicly accessible forms completed by respondents.

REACH Forms is an internal business tool. Workspace accounts are limited to individuals with a REACH email address. Respondents do not create accounts and interact with the Service only by completing a form that has been shared with them.

Talent and creators who have entered into a signed REACH Talent Terms & Conditions agreement are additionally subject to the terms of that agreement. To the extent any provision of this Policy conflicts with the REACH Talent Terms & Conditions, the Talent Terms & Conditions shall control with respect to the talent relationship.

BY ACCESSING OR USING THE SERVICE, OR BY SUBMITTING A RESPONSE TO A FORM OPERATED BY REACH, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH THE TERMS OF THIS POLICY, PLEASE DO NOT USE THE SERVICE OR SUBMIT A RESPONSE.

REACH operates the Service and determines how information submitted through our forms is used. We are therefore the controller of that information, and we are responsible for the collection, handling, and retention practices described in this Policy.

REACH Forms is not offered to outside organizations as a hosted product, and we do not process form responses on behalf of third-party businesses. Where a form is operated in connection with a brand campaign, information collected through that form is used only for the purposes described in Section 7 and disclosed only as described in Section 8.

Workspace user information

For REACH personnel who hold an account, we collect the name, work email address, job title, profile photograph, and localization preferences associated with that account, together with authentication records such as password hashes, two-factor authentication secrets, recovery codes, and active session details including approximate device and browser description.

Respondent information

For individuals completing a form, we collect the answers submitted, together with any contact details requested by that form, such as name, email address, and telephone number. Where a form uses email verification, we retain the verified address and a record that verification occurred.

Technical information

We automatically collect limited technical information when a form is opened, including browser and device type, operating system, referring URL, and campaign parameters attached to the link. Where IP anonymization is enabled for a workspace, IP addresses are truncated before storage.

REACH Forms records more than the final submission. To understand where a form is difficult to complete, the Service records events describing progress through a form, including which questions were viewed, answered, skipped, or revisited, how long was spent on each question, validation errors encountered, and whether a form was abandoned before submission.

Where partial response capture is enabled, answers provided before a respondent leaves are retained even if the form is never submitted. A respondent who has supplied an email address may receive a single message containing a secure link allowing them to resume where they stopped. These links expire and may be used only for the response they were issued against.

Respondents may request a copy of, correction of, or deletion of the information they submitted by contacting us at the address in Section 18.

Certain forms allow a respondent to attach a file or to record a short video or audio answer directly in the browser. Recordings are captured on the respondent’s own device and are transmitted to us only when the respondent chooses to submit them. Nothing is recorded before the respondent starts a recording, and a recording may be discarded and retaken before submission.

Uploaded files and recordings are stored on infrastructure controlled by REACH and are accessible only to authorized workspace members. They are retained according to the retention window configured for the workspace, as described in Section 11, and are deleted when that window elapses or when a deletion request is fulfilled.

Any rights REACH holds with respect to creative materials submitted through a form are determined by the agreement between REACH and the submitting party at the time of submission. For talent represented by REACH, those rights are governed by the REACH Talent Terms & Conditions. This Policy does not independently grant, expand, or modify any such rights.

The Service uses first-party analytics only. We do not embed third-party advertising trackers, and we do not use form data to build advertising profiles or to target advertising to respondents.

Analytics collection is configurable for each workspace and may include aggregate traffic measurement, campaign attribution from parameters in the form link, a first-party identifier used to recognize a returning visitor, and capture of partial responses. Where required, a consent notice is displayed before optional analytics are collected.

REACH uses the information collected through the Service for the following purposes:

• To operate the Service, including building, publishing, and hosting forms and recording responses
• To review, evaluate, and respond to submissions such as applications, intake requests, and registrations
• To communicate with respondents about a submission, including confirmations, verification codes, and resume links
• To measure how a form performs and to improve its clarity and completion rate
• To sync responses to internal systems, including Google Sheets, where a workspace has connected them
• To secure the Service, including authentication, access control, and detection of abuse or automated submissions
• To comply with applicable legal, tax, and regulatory obligations
• For any other purpose to which you provide your express consent

We will not use information collected through the Service in a manner inconsistent with the purposes described in this Policy without prior notice or your consent.

REACH does not sell personal information collected through the Service, and we do not share it for cross-context behavioral advertising. We may disclose information only to the extent necessary to fulfill the purposes described in this Policy:

• Personnel within REACH Projects and its affiliates who require access to administer a form or evaluate a submission
• Brand and advertising clients, where a form was operated in connection with a campaign, limited to the information necessary to fulfill campaign obligations
• Service providers listed in Section 9, subject to binding confidentiality and data processing obligations
• Professional advisors such as attorneys, accountants, and auditors, subject to applicable duties of confidentiality
• Law enforcement or regulatory authorities where required by applicable law, court order, or valid legal process
• Successor entities in connection with a merger, acquisition, reorganization, or sale of assets, subject to comparable privacy protections

The Service is operated on infrastructure controlled by REACH. We rely on a limited number of external providers, and information is disclosed to them only as necessary to deliver the Service:

• Resend, for delivery of transactional email including verification codes, confirmations, and resume links
• Google, where a workspace has connected Google Sheets for response syncing or enabled sign-in with Google, limited to the data that workspace has chosen to sync
• Oracle Cloud Infrastructure, for hosting of the application, database, and stored files
• PostHog, for product analytics. On public forms this receives only which question was reached and when, never your answers, name, email, or phone number, and only where the workspace has left analytics enabled. Where a workspace shows a cookie banner, nothing is sent until you accept it, and where a workspace has turned off visitor recognition, no identifier is stored and each visit is treated as new

Disconnecting an integration stops further disclosure to that provider. We will update this section when a subprocessor is added or removed.

REACH implements reasonable and appropriate technical and organizational measures designed to protect information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption in transit, hashing of passwords and access credentials, encryption of stored third-party access tokens, role-based access control within each workspace, optional enforcement of two-factor authentication, optional network restrictions, and an append-only audit log of administrative actions.

Notwithstanding the foregoing, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect information using commercially acceptable means, we cannot guarantee its absolute security. In the event of a data breach that is reasonably likely to result in risk to your rights or interests, we will notify affected individuals in accordance with applicable law.

We retain information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, contractual, or reporting obligations. Each workspace may configure retention windows for completed responses, partial responses, uploaded files, and audit records. When a window elapses, the corresponding data is deleted automatically.

Individuals may submit a written request to have their information deleted, subject to our right to retain information as required by law or legitimate business necessity. Requests may be submitted to the contact address in Section 18. We will respond to verified deletion requests within forty-five (45) days, as required by California law.

REACH Projects, Inc. is a California-based company and is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”). California residents have the following rights with respect to their personal information:

• Right to Know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to Delete. You may request that we delete personal information we have collected from you, subject to certain exceptions permitted by law.
• Right to Correct. You may request that we correct inaccurate personal information that we maintain about you.
• Right to Opt Out. You may opt out of the sale or sharing of your personal information. REACH does not sell or share personal information as those terms are defined under the CCPA.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights.
• Right to Limit Use of Sensitive Personal Information. To the extent we collect sensitive personal information as defined under the CPRA, you may limit our use and disclosure of such information to purposes authorized by law.

To exercise any of the above rights, please submit a verifiable consumer request using the contact information in Section 18. We will respond to verified requests within forty-five (45) days, with the option to extend by an additional forty-five (45) days where reasonably necessary with prior notice.

California Civil Code Section 1798.83, known as the “Shine the Light” law, permits California residents to request and obtain once per year, free of charge, information about any personal information disclosed to third parties for direct marketing purposes during the preceding calendar year. REACH does not disclose information collected through the Service to third parties for their direct marketing purposes.

To make such a request, please contact us using the information in Section 18 and indicate “California Shine the Light Request” in the subject line or body of your message.

A form may contain links to third-party websites or services that are not operated or controlled by REACH, including payment pages and scheduling tools. This Policy does not apply to those third-party sites. We have no responsibility or liability for the content or privacy practices of any third-party service, and we encourage you to review the applicable privacy policies of any third-party platform you access.

The Service is not directed to individuals under the age of 13, and we do not knowingly collect personal information from children under 13 years of age. Our campus-based programs are limited to enrolled college students who are at least 18 years of age. If we become aware that we have inadvertently collected personal information from a child under the age of 13 without verifiable parental consent, we will take prompt steps to delete such information from our records. If you believe we may have collected information from a child under 13, please contact us immediately at the address in Section 18.

REACH Projects, Inc. is incorporated under the laws of the State of Delaware and maintains its principal place of business in the State of California. This Privacy Policy and any disputes arising hereunder shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of law principles, and subject to applicable federal law including the California Consumer Privacy Act.

REACH reserves the right to update or modify this Privacy Policy at any time. When we make material changes, we will update the “Last Updated” date at the top of this page. Your continued use of the Service following the posting of any changes constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your information, including CCPA requests, deletion requests, or Shine the Light inquiries, please contact us at: