Privacy Policy

The coldreach.com service is operated by the administrator of the coldreach.com service. For every question about this policy or your personal data, write to support@coldreach.com. Signed-in users also get help inside the app.

We act in two different roles. For visitors and account holders we decide why and how their data is used, so we are the controller. For prospect data that customers upload, import or send through the service, the customer decides why and how it is used, so the customer is the controller and we process that data on the customer's behalf as a processor. For the business contact records in our own prospect database we are the controller.

• Account data, meaning your email address, a hash of your password (we never store the password itself), the confirmation code status and the plan you selected.
• Demo inputs, meaning the website URL, target job title, company size, industry and tone you enter in the homepage demo, and the result we generate for you.
• Technical data, meaning your IP address, browser user agent, the page that referred you and campaign parameters in the link you followed.
• Usage logs, meaning actions in your account such as created sequences, generated emails, verifications, exports, sign-ins and errors.
• Billing data, meaning plan, billing period, invoices and payment status. Card details are entered directly with our payment processor and we do not store full card numbers.
• Support messages, meaning what you write to support@coldreach.com and our replies.

• To create and run your account and deliver the plan you pay for, based on the performance of a contract (GDPR Article 6(1)(b)).
• To send account emails such as confirmation codes, security notices and billing messages, based on the performance of a contract.
• To prevent abuse, enforce demo and plan limits, and keep the service secure, using your IP address and usage logs, based on our legitimate interest in protecting the service and its users (GDPR Article 6(1)(f)).
• To keep invoices and accounting records, based on our legal obligations (GDPR Article 6(1)(c)).
• To understand how the site is used and improve it, using analytics without cookies, based on our legitimate interest.
• To answer your messages and handle requests about your rights, based on our legitimate interest and our legal obligations.

When a customer uploads a list, imports contacts from a CRM, connects a mailbox or sends emails through ColdReach, we process that data only to provide the service to that customer and only on the customer's documented instructions. We do not use customer prospect data to build our own database and we do not share it with other customers. The customer is responsible for having a lawful basis to contact the people on their lists and for answering requests from those people. If we receive a request about data a customer controls, we forward it to that customer and help them answer it.

Our prospect database contains business contact data only, such as a person's name, job title, company, work email address, company website and company details. We collect it from lawful sources, namely public company websites, public business registries and licensed business data partners. We do not collect private addresses, consumer data, sensitive data or data about people under 18. Every record shows its source and last-checked date in the app. We process this data based on our legitimate interest, and the legitimate interest of our customers, in business to business communication about products and services relevant to a person's professional role. We have weighed this interest against the rights of the people concerned and we limit the data to what a person's professional role makes public.

If you are a business contact and want to know whether we hold data about you, get a copy, correct it, have it deleted or object to its use, write to support@coldreach.com from the work email address concerned or tell us the address. We answer within one month. When you ask for deletion or object, we remove your record from the prospect database and add your email address to our global suppression list, which keeps you from being added again by our data sources and blocks sending to you from every ColdReach account. We keep only the minimum needed for the suppression list to work.

We share personal data only with service providers who help us run ColdReach, under contracts that require them to protect it and use it only on our instructions. The categories are a hosting provider, a payment processor, an email delivery provider for our own account emails such as confirmation codes and billing notices, AI model providers that generate personalized drafts and summaries, licensed business data partners and email verification services that check whether an address exists. Customer campaign emails are never sent through our own mail servers, they are sent from the mailboxes the customer connects. We may also disclose data when the law requires it or to protect our rights and users against fraud or abuse.

Some of our service providers process data outside the European Economic Area and the United Kingdom. When data leaves these areas, we rely on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission and the UK addendum, together with additional technical and organisational measures where needed. You can ask for more information about these safeguards at support@coldreach.com.

• Account data, for as long as your account is open and up to 30 days after you close it.
• Demo inputs and demo results, up to 30 days, longer only when linked to an account you keep.
• IP addresses and technical logs used for abuse prevention and limits, up to 90 days.
• Usage logs tied to your plan limits, for the billing period and up to 12 months after it.
• Billing records and invoices, for as long as tax and accounting law requires.
• Customer prospect data, for as long as the customer keeps it in the account, and deleted within 30 days after the account is closed.
• Business contact records in our database, while they remain accurate and are rechecked against their source. Suppression list entries are kept for as long as needed to honor the objection.

Under the GDPR and UK GDPR you have the right to access your data, correct it, delete it, restrict its use, receive it in a portable format and object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time. To use any of these rights, write to support@coldreach.com. You also have the right to complain to your local data protection authority.

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect, use and disclose, to request deletion, to correct inaccurate information and not to be treated differently for using these rights. We do not sell personal data of visitors or account holders and we do not share it for cross-context behavioral advertising. Our prospect database makes business contact information available to subscribing customers as part of the service. Because customers pay for the service, California law may treat this as a sale. You can opt out of it, and ask us to delete your record, by writing to support@coldreach.com. We will add you to our global suppression list. You can also use an authorized agent, and we may ask for reasonable proof that you or your agent are entitled to make the request.

We protect personal data with encryption in transit, encrypted storage of credentials and mailbox tokens, password hashing, role based access, access logs and regular backups. Access to personal data is limited to the people and services that need it to run ColdReach. No system is perfectly secure, so if we learn of a breach that affects your data, we will notify you and the authorities as the law requires. Read more on our Security page.

The site sets only strictly necessary cookies for the session, protection against cross-site request forgery and your preferences. Our analytics work without cookies and we use no advertising pixels. Details are in the Cookie Policy.

ColdReach is a business to business service. Accounts are for people acting on behalf of a business. The service is not for people under 18 and we do not knowingly collect their data. If you believe someone under 18 gave us data, write to support@coldreach.com and we will delete it.

We may update this policy when the service or the law changes. We post the new version on this page with a new date, and when the change is significant we also tell account holders by email before it takes effect. Related documents are the Terms of Service, the Acceptable Use Policy, the Refund Policy and our cold email software pricing.