Privacy Policy

Account data is information about our customers and their users — names, email addresses, billing details and how they use the service. Montegra is the controller of account data.

Workspace data is information our customers store in Reach — their contacts, companies, messages, deals and form submissions. Our customers decide what workspace data to collect and why; Montegra processes it on their behalf as a service provider (processor) and only to provide the service.

Information you give us: your name, email, password (stored only as a secure hash by our authentication provider), business details and mailing address, and messages you send to our team.

Billing information is collected and stored by Stripe. We receive the status of your subscription and invoices but never your full card number.

When you connect a mailbox, we receive OAuth tokens that let Reach send email and read replies in threads related to your outreach. We never receive your mailbox password. Tokens are encrypted at rest.

Technical information such as IP addresses (stored in hashed form for rate limiting and abuse prevention) and service logs needed to keep Reach secure and reliable.

To provide, secure and support Reach; to process payments; to send service and account emails; to enforce our Terms and Acceptable Use Policy, including investigating abuse reports; and to meet legal obligations.

We do not sell personal information, use workspace data to train models, or use workspace data to contact anyone on our own behalf.

We use carefully selected providers to run Reach, including Supabase (database and authentication), Vercel (hosting), Stripe (billing), and the email providers our customers choose to connect (Google, Microsoft, or a verified-domain sending provider). Some providers process data outside Canada, including in the United States; where they do, we rely on contractual safeguards.

Workspace data is kept while your subscription is active. Workspace owners can export contacts at any time and request deletion of the workspace from Settings. We delete or anonymize workspace data within 30 days of a confirmed deletion request, except records we must keep for legal, tax or fraud-prevention reasons, such as invoices and suppression entries needed to keep honouring opt-outs.

You may request access to, correction of, or deletion of your personal information, and withdraw consent where processing is based on consent. If you are a contact in one of our customers' workspaces, please contact that business first — they control that data — or unsubscribe using the link in any email you received. You can also contact us and we will help direct your request.

You may complain to the Office of the Privacy Commissioner of Canada or your local data protection authority.

Workspace data is isolated with database row-level security, transmitted over TLS, and access to production systems is restricted and logged. No system is perfectly secure; we will notify affected customers and regulators of a breach as required by law.

Privacy questions: privacy@montegrastudios.com, or Montegra Studios, 5307 Victoria Drive #1459, Vancouver, BC V5P 3V6, Canada.