myReach

GDPR overview

myReach claims GDPR compliance explicitly rather than leaving it to inference: the homepage reads "ISO 27001 certified and GDPR compliant" and the security page repeats it. The privacy policy, last updated on 8 January 2026, names MYREACH, S.A. as controller and its Spanish branch in Barcelona, identification number W0395102G, as its EU representative. A Data Protection Officer is reachable at security@rea.ch, and the Swiss postal address is published for exercising rights. Access, rectification, erasure, portability, restriction and objection are listed, along with the right to complain to a supervisory authority. A Data Processing Agreement is published as a PDF alongside master service and service level agreements, and a named subprocessor list is public. International transfers rely on adequacy decisions or standard contractual clauses.

Who owns the data?

MYREACH, S.A., a Swiss company registered in the Canton of Vaud, acts as data controller, with its Spanish branch in Barcelona as its EU representative. Customers keep their uploaded content: the privacy policy states that myReach will not, under any circumstances, process the information contained in documents uploaded to the platform, and uses only the characteristics of that documentation. Personal data is shared with named providers under signed processing agreements, with public administrations and auditors where the law requires it, and with acquirers in a corporate transaction. After termination, users have thirty days to request the return of everything they stored.

Reuse rights

Users keep control of the content they upload and can export or back it up on either plan, since data export and backup is listed for both Pro and Enterprise. On termination, the terms give thirty days to request the return of everything stored before deletion, and warn that final deletion is irreversible, so a copy should be taken first. Answers are generated by Retrieval-Augmented Generation over the customer's own documents and returned with citations, so reusing them is a matter of the customer's own rights over the source material; no separate licence restricting that reuse is published. The website itself is treated differently: the website terms reserve all intellectual property and prohibit extracting information from the site without written permission.

Data retention & training

Hosting summary

myReach publishes a named subprocessor list with a data location column, which makes hosting unusually easy to trace. Google Cloud Platform provides the infrastructure, hosting and storage, with the data location declared as the European Union. Customer.io, Typeform, Mixpanel, Stripe and Datadog are declared in the European Union as well. Three subprocessors are declared in the United States: OpenAI for natural language processing, CoreWeave for compute and inference, and Sentry for error monitoring. The privacy policy states that transfers outside the European Economic Area rely on adequacy decisions or, failing that, on contractual clauses and additional safeguards. The controller itself is Swiss, a jurisdiction covered by an EU adequacy decision, with an EU representative in Barcelona. Enterprise customers can step outside this arrangement entirely: the plan includes a dedicated private server hosted on the customer's own cloud infrastructure, under the customer's own identity, multi-factor authentication and IP allow-lists. No named data centre region or country is published beyond those labels.