Reachy

GDPR overview

GDPR compliance is claimed explicitly and repeatedly, and the privacy policy is concrete rather than decorative. BlackZebra, a French company registered under SIREN 978381564, names itself as data controller. Three legal bases are cited: contract performance under Article 6(1)(b), legitimate interests under Article 6(1)(f), and consent under Article 6(1)(a) for optional usage data and marketing cookies. The full set of rights is listed, covering access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a supervisory authority, with a one-month response commitment. Six processors are named with their locations, and transfers outside the EEA are covered by standard contractual clauses. The strongest claim is architectural: prospect data never leaves the user's machine. No data processing agreement and no security certification are published, however.

Who owns the data?

The terms are explicit: the publisher claims no intellectual property rights over the material you provide, so your prospect lists, messages and campaign results remain yours. BlackZebra owns only its own side of the product, namely the code, databases, design and layout, which you may not copy or reuse without written consent. The privacy policy reinforces that split at the architectural level: your LinkedIn session, prospect lists, messages and campaign data live on your computer, the vendor hosts no copy of your network and states it cannot read your conversations. Ownership therefore stays with the customer, and the vendor's access is limited by design rather than merely by promise.

Reuse rights

Because the material you feed into the tool remains yours, you may reuse your prospect lists, messages and campaign results without asking the publisher for permission: it holds no rights over them. Getting that data out is a supported action rather than a workaround, with CSV and Excel import and export, enriched contact export, and synchronisation to HubSpot, Salesforce, Pipedrive, Make, Zapier and n8n. The restrictions sit on the other side of the line: you may not copy or reuse the application's code, databases, design or layout without written consent, reverse engineer it, run data mining against the service or resell it. One practical limit is worth noting, as it is a trial restriction rather than a rights question: contact export stays locked during the free trial and unlocks with a paid plan.

Data retention & training

Hosting summary

Reachy's answer to the hosting question is that, for the data that matters most, there is barely any hosting at all: prospect data, message content and the LinkedIn session live on the user's own computer. The publisher states it keeps no copy of the user's network and cannot read conversations, and API keys for OpenAI, Anthropic or Google are stored locally and used directly against the provider. Only a limited set of account and usage data reaches third parties, and the privacy policy names them with their locations: Lemon Squeezy in Utah for payments, Mixpanel in London for anonymised in-app analytics, Sentry in San Francisco for error monitoring, PostHog in the United States for website analytics, Ahrefs for cookieless traffic measurement and Meta for advertising measurement loaded only after consent. Transfers outside the EEA are covered by standard contractual clauses. The publisher is French, the terms note that hosting and infrastructure rely on third-party vendors without naming a jurisdiction for the application itself, and the website is served behind Cloudflare. No regional hosting choice or data residency option is offered, since the local architecture makes one unnecessary for prospect data.