Privacy policy.

Who this covers

This policy covers two groups of people: people who use SnailReach to send letters (our customers and their team members), and people who receive letters sent with it (recipients). It also covers visitors to snailreach.com. SnailReach is run by Bridgewood Creative LLC.

Who is responsible for your data

Recipients and CRM data. The sending company decides who to write to and what to say. For recipients' details, letter activity and any CRM records a customer brings, that company is the controller (or "business" under California law) and SnailReach is its processor (or "service provider"). We handle those details on the company's behalf and under its instructions.

Accounts, billing and our website. For our customers' account and billing details, and for visitors to our website, SnailReach is the controller.

Customers who need a Data Processing Addendum can ask for one at support@snailreach.com.

What we collect

From customers and their teams

• Account details: name, work email, role and the Google or Microsoft account you sign in with.
• Workspace details: company name, postal address, logo, brand color, delivery hours and booking link.
• Billing details: plan, number of reps and payment history. Card details are collected and stored by our payment processor, Stripe. We never see or store your full card number.
• Content you add: letters, templates, follow-ups, notes and video links.
• Mailbox connection details: the mailbox address, and the access tokens, app password or SMTP details that let us send from it. These are encrypted when stored.
• Integration data, if you connect a CRM (HubSpot, Salesforce, Pipedrive or Attio): the people, companies and deals we sync in to suggest who to write to. If you connect Calendly or Cal.com: meeting times and whether a recipient booked.

About recipients

• Contact details the sending company adds, imports or syncs from its CRM: name, title, company, work email, time zone and, if the company uses them, the lists the contact is on.
• Letter activity: when a heads-up is sent, when a letter is delivered, when the seal is tapped, how many seconds of an included video were watched, and whether the recipient booked a meeting, forwarded the letter or opted out. The sending company can also mark that the recipient replied.
• If a recipient forwards a letter, the colleague's name, work email and the note they wrote. The colleague becomes a contact of the sending company.
• Opt-out records: the email address and when and how the person asked to stop.

From visitors to our website

• What you type into our forms, such as a demo request (name, work email, team size and CRM) or an opt-out request.

From everyone

• Server and security logs, such as IP address, browser, pages requested and errors, kept to run and protect the service.

Your mailbox

Each rep connects one mailbox. Outlook and Google Workspace connect by signing in, with permission to send only. Gmail connects with an app password, a code the rep creates in their Google account for SnailReach alone. Any other mailbox connects with its SMTP server details and password. We use the connection for one thing: to send the emails the rep schedules in SnailReach (heads-ups, letter emails, follow-ups and nudges). Follow-ups and nudges only go out when the rep sends them.

SnailReach can send from your mailbox and cannot read it. We do not open, search or store the messages you receive, including replies to your letters. Replies land in your inbox as usual, and you mark a letter as replied in SnailReach so its follow-up leaves your list.

A rep can disconnect their mailbox from settings at any time, and we delete its stored access when they do. You can also remove our access from your Google or Microsoft account settings: delete the SnailReach app password, or remove SnailReach from your connected apps.

Google user data

SnailReach's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, data we receive from your Google account:

• Is used only to provide or improve user-facing features that are prominent in SnailReach: signing you in and sending the emails you schedule.
• Is never sold, and never used or shared for advertising.
• Is never used to train AI or machine learning models.
• Is not read by people at SnailReach, unless you ask us to and say so, it is needed for security or to investigate abuse, or the law requires it.

The same rules apply to data we receive from Microsoft when you connect an Outlook mailbox.

How opens are measured, and cookies

An open is counted when a recipient taps the seal on their letter page. We do not put tracking pixels or hidden images in emails, and we do not track recipients across other websites.

Our website and app use only the cookies needed to sign you in and keep them working. We do not use analytics or advertising cookies. If a letter includes a video from Loom, Vidyard or YouTube, that video loads from its host, which may set its own cookies under its own policy.

How we use it

We use the information above to:

• Schedule and deliver letters, heads-ups and follow-ups, and stop them when they should stop.
• Show the sending company what happened with each letter, send its team alerts, and write letter events back to its CRM.
• Honor opt-outs, for the sending company and across SnailReach.
• Run billing, send account emails and invites, and answer support requests.
• Keep the service secure, prevent abuse and meet legal obligations.
• Understand how the product is used, in aggregate, so we can improve it.

SnailReach has no AI features. We do not sell or share personal information, as those words are used in California law. We do not use letters, contact lists, CRM data or mailbox data to train AI models. We do not use recipients' details to market SnailReach to them.

Our legal bases

Where laws like the GDPR apply, we rely on:

• Contract: to provide SnailReach to our customers and their teams.
• Legitimate interests: to keep the service secure, prevent abuse, honor opt-outs, improve the product and answer people who write to us. We weigh these against your rights.
• Legal obligation: to keep tax and accounting records and respond to lawful requests.
• Consent: where the law requires it. You can withdraw consent at any time.

For recipients' details, the sending company is responsible for having its own legal basis to write to you.

Who we share it with

We share information only with the service providers that help us run SnailReach, each bound by a contract to protect it and use it only for us:

• Supabase: database, sign-in and file storage, in the United States.
• Vercel: hosting for our website and app.
• Stripe: payments and billing.
• Resend: delivery of SnailReach's own emails, such as alerts, invites and account emails.
• Google: Google sign-in, sending from Google mailboxes, and our support email.
• Microsoft: Microsoft sign-in and sending from Outlook mailboxes.
• Nango: stores and manages the connections to the CRMs and Calendly accounts customers connect.
• HubSpot, Salesforce, Pipedrive and Attio: only if a customer connects one. We sync records in and write letter events back.
• Calendly and Cal.com: only if a customer connects one, to learn when a recipient books a meeting.

Our subprocessors page lists each provider, what it handles and where. Video hosts such as Loom, Vidyard and YouTube receive a visit when a recipient plays a video the sender included. We may also share information if the law requires it, to protect people or the service from harm, or as part of a merger or sale of the company, in which case this policy keeps applying to it.

Where data is processed

Data is processed and stored in the United States. If you are outside the US, your information is transferred there. For transfers from the EU, the UK and Switzerland, we rely on the Standard Contractual Clauses, or on the EU-US Data Privacy Framework and its UK and Swiss extensions where our providers take part in it.

How long we keep it

Letters, contacts, synced CRM records and their activity are kept while the sending workspace is active. When an admin deletes the workspace, it is hidden right away and permanently erased 30 days later (the 30 days let us restore it if asked). A customer can ask us to delete individual contacts and letters sooner. Account and billing records are kept as long as tax and accounting law requires.

Opt-out records are kept for as long as needed to keep honoring them, because deleting them would let letters start again. Server logs are kept for up to 90 days, unless we need them longer to investigate a security issue or abuse. Demo requests are kept until we no longer need them to follow up.

Security

Each workspace's data is kept separate by access rules in our database. Data travels over encrypted connections, and mailbox access is encrypted when stored. Only people who need access to run the service have it. No system is perfectly secure, and if a breach affects your data, we will tell the affected customers without undue delay. Read more on our security page.

If you received a letter

Every heads-up, letter email and follow-up says to reply "no letters" to stop. SnailReach can't read the sender's mailbox, so the sender marks your reply in SnailReach, which cancels anything scheduled and stops that company from writing to you again. To stop right away without waiting for the sender, use the "Unsubscribe" option your mail app shows on the letter email or a follow-up, or tap "Don't send me letters" on the letter page. To stop letters from every SnailReach sender, use our opt-out page, which confirms by email.

For any other request about your details, such as seeing or deleting them, contact the company that wrote to you first, because it controls them. If you can't reach it, write to support@snailreach.com and we will help, or pass your request to that company.

Your rights

Everyone can ask to see, correct, export or delete their personal information by writing to support@snailreach.com. We will answer within the time the law sets.

EU and UK. Under the GDPR and UK GDPR you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent where we rely on it. You can also complain to your local data protection authority.

California. In the last 12 months we collected these categories of personal information: identifiers (such as name, email and IP address), professional information (such as title and company), commercial information (such as plan and payment history), internet activity (such as letter activity and server logs) and approximate location from IP address. We collect them for the purposes above, from you, from the company that wrote to you and from tools it connects. We do not sell or share personal information, and we do not use sensitive personal information to infer anything about you.

You have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing (which we do not do). We will not treat you differently for using these rights. To verify a request, we will ask you to confirm it from the email address it is about, and we may ask for more details where needed. We respond within 45 days, and may extend that once by another 45 days when the law allows, with notice. You can use an authorized agent, who must show us your signed permission, and we may ask you to confirm your identity with us directly.

Customers can update their details in settings, disconnect a mailbox or integration, and ask us to delete contacts or letters or close their workspace.

Children

SnailReach is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe we have, write to support@snailreach.com and we will delete it.

Changes to this policy

We will update the date at the top when this policy changes. If a change is significant, we will tell customers by email or in the app before it takes effect.

Contact

Bridgewood Creative LLC, 5610 Ponderosa Drive, West Des Moines, IA 50266 · support@snailreach.com