Skip to content

Privacy Policy

Last updated: March 14, 2026

AutoReach is a product of Mizu Development LLC ("AutoReach," "we," "us," or "our").

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password (stored as a bcrypt hash). We never store plaintext passwords.

Payment Information

Payments are processed by Stripe. We do not store credit card numbers or payment details on our servers. We receive a transaction record from Stripe including the amount and credit pack purchased.

Workflow and Lead Data

When you run workflows, we store: search queries, lead business names, websites, contact emails, phone numbers, AI-generated quality scores, outreach drafts, and close value estimates. In continuous agent mode, we also store agent memory data including learned quality patterns, search variation history, and your approval/rejection patterns.

SMTP and IMAP Credentials

If you connect an email account for outreach, we store your SMTP and IMAP host, port, username, password, and from name. Your SMTP and IMAP passwords are encrypted at rest using AES-256-GCM, and access is restricted to the backend systems required to send email on your behalf. They are used solely to send emails from your account and are never shared with third parties.

Workflow Snapshots

Full workflow state is captured and stored as snapshots for service improvement and debugging. Snapshots include leads, AI-generated content, quality scores, review decisions, and agent memory patterns. Snapshots also record which leads were human-reviewed versus auto-reviewed.

Review Decision Tracking

Each lead tracks review metadata including reviewed_by (human or auto), reviewed_at timestamp, and review_notes. This data is used to improve AI quality scoring and maintain an audit trail of lead approval and rejection decisions.

Agent Thinking Data

Before taking actions, the AI agent performs reasoning steps. We store these "agent thoughts" including the question asked, the AI response, the decision made (follow, deviate, or observe), and the reasoning. This data is used for transparency (visible in activity feeds), quality improvement (e.g., regenerating low-quality emails), and fine-tuning AI models. Agent thinking data is scoped to your account and included in workflow snapshots.

Chat Data

When you use the AI Chat Assistant, your chat messages and conversation history are sent to our AI provider (Anthropic) for processing. Chat conversations are not persistently stored on our servers. Message history exists only in your browser session and is cleared when you navigate away. Your account data (leads, workflows, credits) is retrieved in real time to provide context for chat responses but is not stored separately for chat purposes.

Usage Data

We log workflow activity including stages executed, credits consumed, errors encountered, agent thinking events, chat message counts, and agent cycle counts for operational monitoring and debugging.

2. How We Use Your Information

  • To operate the Service and process your workflow requests.
  • To maintain credit balances and transaction history.
  • To train your personal agent memory (quality patterns, preferences). This data is scoped to your account and not shared.
  • To send transactional emails (account verification, purchase receipts, workflow status notifications such as completed, paused, or error alerts).
  • To analyze workflow snapshots, agent thinking records, and user feedback (thumbs up/down) to improve AI agent performance.
  • To use review decision data to refine AI lead qualification accuracy.
  • To send outreach emails on your behalf through your connected SMTP provider.
  • To process AI Chat Assistant queries by retrieving your account data and sending it to our AI provider for response generation.
  • To improve the Service and fix bugs.

3. AI Processing

AutoReach uses third-party AI models, primarily Anthropic Claude, to generate lead qualifications, outreach content, and search query variations. If our primary AI provider is unavailable, we may fall back to a secondary model hosted via Replicate (currently a Llama-family model) to keep workflows running. Lead data is sent to these AI providers for processing. We do not use your data to train third-party AI models. Our AI providers process data under their respective data processing agreements.

4. Data Sharing

We do not sell your personal data. Depending on how you use the Service, we share data with:

  • Stripe: for payment processing.
  • Anthropic, and Replicate as a fallback: for AI-powered lead qualification, outreach generation, and agent decisions.
  • Google Places API, Google Custom Search, and SerpApi: for business search and, when you use people-search features, looking up publicly available professional profiles by name and company.
  • Cloudflare Turnstile: for bot/abuse prevention on account signup and other sensitive actions.
  • Resend: our transactional email provider, used to send AutoReach account, receipt, and product emails (not your own outreach emails).
  • Your Email Provider: when you connect SMTP or IMAP (e.g., Gmail, Outlook), outreach emails are sent through your email provider using your credentials. AutoReach does not store sent email content.
  • HubSpot or Salesforce: only if you connect a CRM integration, lead data you choose to push or import is shared with that provider under your own account with them.
  • A webhook URL you configure: only if you set up a custom webhook integration, lead data is sent to the URL you provide.
  • Law enforcement: only when required by law or valid legal process.

5. Data Storage and Security

  • Data is stored in PostgreSQL hosted on Supabase (AWS us-west-2).
  • API keys are one-way hashed and cannot be recovered in plaintext after creation. SMTP and IMAP passwords are encrypted at rest using AES-256-GCM; access is restricted to the systems that need them to send email on your behalf.
  • Connections to the Service use TLS encryption in transit.
  • Account passwords are hashed with bcrypt (12 rounds).
  • JWT tokens expire after 7 days.

6. Data Retention

Account data, workflow history, workflow snapshots, agent thinking records, and SMTP/IMAP credentials are retained for as long as your account is active. You can request account deletion at any time; your account is deactivated immediately and you have 30 days to cancel the request. After that 30-day window, your personal data, workflows, leads, snapshots, agent thoughts, SMTP/IMAP credentials, review decisions, and agent memory are permanently deleted. Contact privacy@autoreach.work if you want to confirm your data has been removed. Credit transaction records may be retained for accounting purposes as required by law.

7. Your Rights

  • Access your personal data via the dashboard or API.
  • Export your lead data (including quality scores) as CSV at any time.
  • Delete your account and all associated data.
  • Opt out of non-essential communications.

8. Cookies and Analytics

We use a JWT token stored in localStorage for authentication. This is essential to signing you in and is always active.

We also use analytics tools, including Mixpanel, Vercel Analytics, and Cloudflare Web Analytics, to understand product usage and diagnose issues. These tools may set cookies or similar identifiers and, in Mixpanel's case, may capture aggregate interaction data such as clicks and page navigation for product debugging.

These analytics tools load only after you accept cookies in our consent banner. If you decline, they are not loaded and set no analytics cookies. You can change your choice at any time by clearing this site's data in your browser, which brings the banner back.

9. Children

The Service is not intended for use by anyone under 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this policy at any time. We will notify you of material changes via email. Continued use after changes constitutes acceptance.

11. Contact

Privacy questions? Contact us at privacy@autoreach.work.