Privacy Policy

This policy explains what personal data MeeReach collects, why, who we share it with, how long we keep it and the rights you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules, and US federal and state privacy laws, including the California Consumer Privacy Act as amended by the CPRA (CCPA).

1. Who we are

MeeReach is operated by Teknomee Solutions (OPC) Private Limited, a company incorporated in India (CIN - U62099MH2024OPC428829), with its registered office at K103 PH III COUNTRY PARK, OPP. TATA SP STE NR, Borivali East, Borivlai East, Mumbai- 400066, Maharashtra: registered office address], Mumbai, India (“MeeReach”, “we”, “us”).

• Privacy contact and Grievance Officer (DPDP Act): Dilip Mishra, Director, privacy@meereach.com
• EU representative (GDPR Art. 27): [TO CONFIRM: Dilip Mishra, Hofgeest, 1102EB Amsterdam, Netherlands]

2. Our two roles

We handle personal data in two different capacities, and the rules differ for each.

• We decide how the data is used (a “controller” under GDPR, a “Data Fiduciary” under the DPDP Act, a “business” under US state laws) for people who visit this website, ask for access, hold a MeeReach account, or contact us.
• We act on our customers’ instructions (a “processor” under GDPR, a “Data Processor” under the DPDP Act, a “service provider” or “processor” under US state laws) for the contact lists our customers upload and the email they send through MeeReach. For that data, the customer who sent you the email decides how it is used and is responsible for having a lawful basis to email you. See section 11.

3. What we collect and why

Visiting this website. This site uses no analytics, advertising pixels or tracking cookies, and its fonts are served from our own servers. Our web server keeps standard request logs (IP address, date and time, page requested, browser user agent) to keep the site running and secure. The only cookie this site sets is the language cookie described in section 4, and only if you choose a language.
Legal basis: legitimate interests in operating and securing the site (GDPR Art. 6(1)(f)); reasonable purposes of security and fraud prevention (DPDP Act).

Requesting access. When you use the access form we receive your name, work email, company, the kind of email you send, a rough monthly volume, anything else you choose to tell us, and the language you filled the form in (so we can reply in it). It is emailed to the MeeReach team. We use it only to reply to you and, if you want, to set up an account.
Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries (GDPR Art. 6(1)(b) and (f)); data you provide voluntarily for a specified purpose (DPDP Act s. 7(a)).

Holding an account. We process your name, work email, role, organisation, a hashed password, sign-in and session records (including IP address and device information), activity logs of changes made in your account, API key metadata, credit purchases and usage, invoices, and your support correspondence.
Legal basis: performance of our contract with you or your organisation (GDPR Art. 6(1)(b)); compliance with tax and accounting law (Art. 6(1)(c)); legitimate interests in securing the service and preventing abuse (Art. 6(1)(f)); for DPDP, your consent given when the account is created, and legitimate uses permitted by the Act, such as compliance with law.

Service emails. We email account holders about security, billing, changes to the service and these terms. These are not marketing. If we ever send you product news, we will do so only where the law allows, and every such email will include a one-click unsubscribe.

Sensitive data. We do not ask for or intend to collect special-category or sensitive personal data. Under the CCPA, your account password counts as “sensitive personal information”; we use it only to sign you in and never to infer anything about you.

4. Cookies

We use cookies only where a feature can’t work without them. We use none for analytics, advertising or tracking you across sites, and we don’t share cookie data with anyone.

This website: one cookie, for your language. This site is available in English, Dutch and Korean. When you pick a language with the EN | NL | KO switcher at the top of the page, we save that choice so the site opens in your language next time, instead of making you switch on every visit.

• Name: meereach_lang
• What it holds: only “en”, “nl” or “ko”. No identifier, nothing about you or your device.
• When it is set: only when you click a language in the switcher. If you never click it, no cookie is set.
• How long it lasts: 12 months, or until you clear it or choose another language.
• Who can read it: only meereach.com (a first-party cookie). It is not sent to anyone else.

Because this cookie only remembers a setting you asked for, it is exempt from consent under the EU and UK ePrivacy rules (including the Dutch Telecommunications Act and the UK’s PECR). It is not used to profile you, and it is not a sale or sharing of personal information under US state laws. You can delete it at any time in your browser settings; the site keeps working, in English or the language in the address.

Your browser’s language. On your first visit, if you haven’t chosen a language, we look at the language preference your browser sends with every request (the Accept-Language header) and open the Dutch or Korean version if that’s what your browser asks for. We read it only to choose the page; we don’t store or log it.

The MeeReach console. The console uses only strictly necessary cookies and browser storage to keep you signed in and to protect your session. These don’t need consent under the EU ePrivacy rules, and we don’t use them for advertising or cross-site tracking.

5. Who we share data with

We do not sell personal data, and we do not share it for cross-context behavioural or targeted advertising.

We share personal data only with:

• Service providers (sub-processors) who host and run the service for us: data-centre and cloud-hosting providers in Germany and India, object storage, and the email provider that delivers our own service and form emails. Each is bound by a written contract that limits use to our instructions and requires appropriate security.
• Link-safety services. To warn senders about unsafe links, we check the web addresses in email content against reputation services. We send only the link, never the recipient’s details.
• Authorities and advisers where the law requires it, to protect our rights or users’ safety, or with our professional advisers under confidentiality.
• A buyer or successor if our business is reorganised, merged or sold, under the same protections described here.

Customers can request our current list of sub-processors, and we give notice before adding a new one, at privacy@meereach.com.

6. Where data is stored and international transfers

The MeeReach application and its database are hosted in Germany. Our mail servers run in Germany and India. Our company and support team are based in India.

India has no EU or UK adequacy decision. Where personal data from the EU, EEA, UK or Switzerland is transferred to or accessed from India, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss equivalents), together with the technical and organisational measures in section 8. You can ask for a copy of the relevant safeguards at privacy@meereach.com.

Under the DPDP Act, we transfer personal data outside India only to countries the Government of India has not restricted.

7. How long we keep data

• Website request logs: up to 30 days, longer only while investigating a security incident.
• Access requests that don’t become an account: 24 months, then deleted.
• Account data: for as long as the account is open, and deleted within 30 days after it is closed.
• Security and activity logs: up to 12 months.
• Invoices and accounting records: 8 years, as required by Indian company and tax law.
• Customer contact data: until the customer deletes it or within 30 days after the customer’s account closes. Backups roll off within a further 35 days.
• Suppression entries (unsubscribes, complaints, hard bounces): kept as long as needed to make sure an opted-out address is not emailed again.

Under the DPDP Act, we erase personal data once the purpose is served or consent is withdrawn, unless the law requires us to keep it.

8. How we protect data

We use encryption in transit (TLS), row-level security to keep each customer’s data separate, role-based access for team members, API keys stored only as one-way hashes, signed tracking and unsubscribe links, and an activity log of account changes. Access by our own staff is limited to people who need it to run and support the service.

If we suffer a personal data breach, we will notify affected customers without undue delay. Where we are the controller or Data Fiduciary, we will also notify the relevant supervisory authority (within 72 hours where the GDPR requires it), the Data Protection Board of India, and affected individuals, as the law requires.

9. Your rights

You can exercise any of these rights by writing to privacy@meereach.com. We may need to verify your identity first. We reply within one month, and we will tell you if we need longer where the law allows. We won’t charge you or treat you differently for exercising your rights.

EU, EEA, UK and Switzerland (GDPR). You have the right to access your data, correct it, erase it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. You can always object to direct marketing. You can also complain to the data protection authority in the country where you live or work, or to the UK Information Commissioner’s Office.

India (DPDP Act). As a Data Principal, you have the right to:

• a summary of the personal data we process and the processing activities;
• the identities of other Data Fiduciaries and Data Processors we have shared it with;
• correction, completion, updating and erasure of your data;
• withdraw consent as easily as you gave it;
• nominate someone to exercise your rights if you die or become incapacitated; and
• grievance redressal from our Grievance Officer (section 1). If you are not satisfied with our response, you can complain to the Data Protection Board of India.

United States. Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comprehensive privacy laws have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, targeted advertising and profiling. We do none of these, and we treat Global Privacy Control signals as a valid opt-out;
• limit the use of sensitive personal information. We already use it only for permitted purposes; and
• not be discriminated against for using these rights.

You may use an authorised agent, who must show that you authorised them. If we decline your request, you can appeal by replying to our decision. If the appeal is denied, you can contact your state Attorney General.

In the past 12 months, we collected these categories of personal information for the purposes in section 3: identifiers (name, email, IP address); professional information (company and role); commercial information (credit purchases); internet activity (sign-in and usage records); and account login credentials. We disclosed them only to the service providers in section 5, for business purposes. We have not sold or shared personal information.

10. Children

MeeReach is a business service. It is not directed at children, and we do not knowingly collect personal data from anyone under 18 (the DPDP Act’s definition of a child) or under 13 (COPPA). If you believe a child has given us personal data, contact us and we will delete it. Customers must not upload children’s data without verifiable parental consent where the law requires it.

11. If you received an email sent with MeeReach

Our customers send email to their own contacts through MeeReach. The sender is responsible for having your permission or another lawful basis to email you, and is the right place to go for questions about why they hold your address.

On our customers’ behalf, we process your email address and any details the sender stores, delivery outcomes (delivered, bounced, complaint), and the time, IP address and device information of opens and clicks. We use this data only to deliver the sender’s email, report results to the sender, detect automated opens and clicks, and keep the service secure.

Every marketing message sent through MeeReach has a one-click unsubscribe link. Once you unsubscribe, the address goes on that sender’s suppression list and won’t get their marketing email again. If you contact us about a sender’s email, we will pass your request to that sender and help them respond.

12. Automated decisions

We don’t make decisions about individuals based solely on automated processing that have legal or similarly significant effects. Automated checks in the product, such as address verification, spam scoring and detecting machine opens, help senders improve delivery and don’t make decisions about recipients.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change is material, we tell account holders by email or in the console before it takes effect.

14. Contact

For questions, requests or complaints, email privacy@meereach.com or write to our Grievance Officer, Dilip Mishra, at the registered office in section 1.