Privacy notice

How EasyReach protects your outreach data

Effective January 20, 2026 · NDPR & GDPR compliant

Enterprise-Grade Privacy Protection

EasyReach is fully compliant with the Nigeria Data Protection Regulation (NDPR) and GDPR. We encrypt all data, provide granular consent controls, and never sell your information to third parties.

1. Information We Collect

  • Account Information: Name, email address, phone number, company name, and billing details when you create an account.
  • Contact Data: Phone numbers, email addresses, and custom fields for contacts you import into EasyReach for outreach campaigns.
  • Usage Data: Campaign metrics, delivery reports, call recordings (if enabled), AI transcripts, engagement analytics, and platform interaction logs.
  • Device Information: IP address, browser type, device fingerprints, operating system, and cookies to prevent fraud and optimize performance.
  • Payment Data: Processed securely through Flutterwave and NOWPayments. We do not store full credit card numbers or bank account details on our servers.

2. How We Use Your Information

  • Platform Operation: Deliver SMS broadcasts, AI voice calls, manage contacts, schedule campaigns, and provide analytics dashboards.
  • Service Improvement: Analyze usage patterns to enhance deliverability, optimize AI models, and develop new features.
  • Security & Fraud Prevention: Monitor device fingerprints, detect suspicious activity, and prevent unauthorized access or abuse.
  • Communications: Send account notifications, security alerts, support responses, and (with consent) marketing updates.
  • Legal Compliance: Fulfill regulatory obligations under NDPR, GDPR, and other applicable laws.

3. Data Sharing & Third Parties

  • Telephony Providers: Twilio, Africa's Talking, and Vapi receive phone numbers and message content to deliver SMS and voice calls.
  • Payment Processors: Flutterwave and NOWPayments process transactions. They receive billing details but not your full contact database.
  • AI Services: OpenAI and ElevenLabs process voice transcripts and generate AI responses. Data is encrypted in transit and not used for model training.
  • Analytics: Google Analytics helps us understand platform usage. You can opt out at https://tools.google.com/dlpage/gaoptout.
  • Integrations: HubSpot, Salesforce, Zoho, and Google Sheets receive data only when you explicitly connect them via API credentials.
  • Legal Requirements: We may disclose information to comply with subpoenas, court orders, or regulatory requests from Nigerian authorities.

4. Data Security & Encryption

  • Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3 (HTTPS).
  • Encryption at Rest: Sensitive data (contact records, call recordings, transcripts) is encrypted in MongoDB using AES-256 encryption.
  • Access Controls: Role-based access control (RBAC) ensures only authorized personnel can access customer data. Admin accounts require 2FA.
  • Device Fingerprinting: We collect device fingerprints to prevent fraud and unauthorized account creation. This data is stored securely and not shared externally.
  • Regular Audits: We conduct quarterly security audits and penetration testing. Vulnerabilities are patched within 48 hours of discovery.

5. Consent & Opt-Out

  • Contact Consent: You are responsible for obtaining proper consent from contacts before sending SMS or making voice calls. EasyReach provides tools to track consent status.
  • Opt-Out Handling: Recipients can reply STOP to SMS messages or say 'stop' during voice calls. EasyReach automatically adds them to your do-not-contact list.
  • DND Compliance: We respect Nigeria's Do Not Disturb registry. Numbers on the DND list are flagged, and you receive warnings before sending.
  • Marketing Opt-Out: You can unsubscribe from EasyReach marketing emails at any time via the link in each email or by contacting privacy@easyreach.space.

6. Data Retention & Deletion

  • Call Recordings: Retained for 24 months by default. You can adjust this in Settings → Compliance.
  • SMS Logs: Retained for 18 months. Delivery reports and message content are archived for compliance.
  • Contact Records: Retained indefinitely until you delete them. When you delete a contact, we queue removal across all integrations within 24 hours.
  • Backup Retention: Database backups are retained for 30 days. Deleted data is permanently purged after this period.
  • Account Deletion: When you delete your EasyReach account, all data is queued for deletion and permanently removed within 30 days.

7. Your Rights (NDPR & GDPR)

  • Access: Request a copy of all personal data we hold about you or your contacts. We respond within 48 business hours.
  • Correction: Update inaccurate or incomplete data via your dashboard or by contacting support.
  • Erasure: Request full data deletion by emailing privacy@easyreach.space. We process erasure requests within 30 days.
  • Portability: Export your contact lists, campaign data, and call recordings in CSV or JSON format.
  • Restriction: Request that we limit processing of your data while disputes are resolved.
  • Objection: Object to automated decision-making (AI voice calls) or profiling. We will provide manual alternatives.
  • Data Protection Officer: Nominate a DPO for your organization to coordinate audits and compliance reviews.

8. International Data Transfers

  • Data Hosting: Primary data is hosted in MongoDB Atlas clusters located in the EU and US. Nigerian user data may be replicated for performance.
  • Cross-Border Transfers: When data is transferred outside Nigeria, we ensure adequate protection via Standard Contractual Clauses (SCCs) or adequacy decisions.
  • Sub-Processors: All sub-processors (Twilio, OpenAI, etc.) are bound by data processing agreements that comply with NDPR and GDPR.

9. Cookies & Tracking

  • Essential Cookies: Required for authentication, session management, and security. Cannot be disabled.
  • Analytics Cookies: Google Analytics tracks page views and user behavior. You can opt out via browser settings or the Google Analytics opt-out page.
  • Preference Cookies: Store your language, currency, and theme preferences. Expire after 12 months.
  • Do Not Track: We currently do not respond to browser Do Not Track signals. We recommend using browser privacy settings or opt-out tools.

10. Children's Privacy

  • EasyReach is not intended for individuals under 18 years of age. We do not knowingly collect data from children.
  • If you believe a child under 18 has provided us with data, contact privacy@easyreach.space and we will delete it within 48 hours.

11. Data Breach Notification

  • In the event of a data breach affecting your personal information, we will notify you within 72 hours of discovery.
  • Notifications will be sent via email and posted in your dashboard. We will provide details of the breach, affected data, and steps we are taking.
  • We will also notify the Nigerian Data Protection Commission (NDPC) and other relevant authorities as required by law.

12. Changes to This Policy

  • We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors.
  • Material changes will be notified via email or a prominent notice on our website at least 30 days before taking effect.
  • Continued use of EasyReach after changes take effect constitutes acceptance of the updated policy.

Questions or data requests?

Email our Data Protection Officer at privacy@easyreach.space

Or reach our Lagos office at +234 906 070 0888

We respond to all privacy requests within 48 business hours.

Your Responsibility

As an EasyReach user, you are the data controller for the contacts you import. You must obtain proper consent before sending SMS or making voice calls. EasyReach provides tools to help you track consent and comply with DND regulations, but legal responsibility rests with you.

© 2026 EasyReach by TRICODE PRO LTD. All rights reserved.

Last updated: January 20, 2026