Privacy Policy

Last updated: 22 October 2026

This policy explains how BrightReach (“we”, “us”) processes personal data collected through brightreach.co.in and our automated follow-up platform. We comply strictly with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Who We Are & Roles Under Data Protection Law

Address: Andhra Pradesh, India.
Contact & Grievance Desk: Submit an Inquiry.

BrightReach acts as a Data Fiduciary with respect to our direct business customers (merchants signing up for our software) and as a Data Processor with respect to client appointment records processed on behalf of merchants.

2. Categories of Data We Collect

• Merchant Account Data: Business name, owner/contact name, work email address, service vertical, business city, and billing identifiers.
• Client Appointment Records (Processed on Merchant Behalf): Customer email address, appointment date and time, service category (e.g. dental cleaning, oil change), and invoice amounts.
• Consent & Verification Audit Logs: Tamper-proof record of the consent notice shown, timestamp, IP address, and client intake channel.
• Delivery & Telemetry Data: Email delivery telemetry (delivered, opened, clicked, bounced, complained) and suppression records.
• Inquiries: Correspondence sent to our support and compliance desks.

3. Purpose & Legal Basis for Processing

• Contractual Performance: Delivering verified transactional booking confirmations, 24-hour appointment reminders, and digital tax receipts requested by clients and merchants.
• Consent: Delivering post-appointment review requests, periodic service recalls, and BrightReach early-access product updates.
• Legitimate Interest & Compliance: Maintaining suppression databases to permanently honor opt-outs, preventing spam or fraudulent list imports, and maintaining deliverability hygiene.

4. Third-Party Sub-Processors

We work only with security-certified cloud infrastructure providers:

• Enterprise Cloud Infrastructure: Dedicated transactional email dispatch and real-time bounce/complaint event streaming (Asia Pacific - Mumbai region).
• Supabase: Managed PostgreSQL database hosting with strict Row-Level Security (RLS) enforcement.
• Vercel: Edge web application hosting and SSL termination.

We do not sell, rent, monetize, or broker personal data to advertisers, brokers, or external third parties.

5. Retention & Auto-Purge Standards

Unconfirmed early-access sign-ups and abandoned verification tokens are automatically purged from our database after 30 days. Active subscriber records are retained for the duration of the merchant relationship. Suppressed email addresses are retained indefinitely solely as a permanent suppression barrier to ensure they are never emailed again.

6. Individual Rights & Opt-Outs

Under applicable law, you have the right to access, rectify, or erase your personal data, and to withdraw consent at any time. Every email contains a direct 1-click unsubscribe link. You may also reach our Data Grievance Desk via our Contact Page.

7. Security Architecture

All communications utilize TLS 1.3 encryption in transit. Access to production databases is restricted to authorized service keys, and unsubscribe/confirmation tokens are cryptographically signed using HMAC-SHA256 to prevent spoofing or enumeration.