HighReach Privacy Policy

1. Information we collect

1.1. Information you give us

• Account information: your name, email address and password (passwords are handled by our sign-in provider, Auth0, and are never stored by HighReach in readable form). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Payment information: payments are processed by Stripe. We receive your subscription status, plan, billing country and limited card details, such as card brand, last four digits and expiry. We never receive or store your full card number.
• Your content: the prompts, text, images, videos, audio, reference media and brand assets you submit ("Inputs"), and the images, video and audio the Service generates for you ("Outputs").
• Communications: what you send us by email or through our contact form, and survey or feedback responses.

1.2. Faces and voices
Your Inputs may include photos, videos or recordings of people, including their faces and voices. For example, you might use face swap, lip-sync, avatars, voice cloning or dubbing.

• We process this media only to deliver the feature you request.
• We do not use it to identify or verify anyone.
• We do not create or keep facial or voice templates for identification.
• To generate your result, our model providers may temporarily analyse facial or voice characteristics.
• Only upload media of people who have given you permission (see our Terms of Service, Section 6).

1.3. Information collected automatically

• Device and usage data: IP address, browser and device type, operating system, language, referring pages, pages and features used, clicks, and times and dates of use.
• Generation data: which tools and models you use, generation settings, credit usage, job status and errors.
• Cookies and similar technologies: see Section 6.
• Security data: signals from our bot-protection service (Cloudflare Turnstile), rate-limit records and server logs, which we use to prevent abuse and fraud.

1.4. Information from third parties

• Sign-in providers, such as Google, as described above.
• Stripe, for payment and subscription status.
• Analytics providers, for aggregated or pseudonymous usage information.

2. How we use information

We use personal information to:

• Provide the Service: create and manage your account, process your Inputs, generate Outputs, store your files, and show your history and credit balance.
• Process payments: manage subscriptions and credits, and send receipts and billing notices.
• Keep the Service safe: detect, investigate and prevent fraud, abuse, spam, security incidents, and violations of our Terms (including content that breaks our rules), and enforce our Terms.
• Support you: answer requests and fix problems.
• Improve the Service: understand how features are used, measure performance, debug errors and develop new features, mainly using aggregated or pseudonymous data.
• Communicate with you: send service and account messages, and, where allowed, product updates and offers. You can opt out of marketing emails at any time.
• Meet legal obligations: comply with tax, accounting and other laws, respond to lawful requests, and establish or defend legal claims.

AI training. HighReach does not train its own AI models on your Inputs or Outputs. We send your Inputs to third-party AI providers only so they can generate your Outputs. Those providers process data under their own terms and policies (see Section 3).

3. How we share information

We do not sell your personal information. We do not share it for cross-context behavioral advertising.

We share personal information only as follows:

• AI processing providers. To generate your Outputs, we send your Inputs (prompts and media) to our inference provider, fal.ai, which routes them to the model you choose. The model developers include Google, OpenAI, ByteDance, Kuaishou (Kling), MiniMax, Alibaba, Black Forest Labs, ElevenLabs and others. We also use OpenAI and Google AI services for some text and image tools. We do not send your name, email address or payment details to model providers along with your prompts.
• Service providers. These companies process data for us under contract, only to provide their services to us:
  • Hetzner, for cloud hosting in Germany
  • Cloudflare, for networking, security, file storage (R2) and bot protection
  • Auth0 (Okta), for sign-in
  • Stripe, for payments
  • Resend, for email delivery
  • PostHog (EU), for product analytics and error tracking
  • Google Analytics, for website analytics
• Legal and safety. We share information when we believe in good faith that the law requires it, or that it is needed to protect the rights, property or safety of HighReach, our users or others. This includes reporting child sexual abuse material to the National Center for Missing & Exploited Children.
• Business transfers. If HighReach is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.
• With your consent or at your direction, for example when you share an Output publicly.

4. Retention

• Account information is kept while your account is open.
• Your content is kept until you delete it or delete your account. When you delete a file or generation, we remove it from our storage.
• When you delete your account, we cancel any subscription and delete your account data and content from our active systems. Copies in backups and logs are overwritten over time on their normal schedule.
• Billing and tax records are kept for as long as the law requires, generally up to 7 years.
• Security and abuse records are kept as long as needed to protect the Service, and longer if needed for a legal claim or investigation.
• Third-party AI providers keep Inputs and Outputs only as allowed under their own terms.

5. Security

We protect personal information with technical and organizational safeguards, including:

• encryption in transit
• access controls
• private storage of your files
• separation of payment data, which Stripe handles

No system is completely secure, and we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.

6. Cookies and similar technologies

We use:

• Essential cookies, to keep you signed in, secure your session, protect against bots and remember basic preferences. The Service does not work without them.
• Analytics cookies and tools (PostHog and Google Analytics), to understand how the Service is used and to find errors.

You can control cookies through your browser settings, and you can opt out of Google Analytics with Google's browser add-on. Where the law requires it, we ask for your consent before using non-essential cookies. Where required, we honor recognized opt-out preference signals, such as Global Privacy Control.

7. Your rights and choices

7.1. Choices for everyone

• Access and update your account information in your settings.
• Delete files and generations at any time.
• Delete your account from your settings.
• Unsubscribe from marketing emails using the link in any marketing email.

7.2. Rights under privacy laws
Depending on where you live (for example the EU, UK, Canada, California and other US states), you may have the right to:

• access the personal information we hold about you and receive a copy
• correct inaccurate information
• delete your information
• object to or restrict certain processing
• receive your data in a portable format
• withdraw consent where we rely on consent
• opt out of sale, sharing or targeted advertising (we do none of these)
• appeal our decision on your request
• complain to your data protection authority

To exercise these rights, email Email HighReach from your account email. We may need to verify your identity, and we will respond within the time required by law. An authorized agent may make a request for you where the law allows. We will not discriminate against you for exercising your rights.

7.3. Legal bases (EU/UK)
Where the GDPR or UK GDPR applies, we process personal information on these bases:

• to perform our contract with you (providing the Service and billing)
• our legitimate interests (security, fraud prevention, analytics and improving the Service, balanced against your rights)
• to meet legal obligations
• your consent, where required, for example for non-essential cookies or marketing

8. International transfers

HighReach is a US company. Our main servers are in Germany, and some service and AI providers process data in the United States and other countries. Where we transfer personal information out of the EU, UK or Canada, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or our providers' equivalent commitments.

9. Children

The Service is for people 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact Email HighReach and we will delete it.

10. Links to other sites

The Service may link to third-party websites and services. Their privacy practices are governed by their own policies, not this one.

11. Changes to this Policy

We may update this Policy from time to time. If changes are material, we will notify you in advance, for example by email or in the app, and update the date above.

12. Contact

High Reach, Inc.

• Privacy requests: Email HighReach
• Support: Email HighReach