Privacy Policy

This Privacy Policy explains how Pilum Reach Lite collects, uses, stores, shares, and protects information when you use our website, dashboard, APIs, billing features, and omnichannel messaging platform.

For account, billing, security, product, and support data, we generally act as a data controller. For contact lists, recipient data, and message content you upload or send through the platform, we generally act as your service provider or data processor and process that data to provide the service you request.

To facilitate omnichannel broadcasts and one-to-one messages, we temporarily process and store message payloads. Payloads may include message text, subject lines, template variables, recipient identifiers, media URLs or attachments, provider message IDs, delivery status, timestamps, and provider error responses.

Message payloads are stored so the platform can queue, send, retry, display history, reconcile credits, process inbound replies, enforce opt-outs, provide support, and maintain auditability. Message payloads are retained according to the retention rules below unless you delete them earlier or a longer retention period is required for legal, fraud, security, or dispute purposes.

• Provide the platform. We authenticate users, manage contacts, send broadcasts, process inbound messages, track delivery, maintain credits, and provide API and webhook access.
• Route messages. We send recipient identifiers and message payloads to the connected messaging providers selected by you.
• Process billing. We create Polar checkouts, sync subscription status, reconcile invoices, apply credits, and maintain financial records.
• Support users. We use account, technical, billing, and message-delivery information to answer support requests and troubleshoot issues.
• Secure the service. We monitor authentication, API use, abuse signals, delivery errors, rate limits, and suspicious activity.
• Improve reliability. We use operational logs and client monitoring telemetry to identify bugs, failed requests, and performance issues.
• Comply with law. We retain and disclose information when required for legal obligations, tax, audits, fraud prevention, disputes, or enforcement of our Terms.

We share data only as needed to provide, secure, support, bill, and comply with obligations for the platform.

• Messaging providers. We send message payloads and recipient identifiers to providers such as Meta/WhatsApp, Telegram, Resend, Twilio, Vonage, Plivo, MessageBird/Bird, Telnyx, and similar providers you connect or select.
• Infrastructure providers. We use Supabase for database, authentication, and private media storage services.
• Billing provider. We use Polar to process checkout, payments, subscriptions, invoices, receipts, taxes where applicable, refunds, chargebacks, and customer-portal actions.
• Support and operations. Authorized personnel and service providers may access limited information when needed for support, reliability, security, or compliance.
• Legal and safety. We may disclose information if required by law, subpoena, court order, government request, provider investigation, or to protect rights, safety, security, and fraud-prevention interests.

We do not sell personal information or use recipient data for third-party advertising.

We retain information for as long as needed to provide the platform, meet legal obligations, resolve disputes, enforce agreements, prevent fraud, and maintain security. Current retention targets include:

Account deletion removes or obfuscates user-facing content according to our deletion workflows, but financial ledgers, invoices, legal consent records, fraud-prevention records, and audit evidence may be retained. Some retained financial records may no longer identify a deleted user directly because the user reference can be set to null in the database.

We use administrative, technical, and organizational safeguards designed to protect the platform. These include:

• database-level access controls so users can access only their own data;
• role-based access controls for application features;
• TLS encryption for traffic between your browser and our servers;
• hashed API keys, with raw keys shown only once at creation;
• encrypted storage for selected provider credentials;
• usage limits, monitoring, and abuse-prevention controls.

No online service can guarantee absolute security. You are responsible for strong passwords, safe API-key handling, limiting team access, and maintaining security for connected provider accounts.

When you use third-party channels or billing services, your data is also handled under those providers' terms and privacy policies. Review the policies for the services you connect:

Our infrastructure, messaging, and billing providers may process data in multiple countries. When data is transferred across borders, we rely on safeguards offered by those providers and the contractual, legal, and technical measures available for the relevant transfer.

The platform is not intended for children under 13, and we do not knowingly collect information from children. If we learn that a child has provided personal information, we will delete it as required by law.

We may update this Privacy Policy from time to time. Material changes will be posted here or communicated through the platform.

For privacy questions or requests, contact us at privacy@pilumreach.com or through the in-app Support Center.