Reachio Privacy Policy

Draft pending legal review. Until it is approved, the shared Talivio texts at talivio.com/privacy, talivio.com/terms and talivio.com/legal/dpa apply.

Last updated: 2 November 2026 (draft)

This policy explains how Talivio Technology OÜ ("Talivio", "we") processes personal data in Reachio (https://reachio.talivio.com). It supplements the Talivio Privacy Policy at https://talivio.com/privacy; where they differ, this policy applies to Reachio.

1. Who we are. Talivio Technology OÜ, a private limited company registered in Estonia (registry code 16991406), Ahtri tn 12, Kesklinna linnaosa, 15551 Tallinn, Harju maakond, Estonia. Privacy contact: [email protected] (or [email protected]).

2. What Reachio does. Reachio is a platform for marketing agencies and multi-brand companies ("customers") to plan, approve and publish social media content, answer comments and messages, manage advertising campaigns, produce creatives, install tracking and report results for the brands they manage.

3. Our role. For the account data of people who sign up for Reachio we are the controller. For data that customers bring into Reachio by connecting social media and advertising accounts (for example posts, comments, messages, ad performance, audience statistics and the names of people who interact with a brand) we act as a processor on behalf of the customer, under our Data Processing Agreement (https://talivio.com/legal/dpa). People who interact with a brand should contact that brand or agency first; we will assist them.

4. Data we process.

• Account data: name, email, language, organization, role, sign-in and security logs, billing details (processed by our payment provider).
• Connected account data: when a user connects a platform account, we receive an access token and the data that platform makes available under the permissions the user granted, as described in section 6.
• Content: text, images, videos, alt text, comments, approvals and notes that users create in Reachio.
• Tracking configuration: pixel and tag IDs, consent settings and health checks for the customer's websites. Reachio does not receive the website visitors' browsing data unless the customer enables server-side forwarding, in which case events pass through Reachio to the advertising platform and are deleted within 7 days.
• Usage data: actions in the app, error logs and API call logs (without tokens).

5. Why we process it. To provide the service the customer contracted (GDPR Art. 6(1)(b)); to keep it secure and prevent abuse (Art. 6(1)(f)); to meet legal obligations such as accounting (Art. 6(1)(c)). We do not sell personal data and do not use connected account data for our own advertising.

6. Data from connected platforms. We access each platform only with the permissions the user approves on that platform's consent screen and only for the features the user uses. Tokens are encrypted at rest and never shown in the browser.

• Meta (Facebook, Instagram, Threads, Messenger, WhatsApp). Pages, Instagram and Threads profiles and their posts, comments, messages and insights; ad accounts, campaigns and ad performance; business assets shared with the agency. Processed under the Meta Platform Terms. Each customer's data is kept separate; we do not use it to build or augment user profiles, for retargeting, or for any other customer. To request deletion of data we received through Meta, see section 10.
• Google (Google Ads, YouTube, Google Business Profile). See sections 7 and 8.
• LinkedIn. Company Page posts, comments and statistics; ad accounts, campaigns, creatives, analytics and lead form responses. LinkedIn member data (such as a commenter's name and picture) is shown only to the people managing that Page, is not exported, is not combined with other data, and is kept for no longer than LinkedIn allows (member activity up to 48 hours, profile data up to 24 hours; aggregated Page statistics longer).
• TikTok. Basic profile, profile statistics and public video list of the connected account; videos and captions the user publishes; for advertisers, ad accounts and performance data.
• X. Profile, posts, mentions and their public metrics for the connected account; posts the user publishes. We do not use X content to train AI models.
• Microsoft Advertising, Apple Ads, Pinterest. Account, campaign, ad and performance data; Pinterest boards and Pins of the connected account.
• Telegram, Bluesky, Mastodon. The bot token or account authorization and the posts and messages the user sends.

7. Google API Services — Limited Use. Reachio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular: we use Google user data only to provide and improve the user-facing features described here; we do not transfer it to others except as necessary to provide those features, for security, to comply with law, or as part of a merger with the user's prior consent; we do not use it for serving advertisements, do not sell it, and do not use it for credit decisions; our staff do not read it unless the user consents, it is needed for security or legal reasons, or it is aggregated and anonymized for internal operations. We do not use Google user data to develop, improve or train generalized AI or machine learning models.

8. YouTube API Services. Reachio uses YouTube API Services to let users upload videos to channels they manage, read those channels' videos, comments and analytics, and reply to comments. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms); Google's processing is governed by the Google Privacy Policy (https://policies.google.com/privacy). We access, store and use: the OAuth tokens for the channel; channel and video metadata; comments on the channel's videos (including commenters' public names and pictures, shown only to the team managing the channel); and channel analytics. We do not share this data with third parties other than our sub-processors listed in section 12. We do not place cookies or other identifiers on your device through YouTube API Services. Data we display that is not your own authorized data is refreshed or deleted within 30 days; we re-check our authorization for stored analytics at least every 30 days. You can revoke Reachio's access at any time at https://security.google.com/settings/security/permissions; if you disconnect the channel in Reachio we revoke the token immediately and delete the YouTube data within 7 days, and if you revoke access from Google's page we delete it within 30 days. Privacy questions: [email protected].

9. Artificial intelligence. Reachio can draft captions, replies, reports and creatives using AI models accessed through the Talivio AI Gateway, routed to providers in the EU where available. We send only the content needed for the requested output. We do not use customer content or connected account data to train or fine-tune AI models shared with other customers, and our AI providers are contractually prohibited from training on it. Brand-specific settings (such as approved wording) are learned only within that brand's workspace. AI-generated images and videos are labelled as such.

10. Deleting your data and revoking access.

• Disconnect any platform in Reachio (Connections → Disconnect): we revoke the token where the platform allows it and delete data obtained through that connection within 30 days (7 days for YouTube), except aggregated statistics that no longer identify anyone and records we must keep by law.
• Facebook and Instagram users: if you remove Reachio in your Facebook settings (Settings & privacy → Settings → Apps and websites → Reachio → Remove), Meta notifies us and we delete the data we received through your authorization. You can also send a deletion request; you will receive a confirmation code and can check the status at https://reachio.talivio.com/meta/data-deletion/status.
• Anyone may ask us to delete their data at [email protected]; if we process it for a customer we forward the request to that customer and assist them.
• When a customer closes its Reachio account, all workspace data is deleted within 30 days, and backups within a further 35 days.

11. How long we keep data.

12. Sub-processors and transfers. Hosting: UpCloud Oy (Finland/Germany). Email: our own mail servers in the EU. AI: providers listed in Annex 3 of our DPA, via the Talivio AI Gateway, EU routing where available. Payments: Stripe Payments Europe Ltd. Platforms themselves (Meta, Google, LinkedIn, TikTok, X, Microsoft, Apple, Pinterest) receive data only when the user asks Reachio to send it to them (for example to publish a post) and process it under their own terms. Transfers outside the EU/EEA rely on adequacy decisions or standard contractual clauses.

13. Your rights. Access, rectification, erasure, restriction, objection, portability and withdrawal of consent; the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, www.aki.ee) or your local authority. Contact [email protected]; we answer within one month.

14. Security. TLS in transit; tokens and secrets encrypted at rest; per-customer data separation; role-based access; approval workflow and audit log for every change made to advertising accounts; access to production restricted to authorized staff with multi-factor authentication.

15. Changes. We will post changes here and notify customers by email 30 days before material changes take effect.