Privacy Policy

Last updated / effective:

1. Who we are (controller / processor roles)

[PLACEHOLDER — pending legal review: identify Mako Reach's legal entity, registered address, and data protection contact. Clarify when Mako Reach acts as data controller (e.g. account/billing data of our customers) versus data processor (e.g. outreach recipient data processed on a customer's behalf under a Data Processing Agreement).]

2. What data we process

[PLACEHOLDER — pending legal review: describe data categories collected from customers (account, billing, usage) and, separately, the LinkedIn profile data of outreach recipients that customers import or that is retrieved via connected LinkedIn accounts (e.g. name, headline, company, public profile URL, message content). Distinguish recipients are not Mako Reach's own users.]

3. Lawful basis for processing

[PLACEHOLDER — pending legal review: state the lawful basis relied on for each processing activity, e.g. contract performance for customer accounts, legitimate interests for B2B outreach on a customer's behalf, and consent where applicable. Legal to confirm legitimate-interest balancing test for outreach recipient data.]

4. Sub-processors

[PLACEHOLDER — pending legal review: list sub-processors involved in delivering the service (e.g. hosting/infrastructure, the LinkedIn integration provider, email/SMS delivery, Resend as the transactional email provider, LLM providers used for message drafting) and link to an up-to-date sub-processor register.]

5. Data subject rights

[PLACEHOLDER — pending legal review: describe the rights available (access, rectification, erasure, restriction, portability, objection) and how to exercise them. Outreach recipients who wish to opt out of contact or request erasure may do so via the contact channel below — [PLACEHOLDER: privacy contact email / DSAR request form URL].]

6. Retention

[PLACEHOLDER — pending legal review: state retention periods for account data, outreach/lead data, and message logs, and the criteria used to determine them (e.g. duration of customer contract plus a defined post-termination window, or until an erasure/opt-out request is honored).]

7. International transfers

[PLACEHOLDER — pending legal review: identify where data is hosted/processed, any transfers outside the EEA/UK, and the transfer mechanism relied upon (e.g. Standard Contractual Clauses, adequacy decision).]