Privacy notice

Draft, version 2026-09-29, awaiting legal review. It describes how the service works today; the reviewed version will replace it before public sign-up opens.

Two kinds of personal data

About you, our customer (name, email, billing details, sign-in records): Faresay Ltd is the controller. We use it to run your account, bill you through Stripe, send account email (sign-up confirmation, password resets, alerts you ask for) and keep the service secure. The lawful basis is the contract with you and, for security records, our legitimate interest.

About the people you email (addresses, names and any columns you upload, the messages sent and received): you are the controller and we are your processor. We process it only to provide MyOwnReach to you, on your instructions, and for no other purpose. We never sell it, never use it to build a lead database, and never mail your contacts ourselves.

What we keep and for how long

• Workspace data stays until you delete it or close the account; then it is removed from the live database within 30 days and from backups when they expire.
• Mailbox passwords and DKIM keys are encrypted at rest.
• Unsubscribes and spam reports are kept permanently as a suppression list, because their purpose is to make sure that person is never emailed again.
• Sign-in attempts are kept for 90 days for security.

Processing terms (for customers)

• We act only on your documented instructions (using the software is an instruction), keep the data confidential, and bind our staff to confidentiality.
• We use these sub-processors: Vercel (hosting), Neon (database, EU/UK region), Stripe (billing, customer data only), Resend (account email only). We will give 14 days' notice of a new one.
• We help you answer requests from people exercising their rights: the suppression list and lead export cover most of them. Ask us for anything else.
• We will tell you without undue delay, and within 48 hours, if we become aware of a breach affecting your data.
• At the end of the service we delete your data, or return it first if you ask.

Your rights

You can ask for a copy of your data, correct it, delete it, or object to how we use it, by writing to scarlet@robinofloxley.com. If you received an email sent with MyOwnReach and want to know why, the sender is the controller: use the unsubscribe link, reply to them, or report it to us. You can complain to the Information Commissioner's Office (ico.org.uk).

Cookies

One cookie, to keep you signed in. No advertising or tracking cookies on our pages.

Questions: scarlet@robinofloxley.com. MyOwnReach is provided by Faresay Ltd, trading as Robin of Loxley.