Privacy Policy
Last updated 4 October 2026FullReach AI MB
This notice explains which personal data FullReach AI MB collects, why, for how long, and what your rights are. It covers visitors to fullreach.ai and docs.fullreach.ai, users of FullReach AI, and people we contact about it.
Who is responsible
The controller is FullReach AI MB (registration code 308111564), Laisvės al. 110, Kaunas 44292, Lithuania. Write to privacy@fullreach.ai about anything in this notice.
Personal data in a customer's projects is different, for example in a persona or in the server logs it sends us. The customer is its controller, and we process it under the data processing terms in our Terms of Service.
What we collect
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Account: email address, role, organization and time of verification. | To create your account, sign you in and run your organization. | Contract. For an invited colleague: legitimate interest in giving the organization's team access. | While the account exists. |
| Welcome answers: role, function, goal and how you heard of us, if you give them. | To know who our users are. | Legitimate interest. | While the account exists. |
| Project data: brand details, website, markets, competitors, prompts, personas, topics and profile. | To run the measurement you ask for. | Contract. | While the project exists. |
| Measurements: the AI answers we capture for your prompts, and what we measure in them. | To show your results. | Contract. | While the project exists. Raw copies expire 91 days after capture. |
| Service email: sign-in links, invitations, trial and billing notices, digest, alerts, and one summary after your first results. | To run the service and report results. | Contract. Digest, alerts and the summary: legitimate interest. | While the account exists. |
| Billing: name, billing address, VAT ID, email address, invoices and payment status. Stripe handles your card, and we never see it. | To take payment, issue invoices and account for VAT. | Contract, and our legal duty to keep tax records. | 10 years, as Lithuanian tax law requires. |
| API keys and log keys: the name, creator and last use of each key. We store only a hash of the key. | To let your tools read your data securely. | Contract. | Until an admin revokes the key or deletes the organization. |
| Connections: each AI assistant an admin connects, where its answers go, what it may read, who approved it and when it was last used. We store only hashes of its tokens. | To let the assistant you chose read your data. | Contract. | Until an admin revokes it, the admin who approved it leaves, or the organization is deleted. |
| Technical logs: the IP address, time and path of each API request, and team changes: who changed whose role or removed whom, by email address. | To keep the service secure and fix faults. | Legitimate interest. | 30 days. |
| Free snapshot: your work email address, the website and market you ask about, and whether you want our news. | To send you the snapshot, and our news if you ask for it. | Your request. News: consent, which you can withdraw at any time. | The snapshot for 30 days, your address for 12 months, or until you unsubscribe if you ask for news. After you unsubscribe, we keep your address on a suppression list. |
| Website usage, if you allow analytics: the pages you open and what you click, your device and browser, your approximate location and a random identifier. | To learn which pages help visitors and where they leave. | Consent. You can withdraw it at any time. | Google Analytics keeps each visit for 2 months, and what it ties to the identifier for 14 months. |
| Product usage, if you allow analytics: the pages you open in setup, the dashboard and the connection page, and a recording of the screen. It also includes your clicks and scrolling, your device and browser, your approximate location and your organization's identifier. On the setup steps before the first analysis, the recording shows what you type and what the page shows. On every other page, it hides all text, input and images, but shows the layout and the shape of charts. Usage events name the page, the plan you pick and a trial that ends. | To learn where the setup and the dashboard confuse people, and to fix it. | Consent. You can withdraw it at any time. | PostHog keeps recordings for 30 days, and usage events for 1 year. Withdrawal stops new recording. Write to us to delete what PostHog already holds. |
| Where you came from, if you allow analytics: the link's campaign tags, the website that sent you and the first page you opened. | To learn which channels bring customers. | Consent. You can withdraw it at any time. | While the organization exists. |
| Refer a Friend: which organization referred yours, when, and whether it earned a credit. The organization that referred you sees your email domain and this status, never a name. | To give the longer trial and the credit. | Contract. | While either organization exists. |
| Activity: when you last used FullReach AI. | To learn which accounts use the service, and to improve it. | Legitimate interest. | While the account exists. |
| Messages and calls: what you write to us, the dashboard page you send a message from, or what you enter when you book a call. | To answer you. | Legitimate interest. | 2 years after our last exchange, or longer in a customer relationship. |
Most of this data comes from you. An admin who invites you gives us your email address. Google or Microsoft send it when you sign in with them. Stripe tells us whether a payment succeeded.
The contact form sends us your name, email address, topic and message by email, and FullReach AI stores none of it.
An account needs an email address, and a subscription needs billing details. Everything else is optional.
Who receives it
These kinds of providers process personal data for us, on our instructions and under a data processing agreement:
| Provider | What it does for us | Data it receives |
|---|---|---|
| Cloud hosting in Ireland (EU) | Hosting, database, storage and logs | All data in this notice |
| AI model providers | Analyse websites and answers, write suggestions, and answer a new trial's first prompts | Website text, project data and captured answers |
| Data collection providers | Put prompts to the AI platforms we measure, and read public web pages | Prompts, persona sentences, markets and web addresses |
| Email delivery | Sends our email | Email addresses and message content |
| Payments (Stripe) | Payments, invoices and VAT | Email address, billing details and payment data |
| Office email and calendar | Our mailboxes and call booking | Your messages and bookings |
| Documentation hosting (Mintlify) | Hosts docs.fullreach.ai | Visitors' IP addresses and usage data |
| Bot protection (Cloudflare Turnstile) | Checks that a person, not a script, uses a free tool, the contact form or the trial signup | Your IP address and browser data, on the free tool pages, the contact page and the trial signup only, once you start to fill in a form |
| Web analytics (Google Analytics) | Counts visits and how people use this website, if you allow analytics | Website usage data and your IP address |
| Product analytics (PostHog, EU) | Records how people use the setup and the dashboard, if you allow analytics | Product usage data and your IP address. PostHog discards the IP address after it finds your approximate location. |
Write to privacy@fullreach.ai to learn which providers receive your data.
Stripe receives the admin's email address when we create an organization. Stripe also uses payment data to prevent fraud and to meet its legal duties, as a controller in its own right.
These recipients act under their own privacy terms:
- Google and Microsoft, when you sign in with them.
- An AI assistant that an admin connects, such as ChatGPT or Claude. It receives the measurements it asks for, at your request. An admin revokes it under Settings.
- Google, when you connect our Data Studio connector with an API key. The connector runs on Google's servers and receives the counts it asks for, at your request. An admin revokes the key under Settings.
- The AI platforms we measure. They receive our prompts, but never your name or email address.
- Google's favicon service. Your browser loads the icons of brands and websites from it directly, so Google receives each website's domain and your IP address.
- Courts and authorities, when the law requires it.
- A buyer or successor of our business, under this notice.
We do not sell personal data or use it for advertising.
Transfers outside the EU
Some providers process data outside the European Economic Area, for example in the United States. We rely on a European Commission adequacy decision where one applies, and on the Commission's Standard Contractual Clauses otherwise.
AI models
We do not use your data to train AI models. The business terms of our AI providers do not let them train on it either. We make no automated decision that has a legal or similarly significant effect on you.
People we contact about FullReach AI
We email people at marketing agencies about FullReach AI. We take business contact details from public pages: the agency's website and open business directories. We keep your name, job title, business email address and agency, the page where we found you, our emails and your replies.
The legal basis is our legitimate interest in offering our service to businesses. Each email says where we found you. Reply "no", or write to privacy@fullreach.ai, and we stop at once. We then keep only your email address and your agency's domain on a suppression list, so that we never write again. Otherwise we delete your data 12 months after our last contact, unless you become a customer.
People named in AI answers
AI answers and the pages they cite can name people, such as a company founder or an author. We store these names as part of the measurement, under our and our customers' legitimate interest in knowing how AI platforms describe brands. We build no profile of any person. You can object at privacy@fullreach.ai.
Cookies and browser storage
FullReach AI sets six cookies that the service needs:
| Cookie | Purpose | Lifetime |
|---|---|---|
| __Host-fr_session | Keeps you signed in | 30 days |
| __Host-fr_verify | Ties a sign-in link to the browser that asked for it | 24 hours |
| __Host-fr_oauth | Ties a Google or Microsoft sign-in to your browser | 10 minutes |
| __Host-fr_connect | Ties an AI assistant's request to connect to the browser that opened it | 10 minutes |
| __Host-fr_last_signin | Marks how you last signed in, without your address | 12 months |
| fr_handoff | Carries your analytics choice and a Refer a Friend code across fullreach.ai and its subdomains, such as app.fullreach.ai. With analytics allowed, it also carries where you first came from. Your browser also sends it to docs.fullreach.ai, which Mintlify hosts for our manual, and, once you allow analytics, to PostHog at e.fullreach.ai. | 13 months |
Your browser also stores these items:
- Your setup draft, which includes your email address.
- The project you last opened.
- A dashboard link from an email, while you sign in. After 24 hours, it opens nothing.
- Your display choices, such as sidebar sections and hidden report sections.
- The snapshot you started a trial from.
- How many rows of each log file you uploaded.
They stay in your browser until you clear the site's data.
All of this is strictly necessary for the service you ask for, so it needs no consent.
If you allow analytics, Google Analytics sets two more cookies:
| Cookie | Purpose | Lifetime |
|---|---|---|
| _ga | Tells one browser from another | 13 months |
| _ga_Z6P1RSRH81 | Keeps track of the current visit | 13 months |
If you allow analytics, PostHog also keeps an identifier and the current session in your browser storage while you use the setup or the dashboard. We delete them when you withdraw your consent.
Until you allow it, your browser does not contact Google Analytics or PostHog. Change your choice at any time with . The same control is at the foot of every public page and every setup step. In the dashboard, it is under Settings, Organization. There are no advertising cookies and no cross-site trackers. Mintlify can set its own cookies on docs.fullreach.ai.
Deletion
An admin can delete the organization in Settings. The dashboard then closes for every member at once. We keep the data for 90 days, in case you change your mind, and then delete it for good. When an admin removes a member, we delete that member's account at once.
These records stay longer:
- Invoices and accounting records, for 10 years, and the Stripe customer record that holds them.
- Facts from public web pages, such as a robots.txt file or the names on a page. Every customer who measures that page uses them.
- Technical logs, until their 30 days end.
We do not delete an ended trial automatically, so that you can subscribe later. Delete the organization, or ask us to delete it.
Your rights
You can ask for access, correction, deletion, restriction or a portable copy of your data. You can object at any time to processing based on legitimate interest, and always to direct marketing. Write to privacy@fullreach.ai. We answer within one month and can ask you to prove your identity. We pass requests about data that a customer entered to that customer.
Each digest, alert and summary email has an unsubscribe link. Account email, such as sign-in links and billing notices, has none, because the service depends on it.
You can complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt), or to the authority where you live or work.
Security
We encrypt all traffic, limit access to the people who need it, and store API keys and connection tokens only as hashes. We encrypt the Cloudflare token that an admin gives us. Sign-in needs control of your inbox, so there is no password to steal. If a breach puts your data at high risk, we tell you without undue delay.
Changes to this notice
We date each version of this notice. We email admins before a material change takes effect.