Privacy Policy

Questions about this page can be sent to [email protected]. Requests involving an account should come from the account email when possible.

1. Scope and roles

StudioAnchor is a product operated by Sivants, LLC, a Florida limited liability company. This policy covers the StudioAnchor public website and StudioAnchor products that link to it, including Reach. When a customer organization submits or manages member, contact, campaign, or operational data, the customer generally decides why that data is processed and Sivants processes it to provide the service. Sivants may separately act as the party deciding how account, billing, security, and website data is used.

2. Data we handle

• Account and organization data: name, email, organization name, role, authentication identifiers, settings, and membership.
• Contact and audience data: contact names, email addresses, phone numbers, notes, status, tags, lists, recipient permissions, and campaign audiences supplied or managed by a workspace.
• Product and communication data: campaigns, templates, assets, sender settings, sequence state, inbound replies, delivery and engagement events, analytics, and other content a workspace user supplies.
• Billing data: subscription status, plan, invoices, transactions, and provider identifiers. Payment-card details are handled by the payment provider rather than this public site.
• Technical and security data: IP address, device and browser information, request metadata, timestamps, OAuth identity and token records, authentication and audit events, and diagnostics.
• Support data: correspondence and the information needed to investigate a request.

3. Reach MCP and connected-app data

When a user connects Reach through MCP or OAuth, Reach receives authorization details and tool requests needed to act for the selected workspace. Depending on the approved tool and user instruction, this may include workspace, contact, campaign, template, analytics, or sender information. Reach uses that data to authenticate the connection, return requested results, perform explicitly requested actions, apply plan and approval controls, prevent abuse, and troubleshoot failures. Reach does not treat a directory listing or assistant connection as an endorsement and does not bypass the workspace’s existing permissions.

4. Why we use data

• Provide, secure, maintain, and improve the requested service.
• Authenticate users, enforce organization boundaries, and administer connected applications.
• Process campaigns and other user-directed product actions.
• Manage billing, plan limits, and account support.
• Detect abuse, investigate incidents, comply with law, and protect rights and safety.
• Communicate operational, security, and account information.

5. Recipients and processors

Data may be shared with infrastructure, hosting, database, authentication, email-delivery, storage, payment, analytics, support, and security providers only as needed for their services; with customer-authorized connected applications; with professional advisers under confidentiality obligations; or with authorities and other parties when legally required or necessary to protect rights and safety. StudioAnchor does not sell customer member lists.

6. Retention

• Active account and product data: retained while the account is active and erased from active systems within 30 days after a verified account-deletion request or a termination that requires deletion.
• Disaster-recovery backups: expire within 90 days after active-system deletion.
• OAuth records: access tokens are retained until expiry or revocation; refresh tokens until rotation, expiry, revocation, or connection deletion. Revoked-token, security, and access records are retained for 12 months after revocation or creation unless an incident or legal obligation requires longer retention.
• Support and privacy correspondence: retained for three years after the request is closed.
• Billing and transaction records: retained for seven years after the transaction, or longer when tax law requires it.
• Consent, merge, and administrative audit history: retained for the account term and up to seven years afterward when needed to demonstrate authorization, consent, security, or dispute history. Personal fields are minimized or de-identified when no longer needed.

We may retain a narrowly limited record longer when required by law, to resolve a dispute, or to protect the service. Backup data is isolated from ordinary use and follows the stated expiry schedule.

7. Access, correction, export, and deletion

Workspace administrators can manage much of their data in the product. Requests for access, correction, export, restriction, objection, or deletion can be sent to [email protected]. Reach does not yet provide complete self-service organization deletion, so verified organization-deletion requests are fulfilled through an owner-operated process. We verify the requester’s authority, coordinate with the customer organization when it controls the data, and explain any legal or technical limitation. Disconnecting a connected application revokes its access but does not automatically erase records the user already asked Reach to create.

8. Security and international processing

We use access controls, HTTPS, managed infrastructure protections, and organization-scoped application checks. No system is perfectly secure. Providers may process data in jurisdictions different from the user’s location; applicable contractual and legal safeguards depend on the provider and customer arrangement.

9. Children, changes, and contact

The service is for organizations and authorized adult account holders, not children creating their own accounts. Customer organizations are responsible for permissions and notices when they process children’s data. We may update this policy and will change the date above; material changes may also be communicated in-product or by email.