Privacy Policy for FullReach

1. Introduction

Welcome to FullReach ("we," "us," or "our"). Your privacy is important to us, and we are committed to protecting the personal data we collect and process.

2. Scope of This Policy

This policy covers personal data we process about our account holders and website visitors — primarily the people who sign up for and use FullReach.

3. Personal Data We Process

We deliberately keep this minimal. As an account holder or visitor, we process:

• Your email address, collected when you create an account or sign in.
• Basic authentication and profile information received from your chosen sign-in provider (Google or Microsoft) — typically your email address and the fact that authentication succeeded.
• Technical and usage data that may be generated automatically when you use the Service or visit the website (such as IP address, browser type, and basic log data), where applicable. See Section 8 on cookies and tracking.

We do not intentionally collect special categories of data (such as health, political, or biometric data) about our account holders.

4. How We Collect Your Data

We collect your email address and profile information through third-party authentication providers:

• Sign in with Google — handled through Google's OAuth services.
• Sign in with Microsoft — handled through Microsoft's OAuth services.

When you authenticate, these providers share limited account information (primarily your email address) with us in accordance with their own privacy policies.

5. Why We Process Your Data and Legal Basis

We process your personal data for the following purposes:

Under the Swiss Federal Act on Data Protection (FADP), we process your data on equivalent justifications, including contract performance, your consent where required, and our legitimate interests.

6. How We Share Your Data

We do not sell your personal data. We share it only as needed and with appropriate safeguards:

• Service providers / sub-processors: Trusted third parties who help us operate the Service — including hosting, infrastructure, and authentication providers (such as Supabase, and the Google and Microsoft sign-in services) — bound by confidentiality and data protection obligations.
• Legal and regulatory requirements: Where required by applicable law, regulation, legal process, or a legitimate governmental request.
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, where your data may be transferred as part of the transaction.
• Protection of rights: To protect the rights, property, or safety of Voice AI Agent GmbH, our users, or others.

7. International Data Transfers

We are based in Switzerland. Some of our service providers may process data in other countries, including within the EU/EEA and potentially elsewhere. Where we transfer personal data outside Switzerland or the EU/EEA to a country without an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the Swiss addendum where applicable) or an applicable adequacy decision.

8. Cookies and Tracking

We do not use third-party analytics, advertising cookies, or tracking pixels.

We use cookies only to remember your software preferences (such as your dashboard layout). These contain no personal data and expire after a short period.

We also maintain your authentication session so that you remain signed in across visits.

9. Data Retention

We retain your email address and account data for as long as your account is active or as needed to provide the Service. When you close your account or request deletion, we delete or anonymize your personal data unless we are required or permitted to retain it for legal, accounting, security, or legitimate business purposes.

10. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data
• Object to or request restriction of certain processing
• Withdraw consent at any time, where processing is based on consent
• Receive your data in a portable, machine-readable format
• Lodge a complaint with a supervisory authority

For Swiss residents, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC). For EU/EEA residents, you may contact your local data protection authority.

To exercise any of these rights, email us at branko@voiceaiagent.ai. We will respond within the timeframes required by applicable law.

11. Contact

12. Data Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Third-Party Authentication Services

Authentication relies on Google and Microsoft, and your use of these sign-in methods is also governed by their respective policies:

• Google Privacy Policy: https://policies.google.com/privacy
• Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement

14. Children's Privacy

The Service is a B2B product intended for business users and is not directed to children. We do not knowingly collect personal data from anyone under 16. If we learn that we have done so, we will delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last Updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.