Effective 27 October 2026
Data processing agreement
This agreement is part of the terms of service between Capaxe labs LLP (“Raechly”) and the customer organization (“you”). It applies whenever Raechly processes personal data for you under the GDPR, the UK GDPR or similar laws. You don’t need to sign anything: it applies from the moment you use Raechly. If you need a countersigned copy, write to support@raechly.com.
1. Roles
- You are the controller of your prospect data: the contacts you import or ask Raechly to find, the emails sent to them and the replies they send. Raechly is your processor for that data.
- Raechly is a controller, not your processor, for your account data (sign-in, billing and usage), for its own contact database and for its shared record of which addresses bounce. The privacy policycovers those.
2. What is processed
| Purpose | Finding prospects, writing and sending cold email, capturing and classifying replies, and keeping your inbox and pipeline, as you direct. |
|---|---|
| People | Your prospects and contacts, people who reply to your emails, and your own team members who use Raechly. |
| Data | Name, work email, job title, company, location, LinkedIn URL and phone when provided, the emails sent, the replies received and their classification. |
| Special categories | None intended. Don’t upload them. |
| Duration | As long as you use Raechly, then until deletion under section 8. |
3. Your instructions
Raechly processes your prospect data only to run the service, following your instructions. Your instructions are these terms, your settings, and what you or your AI assistant ask for in the dashboard, the API or the MCP server. If we think an instruction breaks the law, we tell you and don’t act on it.
4. Your duties
You have a lawful basis for each person you email, you tell them what the law requires about how their data is used, and your instructions comply with the law. The acceptable use policy sets out the rest.
5. Security
Raechly protects your data with measures that include:
- Encryption in transit: the website, dashboard, API and MCP server are served over HTTPS only.
- App passwords for inboxes you connect are encrypted (AES-GCM) with a key kept outside the database, and never shown again.
- API keys are stored as hashes; the key itself is shown once, when it is created.
- Sign-in uses one-time codes sent by email, so there are no passwords to steal.
- Every request is scoped to one organization, and staff-only actions refuse organization keys.
- Bounce and complaint notifications are accepted only with a valid Amazon SNS signature.
- Nightly backups stored in a private bucket.
People at Raechly who can reach your data are bound to keep it confidential.
6. Subprocessors
You allow Raechly to use the subprocessors on the subprocessors page. Each one is bound by data protection terms no weaker than these. Before a new subprocessor starts handling your data, we update that page and email account owners. If you object for a reasonable data protection reason, tell us; if we can’t resolve it, you can cancel.
7. Transfers
Some subprocessors are outside the EEA and the UK. Where they are, the transfer relies on safeguards the law accepts, such as the European Commission’s Standard Contractual Clauses or the UK addendum to them.
8. Deletion
You can delete contacts from the dashboard at any time. When your account closes, we delete your prospect data, except where the law requires us to keep it. Data in backups is deleted as the backups are replaced. Opted-out and bounced addresses stay on a suppression list so they are never emailed again.
9. Requests, breaches and audits
- If someone asks Raechly about data we hold for you, we pass the request to you and help you answer it.
- One exception: when a person asks Raechly to forget them, we delete their address from every customer’s contacts, yours included, and keep it only on your blocklist so it is never emailed again. You instruct us to do this.
- We help with data protection impact assessments and regulator questions where they concern Raechly.
- If a personal data breach affects your data, we tell you without undue delay, with what we know and what we are doing about it.
- We answer reasonable questions about how we protect your data, so you can show you meet your own obligations.
10. If this conflicts with the terms
For processing of personal data, this agreement wins over the terms of service.