Privacy Policy.

1. Who we are

This policy is issued by Namaa Al Mostaqbal Information Technology ("Reach More," "we," or the "Company") in its capacity as the operator of the platform and the provider of the services described below.

Company details:

• Name: Namaa Al Mostaqbal Information Technology
• Commercial License Number: 1369140
• Commercial Register Number: 2328416
• Dubai Chamber of Commerce Membership Number: 539683
• Tax Registration Number: 104431019900003
• Unified email for support and privacy: support@reachmore.ai

2. Scope of the policy

2.1 This policy applies to:

• Reach More customers (the "Customer" / the "Company") and their authorized users who use the platform.
• End users (the Customer's customers) whose data may be processed when they interact with the Customer through connected channels, to the extent necessary to provide the service.

3. Definitions

• Personal Data: any information that identifies a natural person or makes them identifiable.
• Sensitive / Financial Data: data that the law requires to be treated with a higher level of protection, such as financial data and payment card data.
• Connected Platforms / Channels: any third party that the Customer connects to Reach More services, such as messaging and social communication platforms (e.g., WhatsApp Business, Instagram, Facebook Messenger, and others), and payment providers.
• Data Controller: the person or entity that determines the purposes and means of processing personal data.
• Processor: the person or entity that processes data on behalf of the Controller and according to its instructions.

4. Data we collect from the Customer

4.1 Categories of data

We may collect the following data upon registration or use of the platform:

• Contact data: name, email address, phone number, username, job role.
• Business data: business name, sector, address, identifying information about the activity.
• Billing data (non-sensitive): billing address, name of the billed party, tax registration (if any), payment record, transaction reference or invoice identifier.

Important notice: we do not store card data or CVV within our systems. Card data is processed and stored at the approved payment gateway provider. We may only receive transaction identifiers (Tokens) or limited verification data.

• Usage and technical data: IP address, device and browser type, operating system, logs, in-system interactions, and performance indicators.
• Support and correspondence data: the content of support requests, tickets, and the attachments provided to us.

4.2 Sources of data

• Directly from you via the website, the platform, or support channels.
• Automatically through technical logs and cookies or measurement tools when used.
• Through integrations you activate with third parties (payment provider, messaging channels, and others).

5. How we use the Customer's data

We use your data for the following purposes:

• Creating and managing the account and providing the services.
• Operating the subscription, billing, collection, and issuing invoices.
• Operating the integrations you activate and enabling the related features.
• Improving the product, the user experience, and internal analytics.
• Communicating with you regarding service updates, alerts, and support.
• Preventing fraud and ensuring the security of the platform and compliance with regulatory requirements.

6. End-user data (the Customer's customers)

6.1 When do we process customers' data?

We process the Customer's end-user data when integrations with connected platforms or channels are activated, or when Reach More is used to communicate with end users or to carry out operations related to the order or support.

6.2 Categories of customer data we may process

Depending on the integrations the Customer activates, these may include:

• Name, phone number, email (if available), shipping address, city, country.
• Order details: order number, products, quantities, status, shipping information.
• Support or messaging conversation data (text or media), in accordance with what the channel provider's policies and the Customer's settings allow.

6.3 Basis of processing

The Customer is the Controller of this data, and Reach More acts as a Processor on its behalf and according to its instructions. The Customer is responsible for obtaining the necessary consents from end users in accordance with the law applicable to it.

7. Mobile apps (iOS and Android)

This section applies to the ReachMore app on the Apple App Store and Google Play (app identifier ai.reachmore.app) and to the Customer's authorized users who sign in to it to manage conversations, contacts, leads, reservations, and notifications.

The apps are a companion to the web platform at app.reachmore.ai. They are intended for business use by the Customer's team, not for the Customer's end users (the Customer's customers), who interact with the Customer through messaging channels such as WhatsApp, Instagram, and Facebook Messenger. The rest of this policy applies to the apps in full; this section adds the app-specific details.

7.1 Data the apps collect

Account and sign-in data

• Email and password when you sign in with email, or your name, email address, and Google account identifier when you sign in with Google.
• Session tokens issued by Firebase Authentication and our backend. They are stored in the platform's secure storage (iOS Keychain, Android encrypted preferences) and removed when you sign out.
• Profile details you edit in the app, such as your display name and profile photo.

Conversation content

• Messages, photos, voice notes, videos, documents, and location pins exchanged between the Customer and its end users through connected channels, together with notes, labels, and assignment you add to a conversation.
• This content belongs to the Customer. Reach More processes it as a Processor on the Customer's behalf, as described in sections 6 and 10. The apps display and send it; they do not use it for any purpose of our own.
• Media you capture or select is uploaded to the Customer's workspace storage so it can be delivered to the end user. It is not stored anywhere else on your device by the apps.

Device and diagnostic data

• Crash reports (device model, operating system version, app version, stack traces, and the state of the app at the time of the crash), collected through Firebase Crashlytics and linked to your user ID and workspace ID so we can reproduce the problem.
• Push notification token for your device, stored on your user record so the Customer's workspace can notify you.
• Network data such as your IP address and request logs, generated when the app talks to our servers.

Usage analytics

• We record product-usage events through Firebase Analytics, for example that the app was opened, a conversation was opened, a message of a given type was sent, or a filter was changed. Events carry your user ID and workspace ID and do not contain message content.
• We use these events to understand which features are used and to improve the apps. We do not use them for advertising.
• The apps do not request the advertising identifier (IDFA / Advertising ID) and do not perform cross-app tracking.

7.2 Device permissions

Each permission is requested only when you first use the feature that needs it. You can grant or revoke any of them at any time in your device settings; the rest of the app keeps working.

• Camera: to take photos you send to an end user in a conversation.
• Microphone: to record voice notes you send in a conversation.
• Photos and files: selected through the system picker, which shares only the items you choose. The apps do not read your photo library or file system beyond that selection.
• Notifications: to alert you about new messages, escalations, assignments, and other workspace events. See 7.3.
• Calendar (iOS, write-only): to add a reservation to your calendar when you ask the app to. The app cannot read existing calendar events.

The apps do not request access to your location, contacts, or Bluetooth. Location pins you see in a conversation were shared by the end user through the messaging channel.

7.3 Push notifications

• Notifications are delivered through Apple Push Notification service and Firebase Cloud Messaging. Delivering them requires sharing a device token with those services.
• A notification may include the name of the end user, the channel, and a short preview of the message, so it can reveal conversation content on your lock screen. Use your device settings to hide previews if that is a concern.
• Signing out removes your device token from your user record. You can also disable notifications for the app in your device settings.

7.4 Third-party services and SDKs

The apps include the following third-party software. Each provider processes data only to the extent needed to deliver its service.

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Messaging, Analytics, Crashlytics): sign-in, data sync, media storage, push delivery, usage analytics, and crash reporting. Google processes this data under its data-processing terms.
• Google Sign-In: only if you choose to sign in with your Google account.
• Apple Push Notification service (iOS) and Google Play services (Android): push delivery.

The apps do not contain advertising SDKs. Data sharing with messaging channels, payment providers, and infrastructure providers is described in section 8; cross-border transfers in section 13.

7.5 Retention

• Account, workspace, and conversation data: retained as described in section 9.
• Crash reports and analytics events: retained on Firebase for a limited period (crash data 90 days; analytics data up to 14 months), then deleted or aggregated.
• Data on your device: the session, a cache of recent conversations, and any unsent messages in the outbox. They are removed when you sign out or uninstall the app.

7.6 Your choices and account deletion

• Sign out at any time from the app's settings. This clears the session and your device's push token.
• Permissions and notifications can be changed in your device settings at any time.
• Account deletion: your user account belongs to the Customer's workspace. Ask your workspace administrator to remove you, or email support@reachmore.ai from the address on the account. We action deletion requests within 30 days unless a regulatory obligation requires us to retain some data.
• Access, correction, and other requests follow the mechanism in section 14. We may verify your identity before acting on a sensitive request.

7.7 App security

• All traffic between the apps and our servers is encrypted in transit (TLS), and data is encrypted at rest on our cloud infrastructure.
• Session credentials are stored in the platform's secure storage (iOS Keychain, Android encrypted preferences), never in plain files.
• Sign-in is rate-limited, and sessions are revoked when a user is deactivated by the workspace administrator.

The general security controls in section 12 apply to the apps as well.

8. Data sharing and disclosure

We do not sell or trade in personal data. We may share data only in the following cases:

• With the platforms or channels the Customer connects to carry out the integration operations it has requested.
• With payment providers to process payments and subscriptions, where we usually only receive transaction identifiers.
• With hosting, infrastructure, and security providers to operate the platform under agreements that ensure confidentiality and appropriate security controls.
• For regulatory compliance or to protect rights, including fraud prevention or responding to requests from competent authorities.

9. Storage, retention, and deletion

9.1 PII data related to marketplace and order integrations (Reach More)

• Data is stored in a cloud infrastructure with encryption in transit (TLS) and at rest (Encryption at Rest).
• We retain data for the period necessary to provide the service, complete shipping, resolve operational disputes, and comply with regulatory obligations, if any.
• Automatic deletion: PII data is automatically deleted within 30 days unless there is a regulatory obligation to retain it.
• The Customer has the right to request the deletion of their data, and the request is implemented within 30 days unless there is a regulatory impediment.

9.2 Reach More conversation data

• During an active subscription: we may retain conversation logs and their metadata to operate the service, support, and analytics.
• After the subscription ends: we retain conversations for 90 days, after which they are scheduled for automatic deletion, unless there is a longer regulatory obligation.

10. Privacy roles (Controller / Processor)

• For Customer data: Reach More is generally a Controller to the extent necessary to manage the subscription and account relationship.
• For end-user data (the Customer's customers): the Customer is the Controller, and Reach More is a Processor on its behalf and according to its instructions.

11. Regulatory or contractual bases for processing

We process data based on one or more of the following bases:

• Performance of the contract and provision of the service.
• Compliance with a regulatory obligation.
• Legitimate interests, such as platform security, fraud prevention, and product improvement.
• Consent where required, such as certain marketing communications or messaging-platform requirements.

12. Information security

We apply security controls including, by way of example:

• Role-based access control (RBAC) and the principle of least privilege.
• Multi-factor authentication (MFA) for administrative or sensitive access.
• Periodic security reviews and penetration tests.
• Monitoring of suspicious activities and alerting on them.
• Logging and reviewing access and changes.
• Protecting integration secrets (API credentials) via a secrets manager.
• Code scanning before releases.

Notice: absolute 100% security cannot be guaranteed, but we are committed to applying reasonable measures, regulatorily and technically, to reduce risks.

13. Cross-border data transfers

The nature of the operation may require the use of global providers for hosting, security, or analytics, which may result in data being processed or stored in different countries, with appropriate security and contractual controls applied and in compliance with the relevant regulations as far as possible.

14. Mechanism for submitting requests

Via email: support@reachmore.ai

We may request verification of your identity before executing sensitive requests to protect your data.

15. Security incidents and reporting

Notification of authorities or individuals.

Where the requirements of data protection regulations apply, we may notify the competent authority or affected persons without undue delay if there is a high risk to their rights or interests.

16. Cookies and analytics

We may use cookies or measurement tools to improve the experience and analyze performance. You can control cookie settings from your browser, and disabling them may affect some platform functions.

17. Children's and minors' data

The Reach More platform is intended for use by businesses and entities, and is not directly aimed at children. The Customer bears full responsibility for ensuring that children's data is not processed via the platform in accordance with the applicable laws.

The ReachMore apps are business tools for the Customer's team and are not directed at children. We do not knowingly collect personal data from anyone under 18 through the apps.

19. Policy updates

We modify this policy from time to time to reflect changes in our services, legal requirements, or best practices. The modification becomes effective upon publication, with an update of the "Last updated" date at the top of the policy. Material changes that affect the ReachMore apps will also be announced in the apps.

Reach More keeps a record of previous versions of the policy. Your continued use of the services after the modification takes effect constitutes acceptance of the updated version.