RE8CH privacy notice

Updated 4 October 2026. This notice covers the RE8CH plugin, its OAuth connection, and RE8CH User Hub account services. The responsible operator is Reachieve LLC (RE8CH). Contact us at business@re8ch.com about privacy or your information.

Information processed and purposes

We process account identifiers, email address, profile information, authentication and session records, tenant memberships, and permissions to sign you in and enforce access. When you use a tool, we process the arguments needed for your request, the resulting service data, resource references, usage records, and operational or security audit events. Privacy requests include their type, status, timestamps, and correspondence; authorized staff also record fulfillment evidence.

We use this information to provide the services you request, maintain security and reliability, investigate misuse, and handle access, correction, export, and deletion requests. Please do not put passwords, private keys, or unrelated personal information into tool arguments. The plugin does not need your entire ChatGPT conversation to carry out a tool request.

Access and recipients

RE8CH applies authenticated tenant and role permissions. Authorized operators and infrastructure providers process information as needed to deliver and secure the service. Tool results are returned to the connected client, including OpenAI when you use ChatGPT. The client provider processes information under its own terms and privacy notice. An integration you choose may also process the information necessary for its operation.

RE8CH infrastructure includes services hosted outside the European Economic Area, including China. Reachieve LLC confirms that applicable contractual and international-transfer arrangements are in place for this processing. Contact business@re8ch.com for information about the safeguards applicable to your service and how to obtain a copy where available. This notice does not promise EU-only storage.

Retention

• Account and service information: retained while needed to provide your account and authorized services. Account deletion is a reviewed fulfillment process; submitting a request does not immediately erase the account or connected service data.
• Central operational logs: the current log store is configured for a 14-day retention period. This limit does not apply to separate database audit, usage, or billing records.
• Privacy-request and audit records: retained to handle requests and record their outcome. These database records currently have no automatic age-based purge. Contact us to request deletion or restriction; we assess any continuing security, legal, or accountability need.
• Database backups: the current database repository uses a count-based policy of two full backups and their dependent recovery data. This is not a fixed number of days. Older data may remain in recovery copies after live-data deletion; immediate deletion from every backup is not currently automated.

Where information must be retained to meet a legal obligation or establish, exercise, or defend legal claims, we assess that reason separately and explain applicable limitations when responding to your request. No universal GDPR retention deadline is implied by these settings.

Your choices and rights

You can disconnect the plugin in the connected client. Disconnecting stops that connection; it does not by itself delete your RE8CH account or information already held by the client.

Use User Hub to export the supported identity data and submit an export or deletion request, or email business@re8ch.com. The identity export is not a complete export of every connected product, billing system, or infrastructure service. Tell us which services your request concerns. Do not email passwords or access tokens; we may ask for proportionate identity verification.

Where applicable, you may request access, correction, erasure, restriction, portability, or object to processing, and may complain to your data protection supervisory authority. We will respond to rights requests without undue delay and, where GDPR applies, normally within one month; if a permitted extension is needed, we will explain it within that first month. This is a response commitment, not a claim that every deletion is automatically completed in 30 days.

Security and changes

We use authenticated connections, scoped authorization, and restricted administrative access. No service can guarantee absolute security. This notice describes current behavior rather than an independent compliance certification. We will update it when material processing or retention practices change.