Privacy Policy

Reach – Messaging & Connectivity

Effective Date: 21 October 2026

Last Updated: 21 October 2026

Operated by: REACH TECHNOLOGIES (PTY) LTD

Country: South Africa

Website: https://reach.co.za/

Privacy Contact: info@reach.co.za

1. Introduction

Welcome to Reach.

Reach ("Reach", "we", "us", or "our") is a communication and connectivity application operated by REACH TECHNOLOGIES (PTY) LTD ("the Company").

Reach enables users to communicate through private messaging, group conversations, voice and video calls, share media and locations, manage contacts, and access connectivity services, including data bundles, vouchers, and digital wallet functionality.

We respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains what information we collect, how we use and protect it, when it may be shared, how long it is retained, and the rights you have regarding your personal information.

Want to delete your account or personal information? Request to delete my data.

We process personal information in accordance with applicable data protection legislation, including South Africa's Protection of Personal Information Act, 2013 ("POPIA").

By using Reach, you acknowledge the information provided in this Privacy Policy. Where consent is required by law, we will request it separately.

2. Information We Collect

We collect and process certain information necessary to provide, maintain, and secure Reach's services.

2.1 Account Information

When you register, authenticate, or use Reach, we may collect and process:

• Phone number
• Display name or username
• Unique account identifiers
• Authentication information
• Device registration information
• Account preferences and settings

This information is used to authenticate users, manage accounts, facilitate communication, and provide access to Reach's services.

Reach handles its own account authentication on its own servers in South Africa. Authentication information is handled using appropriate security measures.

2.2 Contact Information

Reach provides optional contact synchronisation functionality to help users identify and communicate with other Reach users.

When you enable contact synchronisation:

• Your contacts are saved locally on your phone. Phone numbers or phone-number hashes are sent to the Backspace server only to check which contacts use Reach.
• The matching service processes the submitted values against existing user records without saving the submitted contact list as a server-side address book.
• Contact matching results are returned to the application.
• The matching service does not retain the submitted list after processing the request. Matching results are saved locally on your phone.
• Reach does not sell uploaded contact information or use it for targeted advertising. Contact synchronisation is optional and requires the appropriate device permissions.

Contact retention: contacts and matching results remain on your phone until removed locally; there is no fixed automatic expiry. Submitted contact lists are processed for matching without being saved as address-book records. If a matching request fails with an exception, the backend error handler may retain its request body, including submitted phone numbers, in diagnostic records. Users may revoke contact permissions through their device settings.

Revoking permission prevents further access through that permission but does not necessarily remove information previously processed.

2.3 Messages and Communications

Reach provides end-to-end encrypted messaging for supported communications.

Messages are encrypted on the sender's device and are intended to be decrypted only by their authorised recipients.

Reach's servers facilitate the transmission and delivery of messages without requiring access to their unencrypted content.

Message Delivery and Queuing

Reach uses a message queue to support reliable delivery.

When a recipient is unavailable, encrypted messages may be temporarily retained in the delivery queue until delivery can be completed.

The message delivery infrastructure may process:

• Sender identifiers
• Recipient identifiers
• Message identifiers
• Delivery status
• Message timestamps
• Encrypted message payloads

Queued messages are managed according to our message retention and delivery procedures.

Encrypted messages remain queued until the recipient confirms that they have been saved locally, or the queue entry is otherwise removed. Undelivered queued messages do not currently have a fixed automatic expiry period.

After the recipient confirms durable local storage, the queued encrypted message is deleted. For group messages, the encrypted message is deleted when no recipient deliveries remain outstanding. Minimal delivery and read receipts are retained separately to support reliable delivery and prevent duplicate messages. Eligible receipt records are cleaned up after 90 days; unacknowledged direct-message receipts may be retained longer until acknowledged. Reach does not use private message content for advertising or marketing.

2.4 Photos, Videos, Voice Notes and Files

Reach allows users to exchange photos, videos, voice notes and other files.

Shared media is encrypted on the sender's device and temporarily stored on Reach's servers to facilitate delivery. After the recipient confirms that the file has been saved locally, deletion is scheduled with a one-hour grace period. For group media, deletion is scheduled after the final outstanding recipient acknowledges delivery or is removed from the delivery queue. Cleanup runs periodically and retries failed deletions.

Abandoned uploads expire after 24 hours. Completed uploads that are never queued for delivery expire after 30 days. Media associated with queued messages remains available until delivery or another explicit removal of the queue entry.

Media may remain stored locally on the sender's or recipient's device, depending on the user's actions and device settings.

Reach does not maintain a permanent server-side library of users' shared media.

Recipients may independently save, copy, forward or otherwise retain received content.

Deleting content from your device does not necessarily remove copies held by other participants.

2.5 Voice and Video Calls

Reach provides voice and video calling functionality. To establish and maintain calls, Reach may process:

• Participant identifiers
• Call signalling information
• Connection information
• Call initiation and termination events
• Network information required to establish connections

Voice and video communications are transmitted through the application's calling infrastructure.

Reach does not record or store the audio or video content of calls on its servers.

Call connection metadata may be processed for operational, security, and troubleshooting purposes.

Call history is saved locally on your phone without a fixed automatic expiry. Deleting the associated conversation removes its local call-history entries. The calling backend relays call signalling without maintaining a persistent call-history table. Notification providers and operational logs may separately process call-related technical information.

2.6 Location Information

Reach provides optional location-sharing functionality, including live location sharing. When users explicitly choose to share their location, Reach may access:

• Precise geographic coordinates
• Location updates
• Information necessary to support live location sharing

Location information is forwarded between the intended participants through Reach's encrypted messaging infrastructure. Where a recipient is unavailable, encrypted location information may be temporarily queued to facilitate delivery.

Reach does not maintain a server-side history of live location movements or retain encrypted location information in system logs.

Location sharing is optional and requires the relevant device permissions.

Users can stop sharing their live location through the application's location-

sharing controls.

Location information intentionally included in messages may be processed through the message delivery system.

Reach uses Google Maps to support its location-sharing functionality. Google may process information in accordance with its own Privacy Policy, available at https://policies.google.com/privacy.

Reach does not use location information for targeted advertising.

2.7 Wallet and Transaction Information

Reach provides digital wallet functionality and connectivity-related transactions. Depending on the services used, we may process:

• Wallet balances
• Voucher redemption information
• Transaction identifiers
• Transaction amounts
• Data bundle purchases
• Transaction timestamps
• Transaction status
• Account identifiers associated with transactions This information is used to:
• Maintain accurate wallet balances
• Process voucher redemptions
• Facilitate data purchases
• Maintain transaction records
• Investigate transaction disputes
• Prevent fraud and unauthorised transactions
• Comply with applicable financial and legal obligations

Transaction records may be retained where required for accounting, auditing, fraud prevention, or regulatory compliance.

Wallet and voucher transaction records are stored without a fixed automatic expiry. Their retention remains subject to the accounting, auditing, fraud-prevention and legal purposes described above.

Payment processing provider, if applicable: EasyLoad and 1Voucher for the voucher top-up options available in the app

If additional payment methods are introduced, this Privacy Policy may be updated to explain how payment information is processed.

2.8 Network and Connectivity Information

Reach provides features relating to network connectivity and data services. When users access these features, we may process:

• Network connection status
• Data bundle balances
• Data usage information
• Service activation status
• Connectivity-related account information
• Technical information required to provide network services

This information is used to provide connectivity services, maintain account balances, and troubleshoot service issues.

Connectivity purchase records are stored without a fixed automatic expiry. Retention of underlying network usage records held by connectivity providers depends on their operational settings and applicable requirements; a fixed period cannot be established from the app and backend code alone.

2.9 Device and Technical Information

To maintain the reliability and security of Reach, we may process certain technical information, including:

• Device identifiers
• Operating system and version
• Application version
• Device registration information
• Connection information
• Authentication events
• Error logs
• Diagnostic information

We use this information to maintain service functionality, troubleshoot technical issues, detect security threats, and prevent unauthorised access.

The app uses local diagnostic logging, and the backend stores operational error records. The Backspace backend also includes Sentry error reporting, which may receive diagnostic details where enabled.

Stored backend error records have no fixed automatic expiry. Retention of runtime logs and any third-party diagnostic reports depends on deployment and provider settings; those periods are not specified in the app and backend code.

3. How We Use Personal Information

Reach processes personal information for the following purposes:

• Creating and managing user accounts.
• Authenticating users and maintaining secure sessions.
• Delivering private and group messages.
• Facilitating voice and video calls.
• Enabling contact discovery and synchronisation.
• Supporting optional location sharing.
• Processing wallet transactions and voucher redemptions.
• Providing data bundles and connectivity services.
• Maintaining application performance and reliability.
• Detecting and preventing fraud, abuse, and unauthorised access.
• Providing customer support.
• Complying with applicable legal and regulatory requirements. We do not sell personal information to advertisers or data brokers.

We do not use private message content for targeted advertising.

4. Legal Basis for Processing

Reach processes personal information lawfully and only where there is a valid justification for doing so under Section 11 of the Protection of Personal Information Act, 2013 (POPIA).

Depending on the nature and purpose of the processing, we rely on one or more of the following grounds:

4.1 Consent

Where users have provided consent for specific processing activities, including optional access to contacts and location information. Where personal information relating to a child is processed and consent is required, we will obtain prior consent from a competent person, such as a parent or legal guardian, in accordance with POPIA.

4.2 Contractual Necessity

Where processing is necessary to establish or fulfil our contractual obligations to users, including account registration, authentication, messaging, calling services and connectivity-related transactions.

4.3 Legal Obligations

Where processing is necessary to comply with obligations imposed by applicable law, including financial recordkeeping, regulatory requirements and lawful requests from authorised authorities.

4.4 Protection of Users' Legitimate Interests

Where processing is necessary to protect the legitimate interests of users, including protecting their accounts, preventing unauthorised access and maintaining the security of their personal information.

4.5 Legitimate Interests of Reach or Third Parties

Where processing is necessary for the legitimate interests of Reach or an authorised third party, including fraud prevention, service security, troubleshooting and maintaining the reliability of the application, provided such processing is lawful, reasonable and does not unjustifiably infringe users' privacy rights.

4.6 Withdrawal of Consent and Objections

Where processing is based on consent, users or their authorised parent or legal guardian may withdraw that consent at any time, subject to applicable legal requirements. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal or processing justified under another applicable lawful ground. Users may also object to processing based on legitimate interests on reasonable grounds relating to their particular circumstances, subject to POPIA and applicable legal exceptions.

5. End-to-End Encryption and Communication Security

Reach uses end-to-end encryption to protect supported private communications.

Messages are encrypted on the sender's device and can only be decrypted by their intended

recipients.

Reach's servers facilitate the secure transmission and delivery of messages without requiring access to their unencrypted content.

Encrypted messages may be temporarily queued to support delivery when recipients are offline.

While message content is protected through end-to-end encryption, certain information necessary to operate the service, such as account identifiers, message delivery status, and connection metadata, may be processed by Reach.

We implement industry-standard security measures designed to protect communications and personal information.

End-to-end encryption does not prevent recipients from saving, copying, forwarding, or sharing received communications.

Users should protect their devices, authentication credentials, and account access.

6. Data Storage

Reach uses both local device storage and backend infrastructure.

6.1 Local Device Storage

Reach stores certain information locally on users' devices, which may include:

• Conversation history
• Contacts
• Account preferences
• Authentication information
• Encryption keys
• Received media
• Other application data

Sensitive local information is protected using appropriate device security mechanisms. Users should maintain appropriate device security settings.

6.2 Server-Side Storage

Reach's backend infrastructure stores or processes information necessary to operate its services.

This may include:

• Account records
• Authentication information
• Device registrations
• Encrypted queued messages
• Wallet and transaction records
• Connectivity-related information
• Operational logs

Reach temporarily stores encrypted user-shared media to facilitate delivery. Reach does not record or store call audio or video.

Temporary information is removed according to the applicable processing and retention procedures.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

Different categories of information may have different retention periods.

When information is no longer required, we take reasonable steps to delete, anonymise, or otherwise securely dispose of it.

Certain information may be retained where required for legal compliance, dispute resolution, fraud prevention, or security purposes.

8. Sharing of Personal Information

We do not sell users' personal information.

We may disclose or process information in the following circumstances.

8.1 Other Reach Users

Information that users intentionally share through Reach is made available to the intended recipients.

This may include:

• Display names
• Messages
• Photos and videos
• Voice notes
• Files
• Shared locations
• Other voluntarily shared information

Recipients may retain information independently of Reach.

8.2 Service Providers

Reach operates its own servers in South Africa and handles its own account authentication. We use third-party service providers for features including:

• Push notifications
• Technical monitoring
• Payment processing, where applicable

Service providers are permitted to process personal information only for authorised purposes and subject to applicable data protection obligations.

Service providers include Google (Firebase Cloud Messaging, Google Maps and optional Google Drive backups), Apple (push notifications and optional iCloud backups), and EasyLoad and 1Voucher for voucher top-ups. The features you use determine which providers process your information.

8.3 Legal Requirements

We may disclose personal information where required or permitted by applicable law, including in response to a valid court order, subpoena, lawful regulatory request or other legally authorised process.

Before disclosing personal information, Reach will take reasonable steps to verify the identity and authority of the requesting party, establish the lawful basis for the disclosure and ensure that only information necessary and relevant to the lawful purpose is shared.

Where disclosure is necessary to investigate fraud, prevent unauthorised activity, protect users or maintain the security of our services, Reach will only disclose personal information where there is an appropriate lawful basis under POPIA or other applicable legislation.

Reach will maintain appropriate records of such disclosures, including the reason for disclosure and the information shared, subject to applicable legal requirements.

We cannot provide plaintext copies of end-to-end encrypted messages where we do not possess the technical ability to decrypt them.

9. Device Permissions

Reach may request permission to access certain device features.

Permissions are requested through the operating system where required.

Users can manage or revoke permissions through their device settings. Disabling permissions may limit certain application features.

10. Data Security

We implement reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

Our security measures include:

• End-to-end encryption for supported communications
• Secure authentication mechanisms
• Encrypted network communication
• Secure local storage mechanisms
• Backend access controls
• Security-related logging and monitoring
• Regular maintenance and security improvements

While we take reasonable precautions, no electronic system can guarantee absolute security.

Where Reach has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will take appropriate steps to investigate the incident, contain the compromise and mitigate any potential harm.

In accordance with Section 22 of POPIA, Reach will notify the Information Regulator and affected individuals as soon as reasonably possible, subject to applicable legal requirements and any permitted delays relating to investigations or remedial measures.

Such notifications will include the information required by applicable law, including details of the incident and recommended measures affected individuals may take to protect themselves, where applicable.

Users are encouraged to maintain strong device security and keep their applications updated.

11. Your Rights

Under applicable data protection legislation, including POPIA, users may have the right to:

• Request confirmation of whether we hold personal information about them.
• Request access to personal information held by Reach.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal information where legally permitted.
• Object to certain processing activities.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the appropriate regulatory authority. To exercise your rights, contact:

Email: info@reach.co.za

We may request reasonable verification of identity before processing certain requests. We will respond within the timeframes required by applicable law.

12. Account and Personal Data Deletion

Request to delete my data

You can ask REACH TECHNOLOGIES (PTY) LTD to delete your Reach account and associated personal information, or request deletion of specific personal information without closing your account.

Email info@reach.co.za to request deletion of your data, using the subject “Request to delete my Reach data”. You do not need to sign in to the app to make a request.

1. Include the phone number registered with your Reach account.
2. Tell us whether you want to delete your account and associated data, or only specific information. For a request concerning specific information, describe what you want deleted.
3. We may ask you to verify that you own the account before processing the request. Do not send passwords, PINs or one-time verification codes in your email.

We will review your request, confirm any verification needed and explain the scope of deletion and the expected processing timeframe. Requests will be handled within the timeframes required by applicable law. If deleting specific information prevents us from providing a feature, we will explain that consequence.

Following a valid deletion request, we will delete or anonymise eligible personal information associated with the account, subject to applicable legal and operational requirements.

Certain information may be retained where necessary for:

• Financial recordkeeping
• Fraud prevention
• Legal compliance
• Dispute resolution
• Security investigations

Messages and media already delivered to other users may remain on those users' devices.

Deleting a Reach account does not automatically delete information independently retained by other participants.

If information must be retained, we will explain the reason and the applicable retention period or the criteria used to determine it.

Data saved only on your phone, copies held by other people, and backups in your own Google Drive or iCloud account may need to be removed separately. Deleting the app alone does not submit an account or data deletion request.

13. Children's Privacy

Reach is a general communication application and is not specifically directed at children. However, users under the age of 18 may use Reach, subject to applicable legal requirements and appropriate safeguards.

As set out in the Terms & Conditions, users under 18 must have permission from a parent or legal guardian before registering or using Reach. Any minimum age or eligibility requirements imposed by applicable law or a particular service also apply.

Where required under the Protection of Personal Information Act, 2013 (POPIA), Reach will obtain prior consent from a competent person, ordinarily a parent or legal guardian, before processing a child's personal information.

Reach will take reasonable steps to verify that consent has been provided by a person legally authorised to act on behalf of the child and will maintain appropriate records of such consent.

Parents or legal guardians may withdraw their consent, request access to or correction of their child's personal information, or request its deletion, subject to applicable legal requirements.

Reach will take reasonable measures to protect children's personal information and will not knowingly process such information without the necessary legal authorisation.

If we become aware that a child's personal information has been collected or processed unlawfully, we will take appropriate corrective action, which may include restricting or deleting the relevant information.

Parents or guardians may contact us at:

info@reach.co.za

14. International Data Transfers

Reach hosts its own backend infrastructure in South Africa. Third-party services used by the app, including Firebase Cloud Messaging and Google Maps, may process information outside South Africa under their own service terms and privacy notices. If you enable optional Google Drive or iCloud backups, the backup provider handles the backup under its own terms and settings.

Where personal information is transferred internationally, we take appropriate steps to ensure that such transfers comply with applicable data protection legislation, including Section 72 of POPIA where relevant.

These measures may include appropriate contractual protections, legally recognised transfer mechanisms, or other safeguards permitted by law.

Primary hosting location: South Africa

Third-party processing locations depend on the service used and its provider. Reach's South African hosting does not mean that all third-party processing takes place in South Africa. See Firebase privacy information and Google's Privacy Policy.

15. Third-Party Services

Reach may integrate third-party services necessary for application functionality.

These services may process certain information according to their respective privacy policies and contractual arrangements.

Third-party services used by Reach include:

Account authentication: handled internally by REACH TECHNOLOGIES (PTY) LTD on its own servers.

Hosting: servers operated by REACH TECHNOLOGIES (PTY) LTD in South Africa.

Push notification providers: Google Firebase Cloud Messaging and Apple Push Notification service for supported devices.

Reach does not integrate a separate app analytics service. Firebase Analytics is not integrated. Firebase and Google services may automatically process technical and usage information needed to provide their features, as described in their privacy notices.

No separate crash-reporting service is integrated in the app; Firebase Crashlytics is not integrated.

Voucher top-up providers: EasyLoad and 1Voucher.

We encourage users to review the privacy policies of relevant third-party services where applicable.

16. Advertising and Tracking

Reach does not sell personal information to advertising networks or data brokers. Reach does not use private message content for targeted advertising.

Reach does not integrate third-party advertising networks or advertising SDKs.

Reach does not implement its own tracking across third-party apps or websites. Firebase Cloud Messaging and Google services may automatically collect identifiers and technical or usage information in connection with the features they provide. Firebase Cloud Messaging uses installation identifiers to route notifications. This processing is described in Firebase's privacy information and Google's Privacy Policy.

If our advertising or tracking practices change, we will update this Privacy Policy and obtain any permissions required by applicable law.

17. Cookies and Similar Technologies

Reach may use authentication tokens, local storage, and similar technologies to maintain application functionality and user sessions.

These technologies may be used to:

• Maintain authenticated sessions
• Store application preferences
• Support security features
• Improve service reliability

The Reach landing page does not set cookies or include analytics or advertising scripts. The homepage loads fonts from Google Fonts, which requires the browser to contact Google to retrieve font resources.

We do not use these technologies for cross-app advertising tracking unless expressly disclosed and permitted by applicable law.

18. Protection of Personal Information Act (POPIA)

Reach recognises the importance of protecting personal information under South Africa's Protection of Personal Information Act, 2013.

We aim to process personal information in accordance with POPIA's conditions for lawful processing, including:

• Accountability
• Processing limitation
• Purpose specification
• Further processing limitation
• Information quality
• Openness
• Security safeguards
• Data subject participation

The responsible party for the processing of personal information is:

Legal Entity: REACH TECHNOLOGIES (PTY) LTD

Registration Number: 2021/541030/07

Registered Address: 17 NEW CHURCH ST
CAPE TOWN - 8000
South Africa (ZA)

Information Officer: Claudio Coelho

Information Officer Contact: claudio@reach.co.za

Complaints

If you believe your personal information has been processed unlawfully, you may contact us to raise your concerns.

You may also lodge a complaint with the Information Regulator of South Africa.

Information Regulator website:

https://inforegulator.org.za/

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

• Application functionality
• Information processing practices
• Security measures
• Third-party integrations
• Legal or regulatory requirements

When this policy is updated, we will revise the "Last Updated" date.

Where required by applicable law, we will notify users of material changes and obtain any necessary consent.

The latest version of this Privacy Policy will be available at:

https://reach.co.za/privacy.html

20. Contact Information

For questions, concerns, or requests relating to this Privacy Policy or the processing of personal information, please contact:

Company: REACH TECHNOLOGIES (PTY) LTD

Application: Reach

Registered Address: 17 NEW CHURCH ST
CAPE TOWN - 8000
South Africa (ZA)

Country: South Africa

Privacy Email: info@reach.co.za Support Email: info@reach.co.za Website: https://reach.co.za/

Privacy Policy URL: https://reach.co.za/privacy.html