Privacy notice
Last updated 2026-11-02.
This notice explains what personal data ReachZone processes, why, for how long, and what your rights are under the EU General Data Protection Regulation (GDPR) and Spanish law (LOPDGDD).
Who is responsible
The controller is Mohamed Farag, self-employed (autónomo), Carrer de Floridablanca 68, Local 9F, 08015 Barcelona, Spain. Write to hello@reachzone.app for anything about your data. Full details are in the legal notice. We have not appointed a data protection officer, as the law does not require one for this activity.
In short
- This website sets no cookies and has no analytics, trackers, third-party fonts or third-party scripts.
- The free plugin runs on the shop's own website and sends nothing to us. Its admin maps load map images from our tile service.
- On paid plans the plugin sends us the addresses shoppers type, so we can find them on the map. For that data the shop decides, and we act only as its processor (see If you shop at a store that uses ReachZone).
- We never sell data, never use it for advertising and never build profiles.
What we process, and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Website visits: your IP address, the page, your browser type, handled by Cloudflare to deliver the site | delivering the website and protecting it from attacks | legitimate interest | we keep no logs of our own; Cloudflare processes this data for us under its terms |
| Map tile requests from the plugin's admin screens: the tile asked for, the browser's IP address and the referring page, handled by Cloudflare | showing the maps in the plugin's settings | legitimate interest | we keep no logs of tile requests |
| Emails you send to hello@ or support@, and our replies | answering you, and keeping a record | legitimate interest; for customers, the contract | 2 years after the last message; for customers, as long as the contract record below |
| Customer details (from Stripe): company name, contact email, billing address, country, tax ID, Stripe customer and subscription references, plan | providing the plan, refusing businesses in Spain, invoices | contract; legal obligation (invoices and tax) | while you are a customer; invoices and the tax evidence for them 6 years |
| Terms you accepted: the version, a fingerprint of its text, the time, and your confirmation that you buy as a business | proof of the contract | legitimate interest (legal claims) | 6 years after the contract ends |
| Trial without payment: company, contact email, country | the trial, and the rule of one trial per business | contract; legitimate interest (one trial) | 12 months after the trial ends; then only a scrambled form of the email, to stop repeat trials |
| Licence data: the licence key (stored only as a scrambled hash and its last 4 characters), the websites using it (stored only as a keyed hash of the web address), monthly usage counts | checking the licence and the plan's allowances | contract | while the licence is active, then 30 days |
| API server log: the IP address of the shop's server, the time, the request path and the answer code | security, and finding and fixing errors | legitimate interest | 14 days |
| Privacy requests: what you send and our answer | handling your request | legal obligation | 3 years, as proof of how we answered |
You need to give the customer details to buy a plan: we need them for the contract and tax law requires them on invoices. We make no decisions about you by automated means. We keep a nightly backup of our database for 7 days, on the same server and as an encrypted copy with Cloudflare in the EU, so data we delete is gone from the backups 7 days later. Invoices and credit notes are also kept in an encrypted monthly archive with Cloudflare in the EU, for the 6 years tax law requires; each archive is deleted after 7 years at the latest.
Payments
You pay on Stripe's page. Stripe Payments Europe, Ltd. (Ireland) takes the payment and issues the invoice for us. It acts for us as processor, and as its own controller for fraud prevention and its legal duties; see Stripe's privacy policy. We never see your card details. Stripe's pages set their own cookies, under Stripe's terms.
If you shop at a store that uses ReachZone
Shops use ReachZone to check whether they deliver to your address. On a shop with a paid plan, the plugin sends the address you type (and its country) to our service to find its position; on Business and Agency plans, if the shop turned on the unserved-demand map, positions outside its delivery area are sent to us rounded to about 100 metres, with the date. Your name, email address, IP address and order are never sent to us.
For this data the shop is the controller and decides why it is used; we act only on its instructions, as its processor, under our data processing terms. We keep a scrambled key of the address and the position found (not the address text) for 90 days, and the rounded demand positions for 180 days. To use your rights, ask the shop. If you write to us, we pass your request to the shop without undue delay and tell you who is responsible.
Who else handles data
- Hetzner Online GmbH (Germany; the server is in Helsinki, Finland): the server that runs our API and its database.
- Cloudflare, Inc. (USA): delivery and security of this website, the API and the map tile service, storage of the map tiles and of our encrypted backups (in the EU), and forwarding of emails sent to our addresses.
- Geoapify (KEPTAGO LTD, Cyprus, servers in the EU): receives the address text and country of a lookup, or the shop's position and travel time of a drive-time area, and returns a position or an area. Its request logs are kept for no more than 24 hours.
- Stripe: payments and invoices, as above.
- Google (Gmail): the mailbox behind our email addresses, under Google's own privacy policy.
Transfers outside the EU. Cloudflare, Inc., Google and Stripe's US group company receive data in the United States under the EU–US Data Privacy Framework, an adequacy decision of the European Commission; if that framework stops applying, the European Commission's standard contractual clauses apply. You can ask us for a copy of the safeguards.
Your rights
You can ask for access to your data, its correction or erasure, restriction of its use and a copy in a portable format, and you can object to processing based on legitimate interest. Write to hello@reachzone.app. Requests are free; if we have real doubt about who you are, we may ask for proof. We answer within one month (three months for a complex request; we tell you within the first month). You can also complain to the Spanish data protection authority, the AEPD.
Changes
We update this notice when what we do changes, and show the date at the top. Customers are told by email of changes that affect them.