Privacy policy

Last updated: 27 September 2026

1. Who we are

ReachBase (reachbase.nl) is operated by ReachBase, een handelsnaam van Milan Nuis (codedbymilan), registered with the Dutch Chamber of Commerce (KvK) under number 93727488, based in Groningen, Nederland. We are the controller for the data described in this policy. Privacy questions: hello@reachbase.nl.

Organizations that use ReachBase for their own campaigns are themselves responsible for the creator contacts they enter; ReachBase processes that data on their behalf.

2. What data we process

Organizers (Organizer Console)

• Account data: name, email address, password (hashed), organization and role.
• What you enter yourself: events, editions, campaigns, missions, assets, rewards and creator contacts (name, email, phone number, city, notes).

Creators (Creator Portal)

• Account data: name, email address, password (hashed), and phone number and city if an organization enters them.
• Payout details you enter yourself for cash rewards (account holder, IBAN, optionally business name, Chamber of Commerce and VAT number). Only organizations that owe you a payment can see these.
• Connected social accounts. If you connect Instagram or TikTok, we read with your permission: your profile (username, display name, profile picture, follower count, number of posts) and, for the posts you submit for a mission, the platform ID, the publication date and the metrics (views, reach, likes, comments, shares, saves, replies, average watch time). On Instagram we use the scopes instagram_business_basic and instagram_business_manage_insights; on TikTok user.info.basic, user.info.profile, user.info.stats and video.list. We never publish content on your behalf and we do not read messages or comments.
• Screenshots you upload as proof for content the platforms do not expose through their API (for example TikTok Stories).

Everyone

• Technical data needed to provide and secure the service: IP address, browser and time of requests (server logs, kept for at most 30 days).
• Emails we send (invitations, approvals, rewards) and whether they were delivered or opened, through our email provider.

3. Why we use the data

• To let organizations and creators work together: invitations, missions, deadlines, rewards and payment.
• To verify that a submitted post really belongs to your account and was published within the agreed window (verification).
• To measure and report campaign results to the organization you do the mission for, and to handle goals and rewards automatically.
• To help organizations choose creators, for example based on followers and earlier results with that organization.
• To secure the service and prevent abuse.

Legal bases: performance of the agreement (your account and the missions you accept), your consent for connecting social accounts (withdrawn by disconnecting) and our legitimate interest in a secure, working service.

4. Who we share data with

• With the organizations you do a mission for: your profile name, followers and the metrics of the posts you submitted to them. Other organizations do not see this data.
• With processors that run ReachBase, each under a data processing agreement: hosting and database (Vercel, EU region where possible), email (Resend) and file storage (Vercel Blob). They only process on our instructions.
• With Meta (Instagram) and TikTok: only the requests needed to fetch, with your consent, your profile and the metrics of your posts.
• Never with advertisers; we do not sell data.

5. Cookies

ReachBase only uses functional cookies: a session cookie to keep you signed in, a cookie with your theme preference (light/dark) and a temporary cookie (10 minutes) while connecting a social account. We use no tracking or advertising cookies and no third-party cookies.

6. Retention

• Instagram/TikTok access tokens are stored encrypted and deleted immediately when you disconnect or when the platform revokes access.
• Metrics of submitted posts are kept as part of the organization's campaign reporting, until you (through a deletion request) or the organization delete them.
• Accounts are deleted on request; backups within 30 days after that.
• Server logs: at most 30 days.

7. Your rights

You can access, correct, delete or export your data, restrict processing and object. Connected accounts you remove yourself in the Creator Portal under Accounts. To delete all platform data use Data deletion or email hello@reachbase.nl. We respond within 30 days. You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Security

Connections are encrypted (HTTPS), passwords are hashed, platform tokens are stored encrypted (AES-256) and access is limited to the organization the data belongs to.

9. Transfers outside the EU

Our processors may process data outside the EU (for example in the United States). This happens under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

10. Changes

We inform you of important changes through the app or by email. The current version is always at reachbase.nl/en/privacy.