Privacy Policy

1. Who We Are

PressReacher operates an AI-powered journalist database and PR outreach platform, helping PR professionals discover, connect with, and manage relationships with media contacts and industry journalists. Subscribers can also choose to connect an AI assistant (such as ChatGPT or Claude) to their PressReacher account through our MCP connector, as described in Sections 2, 5 and 6.

We are committed to responsible, transparent data practices. This privacy notice explains what data we collect, how we collect it, why we hold it, and what rights individuals have over that data.

ICO RegisteredData Protection Act & UK GDPR CompliantReg: ZC112021

2. What Information We Collect

Professional Contact Information (Journalist and Media Professionals)

We collect and organise publicly available professional information about journalists, editors, and media professionals, including:

• Work email addresses and professional phone numbers
• Job titles and current employer or publication
• Public professional social media profiles and handles
• Company press contact pages and staff directories
• Beat coverage areas and industry specialisms
• Recent published articles and bylines
• Speaking engagements and professional events

Platform Usage Data (Subscribers)

We collect data from individuals who register and use the PressReacher platform, including:

• Account registration details (name, email address, company)
• Authentication data and login records
• Search queries and platform interactions
• Access logs and usage analytics
• Communication and notification preferences
• Billing and payment information (processed by our payment provider)

AI Assistant Connections (MCP Connector)

If you connect an AI assistant to your PressReacher account using our Model Context Protocol (MCP) connector, we collect and hold:

• Connection and authorisation records, including the name of the connected app, when you authorised it, and the permissions it was given
• OAuth access tokens and refresh tokens issued to the connected app after you sign in and approve access
• Static API tokens that you create for use with an AI app or other client

We do not receive your conversation with the AI assistant. We only receive the requests the assistant sends to our connector and we return the results of those requests.

We do not keep a separate store of the content of those requests or of the results we return. When you use the connector to create a collection, campaign draft or media alert, that record is stored in your account in the same way as if you created it in the PressReacher app.

3. How We Collect Information

Automated Collection

We gather publicly available professional information through the following methods:

• Crawling publicly accessible news websites and publications to verify active journalist bylines and coverage areas
• Third-party data enrichment APIs that aggregate publicly available professional information
• Press release databases and industry publications
• Publicly accessible company websites and staff directories

We do not scrape data from platforms that restrict automated access, bypass login walls, or circumvent technical access controls. Where platforms offer official API access to public data, we use those APIs in accordance with their terms of service.

User-Submitted Information

We also collect information that users provide directly when:

• Registering for an account
• Configuring preferences and settings
• Submitting feedback or contacting support
• Connecting third-party email accounts via OAuth
• Authorising an AI assistant or other app to access your PressReacher account through the MCP connector

4. Legal Basis for Processing

Legitimate Interests (Article 6(1)(f) UK GDPR)

We rely on legitimate interests for:

• Organising publicly available professional information to facilitate legitimate business-to-journalist communications
• Verifying that professional contact information is accurate and up to date
• Providing email deliverability intelligence to platform subscribers
• Operating and improving the PressReacher platform
• Keeping the MCP connector secure, preventing misuse, and applying rate limits

We have assessed that these activities represent a proportionate use of professional data, given that the information relates to individuals in their professional capacity, is sourced from public channels, and supports a clear and legitimate business communication purpose. Individuals retain the right to object to this processing at any time.

Contract (Article 6(1)(b) UK GDPR)

We process subscriber account data as necessary to deliver the service under our Terms of Service, including account management, platform access, and billing. This includes processing needed to operate the MCP connector when you choose to connect an AI assistant, such as authorising the connection, issuing and validating tokens, and returning the results of your assistant's requests to you.

Consent (Article 6(1)(a) UK GDPR)

Where we send marketing communications, we do so on the basis of consent. You may withdraw consent at any time by contacting us or using the unsubscribe link in any marketing email.

5. How We Use Your Information

For Journalists and Media Professionals

• Organising professional contact information into a searchable database for use by PR professionals
• Categorising expertise, coverage areas, and publication affiliations
• Enabling targeted and relevant professional outreach
• Maintaining the accuracy of professional directory information
• Making professional directory information available to authorised subscribers through the PressReacher platform, including through an AI assistant that a subscriber has connected to their own account

For Platform Subscribers

• Account creation, authentication, and management
• Delivering platform features including search, campaign management, and coverage tracking
• Usage analytics and service improvement
• Customer support and service communications
• Operating the MCP connector so that you can use your PressReacher account from an AI assistant you have chosen to connect

Email Deliverability Scoring

Microsoft OAuth — Email Account Connection

AI Assistant Connector (MCP)

The PressReacher MCP connector lets you use your PressReacher account from an AI assistant that you choose to connect, such as ChatGPT, Claude or another assistant that supports MCP. The connector endpoint is https://pressreacher.com/api/mcp/. The connector is available on paid plans (Freelancer, Agency and Enterprise) and is not available on trial or free accounts.

How it works. You sign in with your PressReacher account and approve the connection. The connected assistant can then send requests to our connector. We process each request, apply the limits of your account and plan, and return the result to the assistant.

What the assistant can receive. Depending on the request and your plan, results returned to the connected assistant can include:

• Journalist and media professional records, including name, publication, beats, country, public social links, engagement data and professional email addresses
• Your collections (media lists) and their contents
• Your campaign drafts, campaign lists and campaign and coverage statistics
• Your media alerts, coverage reports and email templates
• Account information, such as your plan, limits and usage

Results are limited to what your own account can access. The assistant cannot access other subscribers' lists, campaigns or account data through the connector. The connector does not return mailbox content or email message data from a connected inbox.

What the assistant can do. The connector can search and read data, create and organise collections, create campaign drafts and media alerts, and remove journalists from or delete a collection. The connector cannot send, schedule or start a campaign, and it does not provide access to billing, mailbox settings, team management, blacklist settings, CSV import or export, journalist record edits or data enrichment. Every email you send still requires an action by you in the PressReacher app.

What happens after data reaches the assistant. When PressReacher returns results to your connected assistant, that information leaves our systems at your request and is then handled by the assistant provider under its own terms and privacy policy. Please see Section 6.

Connected-app consent and revocation. You decide which assistant is connected. You can review and revoke access at any time in PressReacher under Settings → MCP. That page lets you create, replace or revoke a static API token, and revoke all connected OAuth apps at once. Individual connected apps are not listed separately. Once access is revoked, those tokens stop working immediately. You may also need to remove the connector within the assistant itself. For questions about the connector, use the contact details in Section 14.

Journalists and media professionals. Professional information about you may be returned, at the request of a subscriber, to an AI assistant that subscriber has connected. The same protections, opt-out and removal rights described in this policy apply. See Section 9.

6. Who We Share Information With

Authorised Platform Subscribers

Professional contact information held in our database is accessible to verified subscribers with active accounts, bound by our Terms of Service and acceptable use policies. Aggregated email deliverability scores are shared across the platform as described in Section 5. No individual subscriber's activity or personal campaign data is shared with other users. This includes subscribers who access the information through an AI assistant connected to their own account, as described below.

Service Providers

We share data with trusted third-party service providers who support our operations, including:

• Cloud hosting and infrastructure providers
• Analytics and platform monitoring services
• Payment processing services
• Customer support platforms

All service providers are contractually required to process data only on our instructions and in accordance with applicable data protection law.

AI Assistant Providers (At Your Direction)

If you connect an AI assistant to your PressReacher account, the provider of that assistant (for example OpenAI for ChatGPT, or Anthropic for Claude) receives the results that our connector returns to your assistant. This sharing happens only because you chose to connect the assistant and, through it, made a request. We do not select the assistant provider and we do not send data to an assistant that you have not connected.

The assistant provider is not our service provider. It processes the information it receives under its own terms and privacy policy, which may allow it to store the information, use it to generate responses, and in some cases use it to improve its models, depending on your settings with that provider. PressReacher does not control, and is not responsible for, how an assistant provider handles information after it has been returned to your assistant. Please read the terms and privacy policy of any assistant you connect and check your settings with that provider.

Journalist records and other information you ask your assistant to retrieve should only be used by you in line with our Terms of Service and applicable data protection law.

Legal Requirements

We may disclose personal data to regulatory authorities, law enforcement agencies, or courts where we are legally required to do so, or where necessary to protect the rights, property, or safety of PressReacher, our users, or others.

7. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected:

• Subscriber account information: For the duration of your account plus 7 years (to meet legal and tax obligations)
• Platform usage data: Up to 2 years for analytics and service improvement purposes
• Professional contact data: Until it is no longer accurate, an opt-out request is received, or we determine it is no longer necessary to hold
• Marketing preferences: Until consent is withdrawn
• Communications and support records: As required by law or legitimate business needs
• MCP connector tokens: OAuth access tokens until they expire (one hour), OAuth refresh tokens until they expire (30 days), and static API tokens until you revoke or replace them, or your account is closed. When you revoke a token, the stored record is removed immediately
• Connected-app authorisation records: OAuth client registrations for up to 365 days, and token records for as long as the related tokens remain valid

Information that has been returned to a connected AI assistant is held by the assistant provider, not by us, and is subject to that provider's retention practices.

8. Your Rights Under UK GDPR

Depending on the nature of your data and how it is processed, you have the following rights:

• Right of Access (Article 15) — Request a copy of the personal data we hold about you
• Right to Rectification (Article 16) — Request correction of inaccurate or incomplete data
• Right to Erasure (Article 17) — Request deletion of your personal data in certain circumstances
• Right to Object (Article 21) — Object to processing carried out on the basis of legitimate interests
• Right to Restriction (Article 18) — Request that we limit how we process your data
• Right to Data Portability (Article 20) — Receive your data in a structured, machine-readable format

9. How to Exercise Your Rights

If you have connected an AI assistant, you can stop further sharing at any time by revoking access under Settings → MCP in PressReacher. To exercise your rights over information held by an assistant provider, you will need to contact that provider directly.

Journalists and Media Professionals — Data Removal

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data at rest and in transit
• Multi-factor authentication and role-based access controls
• Regular security assessments and vulnerability monitoring
• Staff awareness and data protection training
• Incident response and breach notification procedures in line with ICO requirements
• Authorisation of the MCP connector through OAuth 2.1 with PKCE, so that AI apps are only given access after you sign in and approve it
• Access to each connected app limited to the data your own PressReacher account can access, with no access to other subscribers' data
• Protection of connector tokens, which are stored as hashes, with the ability for you to revoke them at any time and for us to disable them where we suspect misuse
• Destructive actions through the connector, such as deleting a collection, require explicit confirmation
• Rate limits on connector requests to prevent misuse

You are responsible for keeping any tokens issued to you or to your AI apps confidential, as set out in our Terms of Service.

11. Automated Processing

Our AI systems perform automated categorisation and organisation of professional information, including:

• Industry and beat classification for journalists
• Relevance scoring for PR outreach matching
• Contact information validation and deduplication
• Email deliverability scoring based on aggregated send data

These automated processes do not make decisions that produce legal or similarly significant effects on individuals. They are used solely to organise publicly available professional information and assess the technical quality of email addresses as delivery channels.

If you connect an AI assistant, the assistant (not PressReacher) decides how to interpret your instructions, which connector requests to make, and how to present the results. Its outputs, including any suggested journalist matches or drafted campaign text, are generated by the assistant provider's systems and are not decisions made by PressReacher. The connector does not send campaigns or take any other irreversible step without your action in the PressReacher app, except that it can delete a collection after explicit confirmation. No decision made through the connector produces legal or similarly significant effects on individuals.

12. Complaints

If you have concerns about how we handle your personal data, please contact us in the first instance at [email protected]. We take all complaints seriously and will respond promptly.

If you remain dissatisfied, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint

If you are located in the EU, you may also contact your local supervisory authority.

13. Changes to This Policy

We may update this privacy notice from time to time. Where changes are material, we will notify subscribers by email or via an in-platform notification. The version number and last updated date at the top of this document will always reflect the current version.

14. Contact Information