Privacy policy

1. Introduction

Squad as a Service SL operates Reach. This policy explains how personal data is handled on this site, in line with the GDPR and Spanish data protection law (LOPDGDD).

2. Who is responsible

When you buy from a business or talk to it through Reach (for example, a gift voucher), that business is the data controller and we process the data on its behalf as data processor. For our own website and service relationships, we are the controller.

3. Data we process

• Purchase details: the product or amount, the names on the voucher (recipient and sender), the dedication and the chosen design.
• Delivery details: the recipient's email and/or WhatsApp number and the scheduled date, when you choose a send.
• Buyer details: email, phone and name collected by Stripe at checkout.
• Technical data: IP address, browser and device, and security logs.

4. Why we use it

• To create, send and redeem the voucher, and to process the payment (performance of the contract).
• To keep an audit trail of issued vouchers for accounting and fraud prevention (legal obligation and legitimate interest).
• To answer requests sent to the business or to us.

5. Service providers

• Stripe (payments: card, Bizum, Apple Pay, Google Pay).
• Cloudflare (hosting, storage and email sending).
• Meta / WhatsApp and its business messaging provider Kapso (WhatsApp sends).
• Google (AI features such as suggested dedications; we send only the text needed for the suggestion).

They act under data processing agreements and only for these purposes.

6. Retention

Voucher and payment records are kept for as long as the voucher is valid and afterwards for the periods required by tax and commercial law (generally up to six years). Delivery details are not used for other purposes.

7. Your rights

You can request access, rectification, erasure, restriction, portability or object to processing by writing to the business or to us at the address below. You may also file a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. International transfers

Some providers may process data outside the European Economic Area; in that case transfers are covered by European Commission standard contractual clauses or equivalent safeguards.

9. Cookies

These pages only use technical storage needed for them to work (for example, keeping your form while you fill it in). We do not use advertising cookies here.

10. Changes

We may update this policy; the date at the top shows the current version.

11. Contact