Last updated: 18 September 2026
This policy describes how Vula Reach (“we”, “us”) — operated as part of the Vula suite — handles personal data when you use vulareach.com, our APIs, and vl4.me short links. It is written for our product model: affiliate tracking, brand campaigns, self-serve invoicing, and SaaS subscriptions. It is not legal advice; ask counsel to review it for your jurisdiction.
Account and product data. Name, email, password or PIN hashes, role, brand or affiliate profile, contact details, campaign and link settings, Meta Pixel IDs you configure, conversion and invoice records, subscription and billing references, support notes, and talk-to-sales or lead form submissions.
Link and click analytics. When someone follows a tracked link we record an event ID, timestamp, user agent, referrer, coarse device and browser signals, and approximate location (country and city when available). Raw IP addresses are hashed with a server salt and are not kept as cleartext for analytics; hashes help with abuse prevention and deduplication. Bot-like traffic may be flagged.
Opt-in interstitial. If a visitor is shown the form and submits it, we may store name, email, phone, a consent flag, and a link to the click. Opt-in personal data is stored separately and is not joined into ordinary dashboards or CSV exports.
Cookies and similar tech. We use authentication tokens for signed-in sessions, a short-lived cookie to remember pricing market localisation, and other essential security cookies. Brands or affiliates may also configure Meta or Google tags that set their own identifiers when visitors hit tracked destinations.
Payments. SaaS plan checkout runs through Vula Payments. We store order and invoice references and subscription state. Full card numbers are handled by the payment provider, not stored by Reach. Affiliate invoices are settlement records between affiliate and brand; Reach is not the merchant for those transfers.
Where laws such as POPIA, GDPR, or other applicable privacy laws apply, we rely on performance of a contract, legitimate interests (security, product analytics, operations), consent (opt-in form and any optional marketing), and legal obligation where required.
We share data with:
We do not sell personal data.
Account data is kept while the account is active and for a reasonable period afterward for disputes, audit, and legal requirements. Click and conversion logs are retained for reporting and attribution. Opt-in records are kept for consent evidence and product purpose, then deleted or anonymised when no longer needed. Auth tokens expire according to product rules.
We use TLS in transit, role-based access control, hashed passwords and PINs, hashed IPs for clicks, and server-side secrets. No method of transmission or storage is completely secure.
Depending on where you live, you may have rights to access, correct, delete, restrict, or port your data, to object to certain processing, and to withdraw consent where processing is based on consent. Contact us using the support channel on this site. You may also lodge a complaint with a supervisory authority (for example your local data protection authority, or the Information Regulator where POPIA applies).
Reach is not directed at children under 18. We do not knowingly collect their personal data.
Servers and processors may be located outside your country. Where required, we use providers and arrangements that support appropriate safeguards.
For Reach accounts and platform processing, we act as controller. When a brand or affiliate collects data through their own campaigns or off-platform tools, they may be an independent controller; Reach processes data only as needed to run the product.
We may update this policy. The “Last updated” date will change. Material changes may be notified in-product or by email for account holders.
Questions about privacy: contact us via early access or the support URL shown in our product emails.