This policy explains how ReachFlow handles account, workspace, content, media, AI, billing and connected-platform data—including the exact OAuth permissions used for social publishing.
Jump to a chapter
Use a direct URL such as /reachflow/privacy#tiktok to open a platform section.
Jump directly to a connected platform
Who and what this covers
This ReachFlow Privacy Policy applies to the ReachFlow website, account, workspace, APIs and integrations. It supplements the main Mohuls Privacy Policy where ReachFlow needs more product-specific detail.
Connected Page visitors, commenters, message participants and other people may appear in data retrieved for an authorized customer. The customer is responsible for having a lawful basis, providing any notices it owes, limiting workspace access and using engagement data only for legitimate business communication. ReachFlow is intended for business users, not for covert monitoring, surveillance or building sensitive profiles about an audience.
Data map
What we receive depends on how you use the product, which integrations you connect, and which optional features you authorize. We ask customers not to submit information that is not needed for their content operations.
Name, username, email address or Bangladeshi mobile number, profile photo, authentication method, account role, country, language and interface preferences. If you use Google sign-in, we receive the verified Google account identifier and basic profile information returned with your consent; we do not receive your Google password.
Organization name, description, logo, website, workspace settings, team or owner relationships, brand voice, audience guidance, approved facts, policies, campaign context, knowledge sources, content examples and visual preferences that you choose to provide.
Drafts, prompts, captions, titles, links, hashtags, publishing dates, timezone, recurrence rules, approval state, platform-specific options, uploaded images, video, audio, documents, thumbnails, file metadata, generated media, publishing results and error records.
OAuth tokens and granted scopes; account, Page, board, profile or channel identifiers; display names, usernames, profile images and public URLs; administrative roles; provider status; post IDs and URLs; and, where an inbox, comment or analytics feature is enabled, the limited conversation, comment or metric data needed for that feature.
Your instructions, relevant workspace context selected for a generation, generated copy and visual prompts, reference-image choices, model and usage information, token or image consumption, quality feedback, job status, errors and the history needed to make organization-specific generation consistent.
Plan, billing market and currency, subscription status, invoice or transaction references, paid amount, payment status, credit wallet and usage history, refunds, gateway customer identifiers and information required for accounting or fraud review. Payment providers process sensitive payment credentials under their own notices; ReachFlow does not intentionally store complete card numbers.
IP address, approximate country derived from network signals, browser and device information, request and security logs, timestamps, diagnostic events, support messages, and records of administrative or workspace actions used to secure and troubleshoot the service.
A social post is meant to leave ReachFlow. Captions, media, links, labels, audience or privacy choices and related metadata are sent to the selected network. Depending on that choice, the network may make them public, searchable, shareable, downloadable or visible to an audience you selected.
ReachFlow does not ask for your Facebook, Instagram, Threads, X, Pinterest, LinkedIn, YouTube, TikTok or Reddit password. Provider consent happens on the provider’s own authorization screen. We do not intentionally collect complete payment-card numbers, and we do not request health, biometric, government-ID or other sensitive information for normal social publishing.
Purpose limitation
We use information for the product function that produced it, for closely related operations such as security and support, and where necessary to meet legal or platform obligations.
Create accounts, maintain workspaces, store content, render calendars, upload media, generate drafts and deliver the features you request.
Authenticate connected accounts, show eligible publishing destinations, validate platform requirements, schedule or publish authorized content, check processing status and record provider post identifiers and outcomes.
When you enable supported features, retrieve and display comments or messages, send your replies and maintain local read, notification or hidden-state preferences.
Retrieve relevant approved workspace knowledge, generate content and images, reduce repetition, preserve brand instructions, measure usage and improve job reliability. Connected-platform data is not used by Mohuls to build advertising profiles.
Select regional billing options, process subscriptions and AI credits, reconcile payments, prevent duplicate charges, answer support requests and maintain business and tax records.
Authenticate users, enforce workspace ownership, prevent abuse, investigate failed or suspicious activity, keep audit trails and comply with legal or platform obligations.
Contract: to create the account, provide subscriptions, maintain the workspace and perform publishing or generation requested by the user.
Legitimate interests: to secure, support, measure and improve ReachFlow, prevent abuse and administer business operations, balanced against individual rights.
Consent or authorization: for OAuth grants, optional cookies or another activity where applicable law or a provider requires a specific choice.
Legal obligations: for tax, accounting, sanctions, fraud prevention, lawful requests, dispute handling and other mandatory duties.
OAuth and publishing
The sections below describe the current ReachFlow implementation. Optional permissions are requested only when configured for an approved feature. The destination provider's consent screen always shows the permissions actually requested for that connection.
To publish later, ReachFlow must keep the provider token or refresh mechanism made available by the provider. Tokens can expire, be revoked or lose a permission. When that happens, ReachFlow marks the connection for reconnection and stops the affected action rather than asking for a social password.
Platform 01
ReachFlow connects to Facebook Pages through Meta OAuth. It lists Pages the authorizing user can manage and uses the selected Page token to publish only the content and media the workspace has prepared or scheduled.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
pages_show_list | Lists Facebook Pages the authorizing user is permitted to access so the correct destination can be selected. |
pages_read_engagement | Reads Page identity and engagement-related Page information needed to validate and operate the connection. |
pages_manage_posts | Creates and manages posts on the selected Facebook Page. ReachFlow enables this scope for Page publishing. |
pages_manage_metadata | Optional: manages Page webhook subscriptions and related Page connection metadata when that integration capability is approved and enabled. |
pages_manage_engagement | Optional: supports authorized Page engagement actions when the corresponding ReachFlow feature is enabled. |
pages_read_user_content | Optional: reads user-generated content on a managed Page for supported moderation or engagement workflows. |
pages_messaging | Optional: reads and sends Page messages in the ReachFlow inbox after Meta approval and user authorization. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Platform 02
ReachFlow supports Instagram Professional accounts linked to a Facebook Page. The connection is used to identify the selected professional account and publish approved visual content; it does not require or receive your Instagram password.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
pages_show_list | Finds the linked Facebook Pages through which eligible Instagram Professional accounts are discovered. |
pages_read_engagement | Reads the Page identity and connection information needed to resolve the linked Instagram account. |
instagram_basic | Reads basic professional-account profile information used to identify the publishing destination. |
instagram_content_publish | Creates and publishes media to the selected Instagram Professional account. |
instagram_manage_messages | Optional: supports the Instagram inbox when Meta has approved the feature and the user grants access. |
pages_manage_metadata | Optional: supports webhook subscription management for connected professional accounts. |
pages_messaging | Optional companion permission used for supported Page-linked messaging workflows. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Platform 03
Threads uses a separate Meta authorization flow. ReachFlow reads basic profile identity and uses a long-lived access token to create and publish content containers requested by the workspace.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
threads_basic | Reads the connected Threads profile identity required to display and validate the publishing destination. |
threads_content_publish | Creates media or text containers and publishes them to the connected Threads profile. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Platform 04
ReachFlow uses X OAuth 2.0 with PKCE. The authorized connection can identify the profile, publish posts and media, renew access for scheduled work and, because ReachFlow includes an X inbox, read and send direct messages when those scopes are granted.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
tweet.read | Reads post information needed to identify referenced posts and confirm supported publishing results. |
tweet.write | Creates posts, replies, quotes or threads on behalf of the connected X account. |
users.read | Reads the connected user's basic profile and public metrics. |
media.write | Uploads the images, GIFs or video selected for an X post. |
offline.access | Provides a refresh token so scheduled publishing can continue after the short-lived access token expires. |
dm.read | Reads authorized direct-message conversations and events for the ReachFlow inbox. |
dm.write | Sends a text reply chosen by an authorized user from the ReachFlow inbox. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Platform 05
ReachFlow reads the connected Pinterest account and its boards or sections so the user can choose a destination, then creates only the Pin content selected in the workspace.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
user_accounts:read | Reads the connected Pinterest account identity used to label the connection. |
boards:read | Lists boards and sections so a user can select the correct Pin destination. |
boards:write | Supports board-related write access required by the configured Pinterest publishing integration; ReachFlow does not create or modify a board unless the user invokes a supported action. |
pins:read | Reads Pin information needed to validate access and publishing results. |
pins:write | Creates the image, carousel or video Pin requested by the authorized user. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Platform 06
ReachFlow offers separate authorization for a LinkedIn member profile and for Company Pages. It identifies the authorizing member, validates eligible Company Page roles, and publishes only to the member or organization selected by the user.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
openid | Identifies the authorizing LinkedIn member through LinkedIn's OpenID Connect response. |
profile | Reads the member's basic profile information needed to label and validate the connection. |
w_member_social | Publishes authorized content on behalf of the connected member. |
r_organization_admin | For Company Pages, lists organizations and roles administered by the authorizing member. |
r_organization_social | Reads organization social content required by the approved Company Page integration and publishing context. |
w_organization_social | Publishes authorized content on behalf of the selected Company Page. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Platform 07
ReachFlow uses YouTube Data API Services to identify the user's channel, upload videos or Shorts, set requested metadata and thumbnails, optionally add the upload to a playlist, and support channel-comment viewing and replies.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
youtube.readonly | Views the connected YouTube account and channel information used to identify the destination. |
youtube.upload | Uploads and manages the videos or Shorts selected for publishing. |
youtube.force-ssl | Permits read/write YouTube account actions over secure transport, including supported video, playlist, comment, rating or caption operations. ReachFlow currently uses it for publishing support and comment workflows described here. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Platform 08
ReachFlow uses TikTok Login Kit and the Content Posting API to identify the creator, read the creator's current posting options and directly publish a video, photo or photo carousel explicitly prepared by the workspace.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
user.info.basic | Reads the basic TikTok identity fields used to connect and label the creator account. |
user.info.profile | Reads additional profile fields, such as username, profile link or biography, returned with user authorization. |
video.publish | Queries creator posting settings and directly publishes authorized video or photo content to the user's TikTok profile. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Platform 09
ReachFlow uses Reddit OAuth with permanent authorization so a connected user can be identified and scheduled content can be submitted to the subreddit chosen in the workspace configuration.
Information accessed
How publishing uses it
OAuth permissions
| Scope | Why ReachFlow requests it |
|---|---|
identity | Reads the connected Reddit account's identity so ReachFlow can label and validate the connection. |
read | Reads Reddit content and destination information required to validate the publishing context and result. |
submit | Creates the self, link or supported media submission chosen by the authorized user. |
A provider may rename, replace or further restrict a scope. The consent screen presented by the provider at connection time is authoritative for the permissions actually granted.
What ReachFlow keeps
Your controls
Generation and automation
ReachFlow can generate copy, visual prompts and images, and can prepare or publish scheduled work automatically. These features process only the workspace context selected or retrieved for the task.
Do not place secrets, regulated personal data or unnecessary third-party personal information in prompts or knowledge sources. Review generated content for accuracy, rights, disclosures and platform suitability before publishing. AI providers process submitted inputs under their applicable service terms; ReachFlow does not represent that generated output is unique, error-free or legally cleared.
Recipients and transfers
We disclose information when it is necessary to provide ReachFlow, complete an action you request, protect the service or comply with law. We do not sell ReachFlow personal information or share it for cross-context behavioral advertising.
Hosting, database, caching, job-queue, security and content-delivery providers operate ReachFlow. Customer media may be held in private object storage and delivered with expiring signed access where supported.
Meta, X, Pinterest, LinkedIn, Google/YouTube, TikTok and Reddit receive the account token and content necessary for the action the user authorizes. Once published, that content is also processed under the destination platform's terms and privacy policy.
Moonshot AI/Kimi may receive prompts and relevant workspace context for text generation. Runware and the selected underlying image model may receive visual prompts and, only when selected, reference images for image generation. Do not include personal or confidential information that is unnecessary for the generation task.
Google may process sign-in assertions, SMSQ may deliver Bangladeshi verification codes, and an IP-geolocation service may resolve an approximate country when trusted edge-country headers are unavailable. These services receive only the information needed for the relevant task.
Paddle, bKash or PayStation may process checkout and payment information depending on country and selected method. ReachFlow receives transaction references, status, amount and reconciliation data rather than intentionally storing complete card credentials.
Information may be shared with auditors, accountants, insurers, advisors or authorities when reasonably necessary to operate the business, enforce agreements, protect users, respond to lawful process or complete a corporate transaction subject to appropriate safeguards.
Mohuls operates from Bangladesh and uses providers that may process information in other countries. A connected platform will also process content wherever it operates. Where applicable, we use contractual, organizational or technical measures intended to support lawful transfers. The laws and government-access rules of a destination can differ from those in your location.
Safeguards
We use layered technical and organizational controls appropriate to a hosted publishing system. Security reduces risk; it cannot make any online service completely immune from attack, user error or provider compromise.
Lifecycle
Retention is based on purpose, customer instructions, provider requirements and legal obligations—not on keeping every record indefinitely. Different records have different lifecycles.
Kept while the account or subscription is active and as needed to provide the service. Customer-created content and media remain until deleted, replaced, archived, account closure is completed or a valid retention instruction applies.
Kept while a connection is active or needed for a scheduled action. Disconnecting stops account-level actions. Because provider grants and local records are separate, also revoke ReachFlow in the provider's settings when you want to invalidate access at the source.
Post IDs, URLs, outcomes, error records and audit events may remain after disconnection to explain completed actions, prevent duplicates, resolve disputes and support security. We minimize or delete these when they are no longer needed.
Generally retrieved for the active inbox or comments view. ReachFlow stores limited local read, hidden and notification state and may store reply attachments or logs. The destination platform retains its own copy independently.
Invoices, transaction references, subscription records, refunds and related business records may be kept for the periods required by tax, accounting, anti-fraud, dispute and legal rules.
Deleted data may remain temporarily in restricted backups, security logs or disaster-recovery copies until overwritten under the applicable cycle, unless preservation is required for an investigation or legal claim.
Removing a local draft, schedule, media record or connection does not automatically remove a post, message, comment or media copy already accepted by a destination provider unless ReachFlow expressly confirms that it completed a provider-side deletion. Use the provider’s own controls for provider-held content. For YouTube access, you may also revoke ReachFlow through Google Security settings.
Choice and control
Rights differ by jurisdiction and by whether Mohuls or a customer controls the relevant information. We will route, verify and respond to a request under the law that applies.
Ask whether Mohuls processes your personal information and request a copy of information we can reasonably associate with you, subject to identity verification and the rights of others.
Update available profile or workspace fields directly, or ask us to correct inaccurate personal information that cannot be changed through the product.
Delete supported workspace records or request account and connected-platform data deletion. We may retain limited records where required for billing, security, disputes or law, and deletion from ReachFlow does not automatically delete content already held by a social platform.
Where applicable, ask us to restrict certain processing or object to processing based on legitimate interests. We will assess the request against contractual, legal and security requirements.
Disconnect a provider, revoke ReachFlow from the provider's security settings, or withdraw optional consent without affecting processing that was lawful before withdrawal.
Contact us first so we can investigate. Depending on your location, you may also complain to the data-protection or consumer-privacy authority responsible for your jurisdiction.
Email contact@mohuls.com with “ReachFlow privacy request” in the subject. Include your ReachFlow account email or mobile number, the organization name, the connected provider and profile/channel/Page identifier when relevant, and the right you want to exercise. Do not send provider tokens or passwords. We may verify identity and authority before disclosing or deleting data. Authorized agents may be asked for proof of authority.
If the data belongs to a customer’s workspace, we may direct the request to that customer. We will not discriminate against an individual for exercising a privacy right, though deleting information required for ReachFlow may make the affected feature unavailable.
Policy administration
ReachFlow is built for business and professional content operations. This final section explains age expectations, policy updates and how to reach Mohuls.
Privacy contact
Mohuls Soft Limited
Sardarpara, Raghunathpur Bazar
Harinakundu, Jhenaidah – 7310, Bangladesh