Privacy Policy

Who operates ReachIRL

ReachIRL is operated by Erickson Operating LLC for this U.S. pilot. References to “ReachIRL,” “we,” or “us” in this policy mean Erickson Operating LLC in connection with the pilot.

Information you provide

If you join the waitlist, we collect your name, email address, and city. If you choose the business path, we also collect your company name and industry. If you send Feedback/Contact, we collect your message and, if you provide them, your name and email address. We also record the page from which a submission was sent and a random request identifier used to prevent duplicate processing.

Information collected automatically

When you use the site, we may collect the page and QR code visited; scan time; pilot, campaign, location, participant, shirt, and creative attribution; browser, operating system, device class, in-app-browser, language, referrer, and screen or viewport details; interaction, scrolling, return-visit, session, error, and site performance information; and signals used to identify bots, rapid repeat scans, or other abuse.

On QR routes, hosting headers may provide an approximate city, region, and country. ReachIRL does not request or intentionally collect precise GPS location, and browser geolocation permission is disabled by the site. The application does not save a raw IP address. It may briefly process an address for rate limiting and, when configured, save only a salted SHA-256 hash for abuse detection. That hash is designed not to reveal the original address. Hosting and network providers may still process IP addresses in the ordinary course of delivering and securing the service.

Analytics and session replay

We use PostHog to understand pilot engagement, site performance, and usability. PostHog session replay may record interactions such as page changes, clicks, scrolling, and layout changes so we can see how the experience works in practice. The site is configured to mask every form input, page text, and element attribute in replay. Our named analytics events report field names and form state, not the names, email addresses, company names, or messages typed into forms. These protections reduce exposure, but replay and analytics data remain pseudonymous rather than guaranteed anonymous.

Why we use information

We use information to:

• operate the waitlist and respond to Feedback/Contact;
• measure the pilot and understand QR engagement;
• improve usability and diagnose technical or performance issues;
• detect duplicate, fraudulent, bot, or automated scans; and
• maintain and protect the site and its services.

We do not use the pilot site for cross-site advertising or ad retargeting.

Service providers and third-party collection

We disclose information to providers as needed for them to operate services for us: Vercel for hosting and infrastructure; Supabase for database storage; PostHog for analytics and session replay; and Resend for Feedback/Contact email delivery. Resend also sends those messages to private operator inboxes so we can respond.

These providers may collect or process technical information through the site in the course of hosting, delivering, securing, measuring, or supporting their services. We do not describe these providers as advertisers, and the current pilot does not sell personal information or share it for cross-context behavioral or targeted advertising.

Cookies and browser storage

QR pages use two first-party, HTTP-only cookies: a random visitor identifier, set for up to one year, and a last-scan value, set for up to one day to recognize rapid repeat scans. The browser also stores first-seen, last-seen, and maximum-scroll information in first-party local storage to recognize return visits. PostHog uses first-party cookies and local storage for its pseudonymous analytics identifiers and session state. ReachIRL does not use session storage in the current implementation.

Do Not Track and browser signals

The site does not currently change its analytics or storage behavior in response to the legacy Do Not Track signal or Global Privacy Control. The pilot does not sell personal information or use it for targeted-advertising sharing, so there is no sale or targeted-advertising activity for Global Privacy Control to opt out of in the current implementation. You may limit cookies or local storage through browser settings, although doing so may affect analytics and repeat-visit functions.

How long we keep information

• QR scan and behavioral or performance analytics data are kept for up to 12 months, subject to shorter provider limitations.
• PostHog session replay is kept for up to 12 months or PostHog’s shorter configured or plan retention period, whichever is shorter.
• Feedback/Contact submissions are kept for 12 months, unless longer retention is reasonably necessary to resolve an active communication or request.
• Waitlist submissions are kept while the ReachIRL waitlist remains operationally useful. Once a record is no longer reasonably needed for that purpose, it will be deleted within 12 months, or earlier when an appropriate verified deletion request is honored.

Limited information may be kept longer when reasonably necessary for security, fraud prevention, legal obligations, dispute resolution, or recordkeeping. Infrastructure providers may retain short-lived operational records according to their service settings.

Security

We use reasonable technical and organizational safeguards appropriate to this pilot, including server-only service keys, restricted database access, request validation, rate limiting, masked replay, and security headers. No security measure is perfect, and we cannot guarantee absolute security.

Your choices and requests

You may email reachirl@conversionsconsulting.com to request access to, correction of, or deletion of information associated with you. We may ask for information needed to verify the request and locate a matching record. We will honor appropriate verified requests, subject to information we reasonably need or are permitted to retain for security, legal, fraud-prevention, dispute, or recordkeeping purposes.

Children

ReachIRL is intended for adults participating in or using the pilot. We do not knowingly seek personal information from children. The site does not use technical age verification. If you believe a child has provided information, contact us so we can review and take appropriate action.

Changes to this policy

We may update this policy as the pilot or its services change. If we do, we will update the effective date shown at the top of this page.