Effective 11 October 2026 · Last updated 11 October 2026
Controller: ExamediX Technologies di Matteo Caprani, Switzerland ("ExamediX", "we"). Reach connects ChatGPT to computers that an account holder has explicitly paired and authorized.
We process account and authentication data, device identifiers and online status, subscription information, OAuth authorization records, and security/audit metadata including tool names and event timestamps. Network IP addresses may be processed transiently in memory for rate limiting and abuse prevention but are not stored in Reach's persistent tool audit log. When you invoke a Reach tool, the requested data or command output is transmitted between ChatGPT, Reach and your paired device only as needed to complete the request.
Reach is designed not to persist file contents, command bodies, command output, clipboard-like input, or binary payloads in server audit logs. Security logs record redacted metadata such as tool name, device, success/failure, lengths and short hashes. Tool results are returned to the requesting ChatGPT conversation and may therefore be processed by OpenAI under your relationship with OpenAI.
We process data to provide the service, authenticate users and devices, execute authorized requests, prevent abuse, maintain security, provide support, administer subscriptions and comply with legal obligations. Where applicable, processing is based on performance of the contract, legitimate interests in operating and securing the service, consent where specifically requested, and legal obligations.
Authorization codes expire after five minutes. Pairing codes expire after fifteen minutes. Access tokens expire after one hour and refresh tokens after thirty days unless revoked earlier. Redacted audit events are retained for up to 30 days. Account and subscription records are retained while the account is active and thereafter only as reasonably required for legal, security and accounting obligations.
Reach's primary service infrastructure is hosted in Switzerland. Data may be transmitted to OpenAI when you use Reach from ChatGPT. Stripe processes checkout, billing and payment data as our payment provider; Reach does not receive or store your full card number. We may use infrastructure and security providers strictly to operate the service, subject to appropriate contractual and security safeguards.
Reach uses an essential secure session cookie when you sign in to the Reach website. We do not use this cookie for advertising or cross-site behavioral profiling.
You choose which computers to pair and which directories the local Reach agent may access. You can disconnect a device or revoke ChatGPT authorization. You may request access, correction, export or deletion of personal data, subject to applicable Swiss data-protection law and, where applicable, the GDPR.
Reach uses TLS, OAuth 2.1-style authorization with PKCE, per-device credentials, hashed stored device tokens, scoped permissions, server-side ownership checks, command safety controls and redacted audit logging. No security system is infallible; users should maintain backups and operating-system security.
For privacy questions or rights requests, email support@examedix.ch or use the Reach support form and choose "Privacy".