Privacy Policy

1. Information We Collect

Account information: your name, work email, organization name, and authentication details when you request access to or create a ReportForge account.

Files and report content you provide: the data files you upload (such as CSV, Excel, JSON, or text), the configuration choices you make in the report flow, and the reports ReportForge generates for you. We refer to this collectively as your "Content."

Billing information: a payment card is collected only when you subscribe to a paid plan; there is no card at signup or during the free trial. When you subscribe, our payment processor collects and stores your payment-card details. ReportForge does not store full card numbers on its own systems; we retain limited billing metadata such as plan, status, and the last four digits.

Usage and device information: log data, IP address, browser and device type, and product-usage events we collect automatically to operate, secure, and improve the service.

2. How We Use Information

We use your information to provide and operate the service — including preprocessing your uploaded files and generating reports — to authenticate you, to provide support, to process billing and enforce plan limits, to secure the service and prevent abuse, to communicate with you about your account, and to comply with legal obligations.

We use aggregated and de-identified usage data to understand and improve ReportForge. We do not sell your personal information.

3. AI Processing of Your Content

ReportForge generates narrative using a third-party AI model provider (Anthropic). To produce a report, relevant portions of your Content are sent to that provider for processing and returned to you as part of your report. We send only what is needed to generate the requested output.

Numeric figures in your reports are computed by ReportForge’s own preprocessor and are not generated by the AI model. Your use of generated output is subject to the disclaimer in our Terms of Service.

4. Service Providers & Sub-Processors

We share information with vendors who process it on our behalf to run the service, under contractual confidentiality and data-protection obligations. Our current key sub-processors are: Anthropic (AI model processing of report content), Supabase (application database and storage), Railway (backend application hosting), Vercel (frontend hosting and delivery), and Stripe (payment processing).

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets. This list of sub-processors may change as the service evolves; material changes will be reflected here.

5. Data Retention & Deletion

We retain your Content and account information for as long as your account is active or as needed to provide the service. Reports and analyses that you delete or archive are first soft-deleted and are permanently purged after 30 days by our retention process. Closing an account archives its reports and analyses, and the same 30 days then apply. A free-trial account with no activity for 90 days is closed automatically. Security and audit logs are kept for up to 12 months.

You may request deletion of your account and associated Content by contacting us, and we carry out the deletion ourselves. We will delete or de-identify your data within a reasonable period after your request, except where we are required to retain it for legal, accounting, or security purposes.

6. Cookies & Tracking

ReportForge uses cookies and similar local-storage technologies that are necessary to operate the service — for example, to keep you signed in. We may use a limited amount of first-party analytics to understand product usage. We do not use third-party advertising trackers.

7. Data Security

We use commercially reasonable technical and organizational measures to protect your information, including encryption in transit, access controls, and authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights & Choices

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the processing of your personal information, and to object to certain processing. You can exercise these rights, or ask questions about them, by contacting us at the address below.

Where applicable law (such as the GDPR or the CCPA/CPRA) grants you these rights, we will honor them in accordance with that law and will not discriminate against you for exercising them.

9. International Data Transfers

ReportForge and its sub-processors operate primarily in the United States. If you access the service from outside the United States, you understand that your information will be processed in the United States and other countries where we or our sub-processors operate.

10. Children’s Privacy

ReportForge is a business product intended for use by adults in a professional capacity. It is not directed to children, and we do not knowingly collect personal information from anyone under 18.

11. Changes to This Policy

We may update this policy as the service and our practices change. When we make material changes, we will update the effective date above and, where appropriate, notify you. Your continued use of the service after an update constitutes acceptance of the revised policy.

12. Contact

Questions about this policy or your data can be directed to dc@darryncooke.com.