← Back to home

Privacy Policy

1. Data Controller

AgencyReporter
Email: contact@agencyreporter.info
We are the data controller for personal information you provide directly to us.

2. Information We Collect

We collect the following categories of personal data:

  • Account Information: Email address, password (hashed), agency name
  • Ad Platform Data: Data from Google Ads and Meta Ads accounts you authorize
  • Client Data: Client names, contact information, and performance metrics
  • Payment Data: Billing address, subscription tier (credit card processed by Stripe)
  • Usage Data: IP address, browser type, pages visited, timestamps
  • Communication Data: Messages sent via our contact form

3. Legal Basis for Processing

  • Contract: Processing account data, generating reports, and providing the service
  • Legitimate Interest: Security, fraud prevention, service improvement, analytics
  • Consent: Marketing communications (you can opt out anytime)
  • Legal Obligation: Compliance with tax laws and regulatory requirements

4. Data Sub-Processors

We share data with the following trusted sub-processors (all GDPR compliant):

  • Supabase: Database and authentication (US-based, SOC 2 certified)
  • Stripe: Payment processing (US-based, PCI DSS compliant)
  • Resend: Email delivery (US-based)
  • Google & Meta: Ad data retrieval (via your OAuth authorization)
  • Anthropic: AI-generated report summaries. Only aggregated performance metrics are shared — no personally identifiable information is transmitted (US-based)
  • AWS S3 (Amazon Web Services): Logo storage for agency branding on reports. Agency logo images are stored in a publicly accessible S3 bucket and contain no personal data (US-based, SOC 2 certified, ISO 27001 certified)
  • PDFShift: PDF generation service. Report HTML is sent to PDFShift to render branded PDF files (EU-based, GDPR compliant)
  • Inngest: Task scheduling and automation (US-based)
  • Vercel: Hosting and CDN (US-based, SOC 2 certified)

5. International Data Transfers

Your data may be transferred to, stored in, and processed in the United States. We ensure appropriate safeguards are in place for sub-processors via Standard Contractual Clauses (SCCs) and adequacy decisions. By using AgencyReporter, you consent to this transfer.

6. Data Retention

  • Account Data: Retained while your account is active. Deleted 30 days after account deletion.
  • Reports: Retained for 2 years from generation date.
  • Payment Records: Retained for 7 years (tax compliance).
  • Usage Logs: Deleted after 90 days.
  • Contact Form Messages: Retained for 1 year, then deleted.

7. Your Rights (EU/EEA Residents)

Under GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate information
  • Erasure: Request deletion of your data (except where legally required to retain)
  • Restriction: Limit how we process your data
  • Portability: Receive your data in a structured, portable format
  • Objection: Opt out of processing for marketing or legitimate interest purposes
  • Withdraw Consent: Withdraw any consent you've given

To exercise these rights, contact us at contact@agencyreporter.info.

8. Supervisory Authority Complaints

EU/EEA residents have the right to lodge a complaint with a data protection supervisory authority (DPA) in your jurisdiction. Contact your local DPA or the ICO (UK) if you believe we have violated your rights.

9. Cookies & Tracking

We use cookies to remember your preferences and track usage for analytics. You can control cookie consent via the cookie banner on our site.

  • Essential Cookies: Required for authentication and functionality
  • Analytics: Track usage patterns to improve the service
  • Marketing: Used by third-party platforms (only if you consent)

10. Data Security

We implement industry-standard technical and organizational safeguards including encryption in transit (TLS) and encrypted storage via our database provider, access controls, regular security audits, and employee data protection training. However, no method is 100% secure — use a strong password and protect your account.

11. Children's Data

AgencyReporter is not intended for users under 18. We do not knowingly collect data from children. If we discover a child's data, we will delete it immediately.

12. California Residents (CCPA)

California residents have the right to know what personal data we collect, request deletion of their data, and opt out of the sale of personal data. We do not sell personal data to third parties. To exercise your California privacy rights, contact us at contact@agencyreporter.info.

13. AI Use & Limited Use Compliance

AgencyReporter uses Anthropic's Claude API to generate written performance summaries from the advertising and analytics metrics pulled from your connected Google Ads and Google Analytics (GA4) accounts. Only aggregated performance metrics (spend, impressions, clicks, conversions, and similar reporting data) are sent to Anthropic to generate these summaries — no raw account credentials or personally identifiable information is transmitted.

The use of data received from Google APIs (including the Google Ads API and Google Analytics Data API) will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use, transfer, or sell data received from these APIs — including raw, aggregated, or derived data — to develop, improve, or train any foundational or generalized AI/ML models. This data is used solely to generate the specific client performance report the connecting agency requested, and for no other purpose.

14. Policy Updates

We may update this policy to reflect changes in law or our practices. We will notify you of material changes by email or via our service. Your continued use indicates acceptance.

15. Contact Us

For privacy inquiries, data requests, or complaints, contact us at:
contact@agencyreporter.info

Effective Date: June 1, 2026
Last Updated: August 11, 2026