Privacy Policy

Last updated: September 2026

Data Controller

ReportWise is operated by CData s.r.o., with its registered seat in Žilina, Slovakia ("we", "us"). We are responsible for the personal data processed through this website. Contact: [email protected]

Your file stays on your device

When you upload a CSV or Excel file, it is parsed and the PDF report is generated entirely in your browser — the file itself is never uploaded to our servers. Some optional features (AI commentary, shared links, connected data sources and scheduled reports) do process report data on our servers; each is opt-in and explained below so you always know where your data goes.

Optional features that use our servers

  • AI commentary (optional) — if you enable AI-written commentary, only the aggregated figures already shown in your report (KPIs, totals, chart points) are sent to Anthropic to generate the text. Raw rows are never sent. Legal basis: performance of a contract / legitimate interests (Art. 6(1)(b),(f) GDPR).
  • Shared report links (optional) — when you publish a report, we store the computed report (aggregated figures, chart data, your company name, chosen colour and logo) so it can be viewed at a private link. Revoking the link from your dashboard deletes it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Connected data sources (optional) — if you connect Stripe or Xero, we store an encrypted access token and pull read-only data (e.g. charges, invoices, contacts) to build your report on our servers. We keep only the resulting report metadata, never the raw records, and you can disconnect at any time. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Scheduled email reports (optional) — if you schedule a report, we store the schedule, your branding and the recipient email addresses, and email the generated PDF to those recipients on your chosen cadence. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

What we collect and why

  • Account data (email, name) — stored when you sign in via Google OAuth or magic link. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Anonymous usage data — a SHA-256 hash of your IP address, page count, and date, used to enforce the free-tier limit. The raw IP address is never stored. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
  • Payment data — processed entirely by Paddle, our Merchant of Record and the seller of record for your purchase. We store only your Paddle customer ID and subscription status; we never handle raw card details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Connection tokens — if you connect a data source (Stripe, Xero), we store an encrypted OAuth access/refresh token and the connected account ID so we can fetch your data. Tokens are encrypted at rest. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Published report data — if you create a shareable link, we store the computed report (aggregated figures and chart data), your company name, accent colour and any logo you upload. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Scheduled report settings — if you schedule recurring reports, we store the cadence, template, branding and the recipient email addresses you enter. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Cookies and sessions

We use a single secure session cookie to keep you signed in. No tracking or advertising cookies are used. Cloudflare Turnstile (CAPTCHA) may set a short-lived cookie for bot detection — it is GDPR-compliant and privacy-friendly.

Third-party processors

  • Paddle.com Market Ltd — payment processing & Merchant of Record (UK-based, GDPR-compliant)
  • Google OAuth — optional sign-in provider (EU Standard Contractual Clauses apply)
  • Cloudflare — CDN, DDoS protection, Turnstile CAPTCHA (EU–US Data Privacy Framework)
  • Anthropic PBC — AI commentary generation; receives only aggregated figures (US-based; used only if you enable AI commentary)
  • Stripe — read-only data source (used only if you connect your Stripe account)
  • Xero — read-only accounting data source (used only if you connect your Xero account)
  • Email delivery (SMTP) — sends magic-link sign-in emails and scheduled report PDFs to the recipients you specify

Data retention

Account data is retained as long as your account is active. Anonymous usage records are deleted automatically after 30 days. You can permanently delete your account and all associated data at any time from your dashboard.

Your rights (GDPR)

If you are in the EU/EEA, you have the right to access, rectify, and erase your personal data, receive it in a portable format, object to processing, and restrict processing. You also have the right to lodge a complaint with your national data protection supervisory authority.

Contact

For privacy questions or to exercise your rights, contact us at [email protected]