Skip to content
Report Reader
Legal & Trust Compliance

Privacy Policy

Last Updated: November 3, 2026 • Committed to document confidentiality, data residency, and enterprise privacy rights.

Privacy Policy

Effective Date: November 8, 2026 Last Updated: November 8, 2026 Version: 2.1 (Global & Regional Compliance Edition)

1. Introduction & Regulatory Scope

Report Reader ("we", "our", "us", or "the Service") operates a specialized software-as-a-service (SaaS) platform for preparing, publishing, vectorizing, and interactively presenting corporate, financial, environmental, and sustainability reports.

We respect your privacy and are committed to protecting personal data across all jurisdictions where we operate. This Privacy Policy outlines our data collection, handling, vectorization, storage, and retention practices in compliance with international and regional privacy laws, including:

  • European Union & United Kingdom: General Data Protection Regulation (GDPR / UK GDPR).
  • United States: California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
  • United Arab Emirates (UAE): Federal Decree-Law No. 45/2021 on Personal Data Protection (UAE PDPL) and financial free zone frameworks (DIFC Data Protection Law No. 5/2020 and ADGM Data Protection Regulations 2021).
  • Kingdom of Saudi Arabia (KSA): Personal Data Protection Law issued under Royal Decree No. M/19 (KSA PDPL).
  • State of Qatar & GCC: Law No. 13 of 2016 concerning the Protection of Personal Data Privacy (Qatar PDPCL).

2. Roles of the Parties (Controller vs. Processor)

Under applicable data protection frameworks:

  1. Customer as Data Controller: When a business customer ("Customer" or "Publisher") uploads documents, configures branding, or collects reader inquiries via lead capture gates, the Customer acts as the Data Controller. The Customer determines the lawful basis and purpose of processing.
  2. Report Reader as Data Processor: Report Reader acts strictly as a Data Processor (or "Service Provider") on behalf of the Customer. We process uploaded content and reader submissions solely in accordance with Customer instructions and our Data Processing Agreement (DPA).
  3. Report Reader as Independent Controller: We act as an independent Controller solely with respect to account management, billing data, authentication telemetry, and direct customer support communications.

3. Categories of Information We Collect

3.1 Customer Account & Profile Information

  • Contact Details: Full name, corporate email address, organization name, job title.
  • Authentication Data: Salted and hashed passwords (via bcrypt/Argon2), multi-factor authentication (TOTP) status, and OAuth2 session tokens (Google, Microsoft).
  • Billing Telemetry: Subscription tier, quota limits, invoice records, and masked payment tokens managed via PCI-DSS Level 1 compliant processors.

3.2 Customer Uploaded Documents

  • PDF Binaries & Document Metadata: Financial statements, ESG annual reports, whitepapers, investor slide decks, document titles, page counts, file dimensions, and checksums.
  • Processed Page Renditions: High-resolution vector page renderings, structural page layouts, thumbnail previews, and search indices.

3.3 Interactive Reader & Session Data

  • Interactive Query Telemetry: Natural language questions submitted by readers against public reports to generate citations and summarized responses.
  • Technical & Security Telemetry: Client IP address, user-agent string, timestamp, request latency, and anti-abuse telemetry (used strictly for rate limiting, DDoS mitigation, and audit logging).

3.4 Lead Capture Gate Submissions

  • When a Publisher enables a Lead Gate on a published report, reader submissions (e.g., reader name, email, company, job role) are encrypted and delivered directly to the Publisher's tenant dashboard.

4. AI Processing, Vectorization & Data Isolation

We maintain an uncompromising architecture regarding artificial intelligence and confidentiality:

  • Zero Foundation Model Training: Customer documents, extracted report texts, and reader questions are NEVER used to train, tune, or improve general AI models of third-party foundational providers.
  • Tenant-Isolated Vector Indices: Text chunk embeddings are segregated using PostgreSQL Row-Level Security (RLS). Vector similarity searches are cryptographically locked to the tenant and specific document boundary.
  • Stateless AI Retrievals: All contextual inferences are executed via stateless API calls that do not retain Customer data beyond query response generation.

5. Middle East & International Data Transfers

5.1 Middle East Regional Compliance (UAE, KSA, GCC)

  • In alignment with UAE Federal Decree-Law No. 45/2021 and KSA PDPL Royal Decree M/19, cross-border transfers of personal data are conducted only to jurisdictions providing an adequate level of protection or supported by approved Standard Contractual Clauses (SCCs).
  • Customers subject to localized data residency mandates may request isolated regional cloud storage deployment (e.g., UAE or KSA sovereign cloud availability zones).

5.2 Cryptographic Safeguards

  • Data in Transit: Enforced TLS 1.3 encryption across all public APIs and viewer embeds.
  • Data at Rest: Industry-standard AES-256 encryption applied to database storage volumes, S3-compatible object buckets, and automated backups.

6. Data Retention & Document Lifecycle

  • Active Subscriptions: Documents and lead records remain available in the Customer's isolated workspace for the duration of their active subscription.
  • Account Cancellation & Grace Period: Following subscription cancellation or account soft-deletion, documents are unpublished immediately and retained for a 30-day grace period, after which they are permanently purged.
  • Security Audit Logs: System audit and access logs are retained in immutable storage for a minimum of 90 days to satisfy compliance and incident investigation obligations.

7. Reader & Customer Data Rights

Depending on your country of residence, you are entitled to the following rights:

  1. Right to Access & Portability: Request confirmation of whether your data is being processed and obtain an export of your information in a machine-readable format.
  2. Right to Rectification: Request correction of inaccurate or incomplete personal records.
  3. Right to Erasure ("Right to Be Forgotten"): Request permanent deletion of your personal records and lead submissions.
  4. Right to Restrict or Object to Processing: Object to automated processing or request temporary suspension of data handling.
  5. Right to Withdraw Consent: Where processing relies on consent, withdraw your consent at any time without affecting past lawful processing.

Reader Deletion Portal: Report readers whose data was captured via a publisher's lead gate may exercise their erasure rights directly through the report publisher or by contacting our Data Protection Officer.

8. Sub-processors & Infrastructure Partners

We engage trusted infrastructure and cloud partners who adhere to rigorous security standards (ISO 27001, SOC 2 Type II):

  • Cloud Hosting & Database Storage: AWS, Google Cloud, or isolated sovereign regional data centers.
  • Object Storage Service: MinIO / AWS S3 with bucket-level server-side encryption.
  • Email Infrastructure: Enterprise SMTP / transactional notification gateways.

9. Contact Information & Data Protection Officer

For privacy inquiries, regulatory notices, or to exercise your statutory data protection rights, please contact our Legal & Privacy Desk:

  • Data Protection Officer (DPO): legal@reportreader.internal
  • General Privacy Inquiries: privacy@reportreader.internal
  • Compliance & Security Desk: compliance@reportreader.internal