Privacy notice

This notice explains how Arboretica B.V. processes personal data when you visit or use Report Scout at reportscout.app. Arboretica B.V., Burgemeester Oudlaan 50 N1.09, 3062 PA Rotterdam, the Netherlands, is the controller. Contact us at info@arboretica.com.

Information we process

• Account and authentication data: email address, optional name and organisation, password hash, verification status, and Google, LinkedIn or X account identifiers when you choose social sign-in.
• Service data: alert settings, selected companies and report types, digest cadence, report interactions, feedback and support requests.
• Recommendation context: for signed-in users who have not opted out, only the latest company or report interaction, its source and time. It overwrites the previous interaction and expires after 30 days.
• Billing data: Stripe customer, subscription, invoice and payment-status identifiers. A Stripe customer record is created only when you start a checkout. Stripe receives payment-card details; Report Scout does not store complete card details or security codes.
• Email data: recipient, template, delivery status, suppression status and important link interactions. We do not rely on email opens as a definitive engagement measure.
• Technical and consent data: security logs, consent category choices and, only after consent, limited analytics such as page, referrer, device class and pseudonymous session identifiers.

Sources and purposes

We receive information from you, your browser when permitted, Stripe, Resend, and the OAuth provider you select. We use it to create and secure accounts; provide alerts and reports; administer billing; respond to requests; prevent abuse; make a narrowly scoped company recommendation; measure and improve the service when consented; and meet legal obligations.

Legal bases

• Contract and steps before a contract for accounts, authentication, requested alerts, report delivery and subscription administration.
• Legal obligation for required accounting, tax and compliance records.
• Legitimate interests for security, abuse prevention, service reliability and the limited 30-day signed-in recommendation context. You may object or disable recommendations at any time.
• Consent for optional analytics/performance storage and promotional communications where consent is required. Consent can be withdrawn as easily as it is given.

Account email, authentication and alert choices are required to provide monitoring. Optional profile, analytics, marketing and recommendation choices are not required to use the core service.

Service providers and recipients

We use Vercel for the frontend and consented analytics/performance data; Google (Google Analytics 4) for consented website analytics; our configured application and database hosting providers; Resend for email; Stripe for billing; Termly for consent management; Google, LinkedIn and X for optional sign-in; and OpenAI for report discovery and company-name resolution. OpenAI is used on public report/company material or company names submitted for resolution, not to provide a user-facing chatbot or to process account passwords.

Providers process data under contractual restrictions. Some providers or subprocessors may process data outside the EEA or UK. Where required, we rely on adequacy decisions, the EU-US Data Privacy Framework, Standard Contractual Clauses and UK transfer safeguards. Contact us for information about the safeguard relevant to a particular transfer.

Retention

• Recommendation context: 30 days.
• Unconfirmed alert claim: confirmation expires after 7 days; the record is removed within 30 days after expiry or use.
• Consented raw growth events: up to 12 months; important email-link detail: 180 days; outbound delivery metadata: 12 months; provider diagnostic event detail: up to 30 days.
• Google Analytics: event-level data 14 months; its cookies up to 13 months.
• Application logs: normally 30 days; security/audit logs: normally 90 days unless an incident requires a documented hold.
• Account data: while the account is active and then deleted, subject to backup rotation and legal exceptions. When you delete your account we cancel any subscription and delete your billing profile and saved payment methods at Stripe. Invoices and payment records are not deleted: Dutch financial and invoice records are retained, by Stripe and by us, for seven years where required.
• Minimum suppression data is retained as needed to honour unsubscribe, bounce and complaint choices. Consent evidence may be retained for five years where necessary to demonstrate compliance.

Your rights

Depending on applicable law, you can request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You can withdraw consent and object to direct marketing at any time. Use Your data or contact us. We normally respond within one month after any necessary identity verification.

You may complain to the Autoriteit Persoonsgegevens or another competent supervisory authority.

Automated decisions, security and children

Report Scout does not make decisions with legal or similarly significant effects solely by automated means. Recommendations simply select a recently viewed company or report and do not change price, access or eligibility. We use access controls, encryption in transit, hashed passwords, limited staff access and monitoring appropriate to the service. No internet service is completely secure.

Report Scout is a professional service and is not directed to children under 16. Contact us if you believe a child supplied personal data.

Changes

We will update the date above and provide additional notice when a material change affects how existing account data is used or requires renewed consent.