Privacy Policy

1. Who is responsible

ReportBridge is provided by Steve Harlow, an individual, who is responsible for the personal data described here. For customer content that an organization puts into ReportBridge, that organization decides what goes in, and we process it on its behalf. Contact: support@report-bridge.com.

2. What we collect

When you visit this website

• Analytics. Every page loads Google Analytics, which records the pages you view, a handful of site events (for example, reaching the demo or submitting an application), your browser and device, and your approximate location. We use it to understand which pages and campaigns work.
• Ad measurement. If you arrive from one of our Google ads, the ad-click identifier and campaign tags in the link are kept in your browser and attached to any application you send, so we can tell which ads lead to applications. Google Ads receives conversion signals through the same Google tag.
• Embedded videos. Some pages embed YouTube videos, so YouTube receives your IP address and browser details when those pages load.
• Server logs. Our website host, Vercel, keeps standard request logs such as IP address, time and page requested.
• The free assessment. The browser-based migration assessment reads your RDL files inside your browser and uploads nothing. Only if you ask for an emailed copy do we receive the summary figures and the contact details you type, as the Security page describes.

When you apply, subscribe or contact us

• The beta application collects your name, work email, company, job title, your answers about your reporting estate, how you heard about us, and any notes you add.
• The newsletter collects your email address. Emails you send us are kept in our mailbox.
• If we contact you about ReportBridge, we keep the business contact details we used, such as your name, work email and public profile link, and a record of the conversation.

When you use the service

• Account data. Your email address, name, role and sign-in history, held by our sign-in provider, Clerk, and in our own user and audit records.
• Billing. Payments are handled by Stripe. We keep the Stripe customer and subscription identifiers, your plan and its status. We never receive or store full card numbers.
• Customer content. The RDL report files you upload, their original and converted SQL, validation and conversion history, and the report definitions we publish to our Bold Reports server.
• Database connection details. The host, port, database name, user name and password for each database you connect. We ask for a read-only credential.
• Report data. Reports are rendered by querying your database when someone views them. Rendered output for background and scheduled runs is stored so it can be delivered.
• Email. Account and application emails, and scheduled-report notices. Scheduled-report emails carry a link to the report, not the report's data.
• Operational records. Service logs, error reports and usage events needed to run and secure the service, kept in our own cloud account.

We do not sell personal information, and we do not use customer content to train AI models.

3. How AI is used

To convert a T-SQL query to PostgreSQL, or to repair a converted query that fails validation, we send the AI model:

• the query text;
• schema details for your database, meaning table and column names, data types and key information;
• report parameter names and their default values; and
• when repairing a query, the error message your database returned, which can occasionally quote a data value.

We do not send your RDL files or rows of your data. The models are Anthropic's Claude models. We call Anthropic's API directly, and if that fails, the same request goes to the same family of models through Amazon Bedrock, part of Amazon Web Services, in the United States.

4. Who processes it, and where

These providers process personal data or customer content for us. Our own platform runs in a dedicated Amazon Web Services account in the United States, and the Bold Reports server that renders your reports is software we run ourselves on that account.

If you use ReportBridge inside Domo, we also exchange data with your own Domo instance through Domo's API, on your instructions. If you are outside the United States, your data is transferred to and processed in the United States.

5. How long we keep it, and deleting it

We have not yet set fixed retention periods, and nothing deletes data automatically on a schedule. Today:

• Customer content, connection details and account data are kept while your account exists. When a subscription ends, access is switched off but the data is not deleted automatically.
• Deleting a report inside the app removes it from our database and from the Bold Reports server. Stored copies of the uploaded RDL file are not removed by that action.
• There is no self-serve way to delete a whole account yet. Email support@report-bridge.com and we will delete your account, customer content and stored files by hand, and confirm when it is done.
• Database backups are kept for 7 days, and daily backups of the Bold Reports server are kept in our storage, so deleted data can remain in backups for a period after deletion.
• Application and newsletter records are kept until you ask us to remove them or unsubscribe. Every newsletter email has an unsubscribe link.
• Google Analytics data is kept for the retention period set in our Analytics account.

6. Cookies and similar storage

• Analytics and ads: Google Analytics sets _ga and _ga_* cookies to tell visits apart. When you arrive from an ad, Google may also set advertising cookies such as _gcl_au. Analytics loads on every page without a separate consent prompt. You can block it with your browser's tracking protection or Google's Analytics opt-out add-on, and the site still works.
• Sign-in: Clerk sets session cookies such as __session and __client_uat to keep you signed in.
• Abuse protection: short-lived cookies named rb-signup-rl, rb-sub-rl and rb-asmt-rl limit how often a form can be submitted.
• In your browser: local storage holds ad-click tags from the page you landed on, your application reference, whether you dismissed the site banner, and, in the web app, your connection settings and sign-in token.
• Videos: YouTube may set its own cookies on pages with an embedded video.

7. How it is protected

• Connections to the website, the API and our database use TLS. Our database is encrypted at rest.
• Every query is scoped to your tenant, report embeds are HMAC-signed with a per-tenant secret, and no report is public.
• Your workspace’s own connection credentials are encrypted with a per-tenant key held in AWS KMS. Passwords for additional data-source connections you add are stored inside that encrypted database, and on the Bold Reports server so reports can render, but are not yet encrypted separately at the field level. That is one reason we ask for a read-only credential.
• ReportBridge does not hold a SOC 2 attestation today. The Security page states exactly what is and is not in place, including how a data processing agreement is handled.

8. Your rights

Depending on where you live, you may have the right to ask for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent. Email support@report-bridge.com with your request; we may need to confirm your identity, and we aim to reply within 30 days.

If your request is about data your organization put into ReportBridge, we will pass it to that organization or act on its instructions. You can also complain to your local data protection authority.

9. Children

ReportBridge is a business service and is not directed at children. We do not knowingly collect children's data.

10. Changes to this policy

We update this policy when what we collect, or who processes it, changes. The date at the top changes with every edit. If a change materially affects customers, we will email account owners before it takes effect.

11. Contact

Questions or requests about privacy: support@report-bridge.com.