Privacy Policy

This privacy policy provides information about the processing of personal data within the free demo/beta version of Reporio (hereinafter “Reporio” or the “service”). It is provided for your information and is not contractually “accepted”.

1. Controller

Christoph Bauer
CLICKIT DIGITAL
Sacherberg 5
86660 Tapfheim, Germany
Email: christoph.bauer@clickit-digital.de

Competent supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

2. Provision and hosting

Reporio and its associated database are hosted in Germany by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. In doing so, technical connection and server data are processed, in particular the IP address, the time of the request, the requested resource, browser information and error data. The purpose is the provision, stability, error analysis and security of the service. The legal basis is Art. 6(1)(b) and (f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the host.

3. Delivery via Cloudflare (reverse proxy / CDN)

The public hosts repor.io, app.repor.io and reports.repor.io are delivered via Cloudflare as a reverse proxy and content delivery network. Cloudflare thereby processes the IP address, TLS and connection information, requested URLs, timestamps, HTTP headers and security-related information. The purposes are secure delivery, TLS encryption, protection against attacks as well as availability and performance. The legal basis is Art. 6(1)(f) GDPR. Cloudflare is an internationally operating provider based in the USA; this involves a transfer to a third country (USA) which is based on a data processing agreement with EU standard contractual clauses.

4. Pre-launch waitlist

Reporio is currently in a pre-launch phase. If you sign up for the waitlist, we process the email address you provide, the interface language selected at the time, and the timestamp of your consent. The purpose is to notify you by email once Reporio becomes publicly available. The legal basis is your consent (Art. 6(1)(a) GDPR), given via the checkbox in the signup form. No payment processing takes place during this phase; section 10 describes the payment processors already prepared for the future paid version.

We do not send any other emails to waitlist entries and do not use the address for advertising or profiling. Every confirmation email contains a link that lets you remove yourself from the waitlist at any time, without needing to log in; this immediately withdraws your consent (Art. 7(3) GDPR). Waitlist entries are kept until you unsubscribe or until Reporio's public launch, whichever comes first.

5. User account and organisations

To use Reporio you create a user account. We process in particular the email address, a freely chosen name or display name, the password hash (never the plaintext password), membership of and affiliation to organisations, roles and permissions as well as login, security and time information; for security-relevant operations possibly also the IP address.

The purposes are registration, login, provision of the user account, organisation and permission management as well as abuse and security prevention. There is no obligation to provide your real name; user profiles are not public. The legal basis is Art. 6(1)(b) and (f) GDPR.

6. Use of the Reporio platform

To provide the SaaS service we process the data you enter and the data generated during operation, in particular: organisations and memberships; projects as well as any freely entered project or client names; domains and URLs; keywords; search engine; country and location; language; device type (desktop/mobile); ranking, SERP, competitor and visibility data; report configurations and schedules; report recipients; generated reports and report PDFs; report links and shares; delivery status; event logs; the activity feed as well as audit, diagnostic and error data.

The purposes are the provision of the Reporio service, the collection and preparation of SEO data, the creation and delivery of reports, collaboration within an organisation, error diagnosis, operational security, abuse prevention and the traceable documentation of important system operations.

The legal bases are Art. 6(1)(b) GDPR (user or contractual partner), Art. 6(1)(f) GDPR (security, error analysis, abuse prevention, stable operation) as well as Art. 6(1)(c) GDPR insofar as statutory retention obligations exist.

7. SEO data provider (DataForSEO)

To query search engine and ranking data we use the SEO data provider DataForSEO. For each query we transmit the keyword, the language code, the device type, the operating system, the query depth and the location code or location name. The user account, email address, organisation, project ID or internal user IDs are not systematically transmitted.

Through the same provider we also retrieve individual publicly accessible web pages for analysis: the project's own pages and the pages of competitors that appear in the search results for the monitored search terms. Only the respective page URL is transmitted; the user account, email address, organisation or project ID are not. The retrieval is performed by DataForSEO, not by our servers, and covers one individual address at a time — entire websites are not crawled.

We do not store a full copy of the retrieved page, but a structured analysis: metrics such as word count, page size, number of links and images, HTTP status, indexability and canonical address, plus the text fields title, meta description and headings. The purpose is to compare a page with its own earlier state and with competitor pages, in order to detect changes and derive recommendations from them. The legal basis is Art. 6(1)(b) and (f) GDPR.

Depending on your input, keywords and location information may in individual cases contain a personal reference. Further information can be found in the DataForSEO privacy policy (https://dataforseo.com/privacy-policy).

8. Automated report texts (Groq)

For the automated creation or linguistic preparation of report texts we use the AI service Groq (Groq, Inc., USA). Reduced evaluation data is transmitted; this may include the project name, ranking movements, competitor data, summarised insights, warnings, signal texts and statistical information. Raw data, complete SERP snapshots, internal IDs, keyword IDs and provider costs are removed before transmission according to the current state of the application. Because of the project name and any free-text content, a personal reference cannot be entirely ruled out in individual cases.

A transfer to a third country (USA) takes place, which is based on a data processing agreement with appropriate safeguards (in particular EU standard contractual clauses).

9. Email delivery (Resend)

For sending emails we use the service Resend (Plus Five Five, Inc., trading as Resend, USA). Transactional emails are sent, in particular report delivery, organisation invitations, waitlist confirmations and operational or technical notifications. We transmit the recipient's email address, the subject, the HTML and text content as well as, where applicable, a complete report PDF as an attachment. We also store the delivery status, error status and time. No open or click tracking is used.

A transfer to a third country (USA) takes place, which is based on a data processing agreement with EU standard contractual clauses.

10. Payment processing (Stripe, PayPal)

Reporio is currently in a pre-launch phase without live payment processing (see section 4) — neither Stripe nor PayPal is currently connected with live credentials, and no payment data is transmitted yet. Both are technically prepared as payment processors for the future paid version of the product, which is why we describe them here in advance.

Once billing is active, checking out a plan will transmit an organisation ID and the selected plan and billing interval to the respective processor as reference/metadata; we do not transmit your name, email address or payment details ourselves. Instead, Stripe's or PayPal's own hosted checkout page collects your email address and payment details directly from you. After the payment is completed, the processor sends the email address you entered there, the payment status and (for Stripe) a customer/subscription identifier back to us via webhook, so we can activate your subscription.

Stripe (Stripe, Inc., USA) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, itself using group companies and sub-processors in the USA) act as our payment processors under a data processing agreement. Where processing takes place in the USA, this is based on appropriate safeguards (in particular EU standard contractual clauses). Further information can be found in Stripe's privacy policy (https://stripe.com/privacy) and PayPal's privacy policy (https://www.paypal.com/privacy).

11. Technically required storage in the browser

We use exclusively technically required storage mechanisms:

• a session cookie for login and session,
• a token to protect against cross-site request forgery (XSRF-TOKEN),
• storage of the chosen language in localStorage (key “reporio.locale”),
• storage of the chosen design/theme in localStorage (key “reporio-theme”).

These storage mechanisms serve exclusively for login, security and display preferences explicitly chosen by you. They are not used for advertising, profiling or audience measurement. No analytics or marketing cookies and no consent management platform are used. The legal basis is § 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

12. Contact

There is no contact form. If you contact us by email, we process your sender address, the subject, the content and technical transmission information insofar as this is necessary to handle your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR.

13. Erasure and retention

Where technically fixed periods exist, the following applies: event logs are deleted after 90 days, the activity feed after 180 days and application logs (Laravel) after up to 14 days as part of the existing rotation.

We process account, organisation, project and report data for the duration of use or of the contractual relationship. After deletion or the end of the contract they are deleted as soon as they are no longer required for contract performance, security, legal defence or statutory retention obligations. Backups may temporarily contain data until they are overwritten in the regular cycle. Documents required under tax and commercial law are retained in accordance with the statutory periods. In the event of security incidents, relevant log data may be stored longer until the matter has been finally clarified.

A fixed period additionally applies to individual report content: stored report snapshots (the frozen metrics and analysis text of a report) and their associated analysis text are automatically deleted 24 months after creation. If a snapshot is still linked to a report that was actually sent, it is retained beyond that period until that link no longer exists.

The page analyses described in section 7 are deleted automatically 400 days after they were recorded. The text fields they contain (title, meta description, headings) are removed earlier: as soon as a record is no longer needed for a comparison with a newer measurement or for the analysis period behind a report — the structural metrics remain, the text does not.

14. Your rights

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR)
• right to withdraw consent given (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.