Privacy Policy

Reportly ("we", "us", "our") is a client-reporting platform for marketing agencies, operated at tryreportly.com. This policy explains what data we collect, why, and how it's handled — for both agencies who use Reportly directly, and the agencies' own clients whose marketing data flows through the platform.

Account data: name, email, agency name, and password (one-way hashed) when you register.

Client & report data: the client names, metrics, and report content you create or generate inside your account.

Connected marketing accounts: if you connect a client's Google Analytics (GA4), Meta Ads, Google Ads, Google Search Console, HubSpot, Mailchimp, LinkedIn Ads, TikTok Ads, or Microsoft Advertising account, we store the access tokens needed to pull that account's metrics on your behalf, and the metrics data itself for report generation. We never request more access than a given integration needs.

Billing data: subscription and payment processing is handled by Lemon Squeezy, our merchant of record — Reportly does not store your card details. We do store your plan, billing status, and Lemon Squeezy customer/subscription IDs.

Usage & device data: IP address, browser/user-agent, and login timestamps, kept for security purposes (e.g. detecting suspicious login activity).

• To operate your account, generate reports, and provide the features you use.
• To pull metrics from marketing platforms you've explicitly connected, for the sole purpose of building your reports.
• To generate AI-written summaries and insights inside your reports, using OpenAI's API — the metrics needed for a given report are sent to OpenAI to produce that summary; they are not used by OpenAI to train models under their API terms.
• To send transactional emails (verification, password reset, report delivery, billing notices) via our email provider, Resend.
• To process payments and manage subscriptions via Lemon Squeezy.
• To detect fraud, abuse, and unauthorized access, and to enforce our Terms of Service.

We do not sell your data, or your clients' marketing data, to third parties.

Reportly relies on the following processors to operate. Each only receives the data necessary for its function:

• Google (GA4, Google Ads, Search Console): for connecting your clients' marketing data.
• HubSpot, Mailchimp, Meta: for connecting other marketing/CRM data sources you choose to link.
• LinkedIn Ads, TikTok Ads, Microsoft Advertising: for connecting other ad platform data sources you choose to link.
• OpenAI: generates AI report insights from your metrics (not used to train their models).
• Lemon Squeezy: processes payments and acts as merchant of record.
• Resend: sends transactional emails (verification, password reset, report deliveries, receipts).
• Supabase: hosts our database (all account, client, and report data).
• Render: hosts our application backend.
• Cloudflare: network security and DDoS protection.

We keep your account and report data for as long as your account is active. If you close your account, we delete your data within a reasonable period, except where we're required to retain billing records for legal/tax purposes. Disconnecting an integration (GA4, Ads, etc.) immediately revokes our access and removes the stored token.

Depending on where you're located, you may have the right to access, correct, export, or delete your personal data. To exercise any of these rights, contact us at the email below — we'll respond within a reasonable timeframe.

Passwords are hashed, not stored in plain text. Sensitive tokens (OAuth credentials for connected integrations) are encrypted at rest. We use rate limiting and account lockouts to guard against brute-force login attempts, and support optional two-factor authentication (mandatory for admin accounts).

Reportly is a B2B tool intended for marketing professionals and agencies. It is not directed at, and we do not knowingly collect data from, anyone under 18.

We may update this policy as Reportly evolves. Material changes will be reflected by updating the "Last updated" date above.

Questions about this policy or your data? Reach out and we'll get back to you.