Privacy policy
Effective 10 October 2026
Who we are
iReport (“we”) is a financial analysis service. We are the controller of the personal data described here, within the meaning of Egypt's Personal Data Protection Law No. 151 of 2020. Questions or requests: support@example.com.
What we collect
- Account details: your name, email address, a securely hashed password, the organisations you belong to and your role in each.
- Financial data you provide: files you upload (for example general ledger, trial balance and profit and loss exports) or data read from your Odoo database when you connect it, plus settings, targets, commentary and reports you create. This can include names of customers, suppliers or staff that appear in account names or notes.
- Odoo credentials: the address, database, login and API key you enter. The API key is encrypted before it is stored and is never shown again or included in exports.
- Technical data: your IP address and request details in server logs and, for abuse protection, in rate-limit records kept for up to 8 days.
- Cookies: only the essential cookies that keep you signed in. We use no advertising or analytics cookies.
How we use it
- To provide the service: read and organise your financial data, calculate analysis and KPIs, and produce reports you choose to share.
- To run your account: sign-in, password reset, invitations from colleagues and service emails.
- To keep the service secure and reliable: preventing abuse, investigating errors and keeping logs.
We process your data to perform our agreement with you (these purposes) and, where the law requires it, with your consent, which you give when you create an account and can withdraw by deleting it. We do not sell your data, use it for advertising, or use your financial data to train AI models.
AI commentary and PDF reading
When someone in your organisation asks for AI-written commentary, the figures and business context needed for that commentary are sent to Anthropic, our AI provider, to generate the text. When someone uploads a PDF or a scanned page, each page is sent to Anthropic to read its figures. We do not store the page; only the figures you confirm are imported. Anthropic may keep requests for a limited period under its commercial terms (for example to prevent abuse). Anthropic processes this data on our behalf and does not use it to train its models. Nothing is sent to the AI provider unless a user asks for commentary or uploads a PDF.
Who processes data for us
- Supabase: database and sign-in. Data is stored in the European Union (Ireland).
- Vercel: hosting of the application.
- Anthropic: AI commentary and reading uploaded PDF pages, only when requested.
- Email delivery: the provider that sends sign-in and invitation emails.
These providers act on our instructions under contracts that require them to protect the data. Because they operate outside Egypt, your data is transferred to and stored outside Egypt, in countries with data protection rules at least comparable to Law 151/2020 (in particular the European Union). By using the service you agree to this transfer.
Who else can see your data
Members of your organisation see its companies according to the role an admin gives them. A report becomes visible to anyone with its link only when you publish it, and you can stop sharing or set the link to expire at any time. We disclose data to authorities only when Egyptian law requires it.
How long we keep it
- Your account and financial data are kept while your account is open.
- Deleting a company, an organisation or your account removes that data from our database immediately. Encrypted backups held by our database provider are overwritten on their normal cycle, within 30 days.
- Server logs and rate-limit records are kept for a short time (rate-limit records up to 8 days).
Your rights
Under Law 151/2020 you can:
- Access and portability: download your personal data from Account → Your data, and each company's data from its settings → Profile.
- Correction: change your name and password on the Account page, and edit company data at any time.
- Deletion: delete companies, organisations or your whole account yourself, from the app.
- Objection and withdrawal of consent: stop using the service and delete your account, or write to us.
For anything you cannot do in the app, email support@example.com. We answer within 30 days. You may also complain to Egypt's Personal Data Protection Centre.
Security
Data is encrypted in transit and at rest. Access is restricted by organisation and role, Odoo API keys are encrypted with a separate key, and every company's data is isolated in the database. No system is perfectly secure; if a breach affects your personal data, we will inform you and the authorities as the law requires.
Children
The service is for businesses and is not intended for anyone under 18.
Changes
If we change this policy in a way that matters, we will tell signed-in users before the change takes effect. The date at the top shows the latest version.
Contact
iReport: support@example.com.