Privacy Policy

1. Introduction

Welcome to Report Alchemy ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service").

Report Alchemy is operated by Sagwa Limited. We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our policy or our practices with regards to your personal information, please contact us at contact@report-alchemy.com.

2. Information We Collect

We collect several types of information for various purposes to provide and improve our Service to you:

2.1. Personal Information:

• Name and email address (collected when you sign up using Google Sign-In).
• Billing information (if you make purchases).

2.2. Usage Data:

• Information on how you use the Service.
• Your IP address, browser type, and browser version.
• The pages of our Service that you visit and the time and date of your visit.
• The time spent on those pages and other diagnostic data.

2.3. User-Generated Content:

• Any information you input into our Service to generate reports.
• The content of generated reports.

2.4. Cookies and Similar Tracking Technologies:

• We use cookies and similar tracking technologies to track activity on our Service and hold certain information.

3. How We Use Your Information

We use the information we collect in various ways, including to:

• 3.1. Provide, operate, and maintain our Service.
• 3.2. Improve, personalise, and expand our Service.
• 3.3. Understand and analyse how you use our Service.
• 3.4. Develop new products, services, features, and functionality.
• 3.5. Communicate with you, including for customer service, updates, and marketing.
• 3.6. Send you emails.
• 3.7. Find and prevent fraud.
• 3.8. Process your payments.
• 3.9. Use Google Ads Enhanced Conversions to measure and improve advertising effectiveness by securely sharing hashed user data (such as email addresses) with Google.

We do not use the content you enter, or the reports we generate for you, to train or improve any AI model — ours or anyone else's. Report content is sent to our AI provider solely to produce your report and is returned to you; it is not used by them for model training.

4. Data Storage and Security

4.1. Data Storage: We use industry-standard methods to keep your information safe and secure while it is transmitted over your network and through the Internet to our servers. However, no method of transmission over the Internet or method of electronic storage is 100% secure, so we cannot guarantee its absolute security.

4.2. Data Location: Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

4.3. Security Measures: We implement appropriate technical and organisational security measures to protect the security of your personal information. However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure.

4.4. Third-Party Services: We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services, or to assist us in analysing how our Service is used. These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

4.5. Sub-processors

Where a school uses Report Alchemy, the school is the data controller and we act as a processor. These are the sub-processors we engage, what they receive, and where they process it:

Minimising pupil data: Report Alchemy only needs a pupil's first name, and does not ask for surnames, dates of birth, addresses or any other identifier. We recommend teachers enter first names only, or initials. Teachers can also switch on pseudonymised generation, which replaces pupil names with placeholders before anything is sent for generation and restores them on our own servers, so no pupil name reaches our AI provider at all.

For schools: our Article 28 UK GDPR Data Processing Agreement is published in full and can be accepted online, and there is a data protection impact assessment your DPO can use as a starting point. Everything a DPO needs is collected at report-alchemy.com/data-protection.

5. Sharing of Your Information

We do not share, sell, rent, or trade your information with third parties without your consent, except as described below:

5.1. Business Transfers: If we or our assets are acquired by another company, or in the unlikely event that we go out of business or enter bankruptcy, user information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur and that any acquirer may continue to use your personal information as set forth in this policy.

5.2. Legal Requirements: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.

5.3. Vital Interests and Legal Rights: We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person, or illegal activities.

5.4. Service Providers: We may share your information with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information.

5.5. With Your Consent: We may disclose your personal information for any other purpose with your consent.

6. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information. These may include:

6.1. Access: Request a copy of the personal information we hold about you.

6.2. Rectification: Request that we correct any inaccurate or incomplete personal information we hold about you.

6.3. Erasure: Request that we delete your personal information in certain circumstances.

6.4. Restriction: Request that we restrict the processing of your personal information in certain circumstances.

6.5. Data Portability: Request a copy of your personal information in a structured, commonly used, and machine-readable format.

6.6. Objection: Object to our processing of your personal information in certain circumstances.

6.7. Withdraw Consent: Withdraw your consent at any time if we are relying on your consent to process your information.

To exercise any of these rights, please contact us at contact@report-alchemy.com. We will respond within a reasonable timeframe and in accordance with applicable data protection laws.

7. Cookies and Similar Technologies

7.1. What Are Cookies? Cookies are small pieces of text sent by your web browser by a website you visit. A cookie file is stored in your web browser and allows the Service or a third party to recognise you and make your next visit easier and the Service more useful to you.

7.2. How We Use Cookies: We use cookies and similar tracking technologies to track activity on our Service and hold certain information. Cookies help us understand how you use our site and improve your experience, including keeping you signed in, understanding your usage, remembering preferences, and providing personalised content.

7.3. Types of Cookies We Use:

• Essential cookies required for the operation of our website.
• Analytical/performance cookies that help us understand how visitors use the site.
• Functionality cookies that allow us to remember your preferences.
• Targeting/advertising cookies that record your visit to our site to help deliver relevant content.

7.4. Managing Cookies: You can manage or disable cookies through your browser settings. However, if you choose to refuse cookies, some portions of our Service may not be fully functional.

8. Third-Party Links and Services

The Service may contain links to third-party websites and services that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

9. Children's Privacy

Our Service does not address anyone under the age of 16. We do not knowingly collect personally identifiable information from anyone under the age of 16. If you are a parent or guardian and you believe that your child has provided us with personal information, please contact us so that we can delete such information and take appropriate action.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Changes are effective when they are posted on this page. We will notify you of any significant changes, and we encourage you to review this Privacy Policy periodically for updates.

11. International Data Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those of your jurisdiction. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

12. Data Retention

12.1. Pupil records, teachers' notes and generated reports. You choose a retention period for these on the My Pupils screen:

12.2. Writing a new report about a pupil restarts their clock. Deletion removes the pupil record, every report generated for them, the notes behind those reports and any saved suggestions. It is immediate and cannot be undone.

12.3. Automatic deletion is currently switched off. We would rather say so than let you assume a timer is running. The period above is the schedule we work to and will apply if you ask us; nothing is presently deleted on its own when it expires. We will give at least 30 days' notice here before switching automatic deletion on.

12.4. That is why the controls below matter, and they work today. You can delete an individual pupil and everything we hold about them at any time from My Pupils, or delete your whole account and all its data from the same screen. Both take effect immediately.

12.5. Report formats are kept until you delete them, because they are your templates rather than pupil data. Note that a format's example report is stored as you saved it, so if you pasted in a real past report it will contain whatever that report contained.

12.6. Account and billing records. Your name, email address and billing history are kept while your account is open, and payment records for six years afterwards, as UK tax law requires.

12.7. Database backups are retained by our hosting provider for up to seven days, so deleted data can persist in an encrypted backup for that period before ageing out.

12.8. Schools should read the fuller account written for data protection officers at report-alchemy.com/data-protection.

13. Legal Basis for Processing Personal Information (EEA and UK Users)

13.1. If you are from the European Economic Area (EEA) or the United Kingdom, our legal basis for collecting and using the personal information described in this Privacy Policy depends on the personal data we collect and the specific context in which we collect it.

13.2. Report Alchemy may process your personal data because:

• We need to perform a contract with you.
• You have given us permission to do so.
• The processing is in our legitimate interests and is not overridden by your rights.
• To comply with the law.

13.3. If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the details provided in the "Contact Us" section.

14. Your California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

14.1. Right to Know: Request that we disclose certain information about our collection and use of your personal information over the past 12 months.

14.2. Right to Delete: Request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.

14.3. Right to Opt-Out: If we sell personal information, you have the right to opt out. We do not currently sell personal data.

14.4. Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your rights under the CCPA, please contact us using the details provided in the "Contact Us" section. We may need to verify your identity before responding to your request.

15. Contact Us

If you have any questions about this Privacy Policy, please contact us using the details below: