Privacy, data rights, and regional compliance
We only process your chats to build the reports you ask for. No data sales, no advertising audiences. You can export or delete your data at any time.
Who operates The Chat Report
Art Skool LLC, operating as The Chat Report, is the operator and data controller for The Chat Report.
Our baseline promises
These apply everywhere we operate. When a regional rule is stricter, we apply the stricter option.
- We process chats, media, and metrics only to deliver your previews, reports, billing, and support.
- We do not sell personal data or use it for cross-context behavioral advertising.
- You control deletion. Remove uploads, reports, and accounts at any time and we propagate that to our processors unless law requires retention.
- Security-first: encryption in transit and at rest, least-privilege access, and audit logging on administrative actions.
- Minimal analytics: product analytics (including Vercel Analytics) that avoid cross-site ad tracking.
What we collect
Data you provide
- Account details (name, email), device identifiers when you sign in.
- Consents or authorizations you capture from chat participants; only upload content you have permission to share.
- Chat exports, media, and annotations you upload to build a report.
- Payment details handled by Stripe (we receive tokens, not full card numbers).
- Support messages and preferences (language, notifications, privacy choices).
Data created automatically
- Usage and device signals (browser/OS version, IP address, timestamps, performance events) to keep the service stable and secure.
- Product analytics (page interactions, feature usage) to improve flows.
- Derived insights (clusters, scores, share kits) created from your uploads to power the report.
Why we use it
- Provide previews, exports, and billing you request.
- Maintain security, prevent abuse, and detect errors.
- Improve onboarding and sharing effectiveness.
- Comply with legal obligations (tax, accounting, safety).
Legal bases for EEA/UK GDPR processing
Where the GDPR or UK GDPR applies, we process personal data under:
- Contract: to deliver the app, generate reports, process payments, and provide support you request.
- Consent: for optional actions you start (e.g., connecting external sources or receiving marketing emails).
- Legitimate interests: to improve the product, keep it secure, prevent fraud/abuse, and understand feature performance—balanced against your rights.
- Legal obligation: to meet tax, accounting, and compliance duties, and to respond to lawful requests.
Cookies and local storage
We use essential cookies/local storage for authentication, session continuity, and rate limiting. We rely on privacy-forward analytics (including Vercel Analytics) that avoid ad tracking. If you block non-essential cookies, the core app still works.
Regional rights at a glance
We honor the strongest applicable rights based on your location and the location of people whose data you upload.
EEA + UK (GDPR / DPA 2018)
- Access, obtain a copy, and portability of personal data.
- Correct inaccurate data.
- Delete data when it is no longer needed or consent is withdrawn.
- Restrict or object to processing, including marketing.
- Withdraw consent at any time.
- Lodge a complaint with your supervisory authority (e.g., ICO in the UK or your local DPA).
California (CCPA/CPRA)
- Know the categories and specific pieces of personal information we collect and disclose.
- Delete and correct personal information.
- Opt out of “sale” or “sharing” for cross-context behavioral advertising. We do not sell or share data for ads; if that ever changes, we will surface a Do Not Sell/Share control.
- Limit use/disclosure of sensitive personal information to the services you request.
- Use an authorized agent to submit a request; we may verify identity and authority.
- Freedom from discrimination for exercising your rights.
Virginia, Colorado, Connecticut, Utah, and similar U.S. laws
- Access, confirm, and receive a copy of personal data.
- Correct and delete personal data.
- Opt out of targeted advertising, sale, or certain profiling.
- Appeal if you disagree with our response; reply “Appeal” to our decision and we will re-review within required timelines.
- No discrimination for exercising your rights.
Canada (PIPEDA)
- Access and obtain information about your personal data.
- Request corrections to inaccurate or incomplete data.
- Withdraw consent where processing is based on consent; this may affect service delivery.
- File a complaint with the Office of the Privacy Commissioner.
Australia & New Zealand
- Access and correction rights under the Privacy Acts.
- Complaints can be directed to us first, then to the OAIC (AU) or OPC (NZ) if unresolved.
Other regions
- We aim to honor equivalent rights where local law requires them (e.g., Brazil LGPD, Switzerland nFADP).
- Cross-border transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses where applicable).
How to exercise your rights
- Use in-product controls (Account > Export All Data and Account > Delete Account) to export or request deletion. Group admins can also delete uploads and generated reports; we process those requests promptly.
- Email us at info@thechatreport.com with the request type (access, delete, correction, objection, limit, opt-out) and the email used in your account.
- We respond within 30–45 days (or faster where required). If you appeal a decision, reply “Appeal” and we will re-review within the timelines set by your state law.
Data retention and deletion
- We retain uploads, generated modules, and share kits while your account remains active or until you delete them.
- When you delete data or your account, we remove it from active systems and instruct processors to do the same, except where retention is required for fraud prevention, accounting, or legal obligations.
- Aggregated or de-identified analytics may be kept to improve the service without re-identifying individuals.
Sharing and transfers
We use vetted processors under data protection agreements and limit their use to our instructions.
- Hosting and storage: cloud infrastructure (including Google Cloud and Supabase) to run the application.
- Payments: Stripe for checkout and billing; we do not store full card numbers.
- Analytics and product performance: privacy-forward analytics such as Vercel Analytics to understand feature adoption.
- AI processing: where we use third-party model providers (e.g., OpenAI API) they act as processors; we restrict training and reuse of your data per their enterprise terms.
- Communications and support: email and incident tooling to respond to you and secure the service.
If we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or other approved mechanisms, and we assess the necessity of each transfer.
Controller/processor roles and DPAs
For individual accounts, Art Skool LLC determines how data is used to provide The Chat Report (controller role). For organizations uploading data on behalf of others, you are the controller and we act as a processor. We can provide a Data Processing Addendum with Standard Contractual Clauses on request at info@thechatreport.com.
Security
- Encryption in transit and at rest for stored content.
- Access controls for staff with role-based permissions and logging of administrative actions.
- Regular backups and monitoring; incident response procedures for notifying affected users when required.
Children
The Chat Report is not directed to children under 13 (or under 16 in California for data sharing). Do not upload chats involving minors without proper authority and consent.
Changes
We will update this notice when our data practices change. If changes are material, we will notify you in-product or by email so you can review before they take effect.
Questions or requests? Reach us at info@thechatreport.com.