Privacy, data rights, and regional compliance
We only process your chats to build the reports you ask for. No data sales, and your chats never reach advertisers. You can export or delete your data at any time.
Who operates The Chat Report
Art Skool LLC, operating as The Chat Report, is the operator and data controller for The Chat Report.
Our baseline promises
These apply everywhere we operate. When a regional rule is stricter, we apply the stricter option.
- We process chats, media, and metrics only to deliver your previews, reports, billing, and support.
- We do not sell personal data. Your chats, reports, and member data never reach advertisers. To measure our own ads, our main web pages use the TikTok and Meta pixels, which you can turn off in Your privacy choices.
- You control deletion. Remove uploads, reports, and accounts at any time and we propagate that to our processors unless law requires retention.
- Security-first: encryption in transit and at rest, least-privilege access, and audit logging on administrative actions.
- Minimal analytics: product analytics (including Vercel Analytics) that avoid cross-site ad tracking.
What we collect
Data you provide
- Account details (name, email), device identifiers when you sign in.
- Consents or authorizations you capture from chat participants; only upload content you have permission to share.
- Chat exports, media, and annotations you upload to build a report.
- Locations you choose to add to member profiles, and your account's country, which the desktop app sets once from your device's region and which you can change or remove in Account.
- Plans and sealed predictions you choose to add to a group report. We encrypt these contributions on our server; unlike the report itself, our server can read them to show plans to the group and reveal predictions after a qualifying next-year report is published.
- Payment details handled by Stripe (we receive tokens, not full card numbers).
- Support messages and preferences (language, notifications, privacy choices).
Data created automatically
- Usage and device signals (browser/OS version, IP address, timestamps, performance events) to keep the service stable and secure.
- Product analytics (page interactions, feature usage) to improve flows.
- Ad measurement: when you allow it, the TikTok and Meta pixels on our home, sample, download, and checkout pages record visits, downloads, and purchases with a browser identifier, so we can see which TikTok, Facebook, and Instagram ads bring people here. They never run on reports.
- Derived insights (clusters, scores, share kits) created from your uploads to power the report.
- An approximate country per member on the report's map, read in your browser from the country code of their chat number. It is never stored.
Why we use it
- Provide previews, exports, and billing you request.
- Maintain security, prevent abuse, and detect errors.
- Improve onboarding and sharing effectiveness.
- Comply with legal obligations (tax, accounting, safety).
Legal bases for EEA/UK GDPR processing
Where the GDPR or UK GDPR applies, we process personal data under:
- Contract: to deliver the app, generate reports, process payments, and provide support you request.
- Consent: for optional actions you start (e.g., connecting external sources or receiving marketing emails).
- Legitimate interests: to improve the product, keep it secure, prevent fraud/abuse, and understand feature performance—balanced against your rights.
- Legal obligation: to meet tax, accounting, and compliance duties, and to respond to lawful requests.
Cookies and local storage
We use essential cookies/local storage for authentication, session continuity, and rate limiting. We rely on privacy-forward analytics (including Vercel Analytics), and on our main pages the TikTok and Meta pixels and their cookies measure our ads. In the EEA and UK the pixels wait for your consent; elsewhere you can turn them off in Your privacy choices, and we honor Global Privacy Control. If you block non-essential cookies, the core app still works.
Regional rights at a glance
We honor the strongest applicable rights based on your location and the location of people whose data you upload.
EEA + UK (GDPR / DPA 2018)
- Access, obtain a copy, and portability of personal data.
- Correct inaccurate data.
- Delete data when it is no longer needed or consent is withdrawn.
- Restrict or object to processing, including marketing.
- Withdraw consent at any time.
- Lodge a complaint with your supervisory authority (e.g., ICO in the UK or your local DPA).
California (CCPA/CPRA)
- Know the categories and specific pieces of personal information we collect and disclose.
- Delete and correct personal information.
- Opt out of “sale” or “sharing” for cross-context behavioral advertising. We do not sell data. The TikTok and Meta pixels on our main pages count as “sharing”: turn them off with Your privacy choices at the bottom of our home page, or send Global Privacy Control.
- Limit use/disclosure of sensitive personal information to the services you request.
- Use an authorized agent to submit a request; we may verify identity and authority.
- Freedom from discrimination for exercising your rights.
Virginia, Colorado, Connecticut, Utah, and similar U.S. laws
- Access, confirm, and receive a copy of personal data.
- Correct and delete personal data.
- Opt out of targeted advertising, sale, or certain profiling.
- Appeal if you disagree with our response; reply “Appeal” to our decision and we will re-review within required timelines.
- No discrimination for exercising your rights.
Canada (PIPEDA)
- Access and obtain information about your personal data.
- Request corrections to inaccurate or incomplete data.
- Withdraw consent where processing is based on consent; this may affect service delivery.
- File a complaint with the Office of the Privacy Commissioner.
Australia & New Zealand
- Access and correction rights under the Privacy Acts.
- Complaints can be directed to us first, then to the OAIC (AU) or OPC (NZ) if unresolved.
Other regions
- We aim to honor equivalent rights where local law requires them (e.g., Brazil LGPD, Switzerland nFADP).
- Cross-border transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses where applicable).
How to exercise your rights
- Use in-product controls (Account > Export All Data and Account > Delete Account) to export or request deletion. Group admins can also delete uploads and generated reports; we process those requests promptly.
- Email us at info@thechatreport.com with the request type (access, delete, correction, objection, limit, opt-out) and the email used in your account.
- We respond within 30–45 days (or faster where required). If you appeal a decision, reply “Appeal” and we will re-review within the timelines set by your state law.
Data retention and deletion
- We retain uploads, generated modules, and share kits while your account remains active or until you delete them.
- Group plans and predictions remain with that group until its data is deleted. A linked account deletion removes that account’s contributions; guest contributors can request deletion from us.
- When you delete data or your account, we remove it from active systems and instruct processors to do the same, except where retention is required for fraud prevention, accounting, or legal obligations.
- Aggregated or de-identified analytics may be kept to improve the service without re-identifying individuals.
Sharing and transfers
We use vetted processors under data protection agreements and limit their use to our instructions.
- Hosting and storage: cloud infrastructure (including Google Cloud and Supabase) to run the application.
- Payments: Stripe for checkout and billing; we do not store full card numbers.
- Analytics and product performance: privacy-forward analytics such as Vercel Analytics to understand feature adoption.
- Ad measurement: TikTok and Meta, through their pixels on our main web pages when you allow it. They receive page visits, downloads, and purchases, never your chats or reports.
- Editorial report copy: automatically written taglines and introductions are produced locally on your device from structured report facts and are not sent to an AI provider.
- Communications and support: email and incident tooling to respond to you and secure the service.
If we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or other approved mechanisms, and we assess the necessity of each transfer.
Controller/processor roles and DPAs
For individual accounts, Art Skool LLC determines how data is used to provide The Chat Report (controller role). For organizations uploading data on behalf of others, you are the controller and we act as a processor. We can provide a Data Processing Addendum with Standard Contractual Clauses on request at info@thechatreport.com.
Security
- Encryption in transit and at rest for stored content.
- Access controls for staff with role-based permissions and logging of administrative actions.
- Regular backups and monitoring; incident response procedures for notifying affected users when required.
Children
The Chat Report is not directed to children under 13 (or under 16 in California for data sharing). Do not upload chats involving minors without proper authority and consent.
Changes
We will update this notice when our data practices change. If changes are material, we will notify you in-product or by email so you can review before they take effect.
Questions or requests? Reach us at info@thechatreport.com.