Privacy policy

Last updated October 14, 2026

ReportFalcon ("we", "us") is a reporting tool for marketing agencies. Agencies connect their clients' Google Search Console, Google Analytics and (where enabled) Google Business Profile data and turn it into reports they share with those clients. This policy explains what we collect, why, and the choices you have. Questions: hello@reportfalcon.com.

Who is responsible for which data

• Your account and agency data (names, email addresses, agency details): we decide how this is used, as described here.
• Your clients' data (client names, websites, reporting data, notes): the agency decides what goes into ReportFalcon and who sees it. We process it on the agency's behalf, only to provide the service. Agencies are responsible for having their clients' permission to connect their Google properties.

What we collect

• Account details: name, email address, a secure hash of your password (never the password itself), your role, when you confirmed your email and when you last signed in.
• Sign in with Google: if you use it, we receive your Google account's ID, name and email address. We don't receive your Google password or access to anything else in your Google account.
• Agency details: agency name, website, logo and colours you upload for branding.
• Client details agencies enter: client names, websites, logo links, brand terms, report notes, which report sections are shown, and the Google properties connected to each client.
• Google data: see the next section.
• Usage records: how many times each shared report was viewed and when, plus a log of account events (such as sign-ups, team changes and admin actions) that we use for security and support.
• Technical data: your IP address is used briefly to slow down repeated failed sign-in attempts, and appears in our hosting provider's standard server logs.

Google data

Each agency gets its own reporting account (a Google service account). An agency or its client grants it read-only access to specific Search Console properties and Google Analytics 4 properties. ReportFalcon can only read properties that were shared with that agency's reporting account. Where Business Profile is enabled, an agency can connect a Google login that manages its clients' Business Profiles.

• What we read: search performance (clicks, impressions, positions, queries and pages), website analytics (sessions, users, channels, sources, landing pages, key events) and, where enabled, Business Profile metrics and reviews.
• How we use it: only to build the reports the agency requests and shows to its clients. We never use Google data for advertising, never sell it, and never use it to train AI models.
• How long we keep it: fetched data is cached for up to about 12 hours to keep reports fast. When an agency shares a report, a copy of that report is saved so the link keeps showing the same numbers, until the agency deletes it.
• Removing access: remove the reporting account from your Search Console or Google Analytics users at any time; ReportFalcon then can no longer read that property.

ReportFalcon's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

• To run the service: sign you in, show your clients and reports, and share reports with your clients.
• To send service emails: email confirmation, password resets and team invites. We don't send marketing emails without your consent.
• To keep the service secure, prevent abuse and give support.

Who we share it with

We don't sell personal information. We use these service providers to run ReportFalcon, and they process data for us under their own security and privacy terms:

• Vercel: hosting of the application.
• Neon: database hosting.
• Resend: sending service emails.
• Google: the Google APIs that provide reporting data, and Sign in with Google.

Pages also load fonts from Google Fonts and code libraries from public content delivery networks (jsDelivr and cdnjs), which receive your IP address when your browser requests those files. Reports an agency shares are visible to anyone with the link. We may disclose information if required by law.

Cookies

We use one essential cookie that keeps you signed in and protects forms against forgery. We don't use advertising or analytics cookies.

Security

All traffic is encrypted (HTTPS). Passwords are stored as one-way hashes, and stored Google credentials are encrypted. Access to the service's systems is limited to what's needed to run and support it.

How long we keep data

We keep account, agency and client data while the agency's account is active. When an agency or client is deleted, its data is removed from our database, along with the shared reports. Sign-ups that never confirm their email may be deleted after 7 days. Our providers' backups may keep copies for a limited time afterwards.

Your choices and rights

You can update your name, email and password on your account page, and disconnect Google sign-in there. You can ask us to access, correct, export or delete your personal information, or object to how we use it, by emailing hello@reportfalcon.com. If your information is in ReportFalcon because an agency added it (for example as their client), please contact that agency first; we'll help them respond. Depending on where you live, you may also have the right to complain to your data protection authority.

Children

ReportFalcon is a business tool and isn't meant for anyone under 16.

Changes

We'll update this page when our practices change and, for significant changes, tell account owners by email.