ReportingFlow

Privacy Policy

Aodholdings LTD | Effective Date: 31 August 2026 | Last Updated: 31 August 2026

1. Introduction

ReportingFlow is a product of Aodholdings LTD, a company registered in England and Wales. We operate the ReportingFlow platform (reportingflow.io), which provides automated advertising performance reporting services to marketing agencies and freelancers.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our website and services. It applies to all users of ReportingFlow, including agency owners, account managers, and any individuals whose data is processed as part of our service.

We are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), and applicable US privacy laws including the California Consumer Privacy Act (CCPA).

2. Who We Are (Data Controller)

For the purposes of UK and EU data protection law, the data controller is:

Aodholdings LTD

Registered in England and Wales

Contact: privacy@reportingflow.io

If you are located in the European Union and have questions about how we handle your data, you may contact us at the address above. We will respond within 30 days.

3. What Data We Collect

3.1 Account and Identity Data

When you create a ReportingFlow account, we collect:

Your name and email address
Company name and role
Billing name and address
Password (stored in encrypted form — we never store plain-text passwords)

3.2 Advertising Platform Data

When you connect a Meta (Facebook/Instagram) Ads account to ReportingFlow, we access and process advertising performance data on your behalf. This includes:

Ad spend, impressions, clicks, reach, frequency, CPM, CPC, CTR
Conversion data, leads, ROAS, CPA
Campaign, ad set, and ad-level performance breakdowns
Audience demographic breakdowns (age, gender, region) — aggregate only, not individual user data

This data belongs to you and your clients. We process it solely to generate reports as instructed by you. We do not use your advertising data for any other purpose, including advertising, benchmarking, or resale.

3.3 Usage and Technical Data

We automatically collect certain technical data when you use ReportingFlow:

IP address and approximate location
Browser type and version
Pages visited and features used within ReportingFlow
Report generation history and timestamps
Error logs for debugging purposes

3.4 Payment Data

All payment processing is handled by Stripe, Inc. ReportingFlow does not store your full card number, CVV, or bank details. We receive only a tokenised reference from Stripe confirming payment status. Stripe's privacy policy governs the handling of your payment data.

3.5 Communications Data

If you contact us by email or through any support channel, we retain a record of that correspondence including your name, email address, and message content.

4. Legal Basis for Processing (UK & EU Users)

We process your personal data under the following legal bases:

Contract performance: Processing necessary to provide the ReportingFlow service you have subscribed to, including generating reports, sending emails, and managing your account.
Legitimate interests: Improving our product, preventing fraud, ensuring platform security, and conducting aggregate analytics on how our service is used. We have assessed that these interests do not override your rights.
Legal obligation: Retaining financial records as required by UK tax and accounting law (typically 6 years).
Consent: Where we send optional marketing communications, we rely on your explicit consent, which you may withdraw at any time.

5. How We Use Your Data

We use the data we collect to:

Create and manage your ReportingFlow account
Connect to your advertising platforms and retrieve performance data
Generate automated PDF reports and deliver them by email
Process payments and manage your subscription
Send transactional emails (report delivery, account notices, billing confirmations)
Respond to support requests
Detect and prevent fraudulent or unauthorised access
Comply with legal obligations
Improve and develop the ReportingFlow platform

We do not use your data for automated decision-making that produces legal or similarly significant effects.

We do not sell your personal data. We do not share your advertising data with any third party except as described below.

6.1 Service Providers (Sub-processors)

We share data with trusted service providers who process it on our behalf and under our instruction:

Supabase (database hosting) — stores your account data and report history
Vercel (application hosting) — hosts the ReportingFlow platform
Resend (email delivery) — sends reports and transactional emails
Stripe (payment processing) — processes subscription payments
Anthropic (AI report generation) — generates narrative commentary for reports
Meta Platforms (data source) — we access your ad account data via the Meta Marketing API under your authorisation

All sub-processors are contractually bound to handle your data in accordance with applicable data protection law and may not use it for their own purposes.

6.2 Legal Requirements

We may disclose your data to law enforcement, regulators, or courts where required by applicable law, or where necessary to protect our legal rights or the safety of others.

6.3 Business Transfers

If Aodholdings LTD is acquired, merged, or sells its assets, your data may be transferred to the successor entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

7. International Data Transfers

ReportingFlow is based in the United Kingdom. Some of our sub-processors are based in the United States or operate globally. When we transfer your personal data outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs)
Transfers to countries or organisations recognised as providing adequate protection

You may request details of the safeguards we use for international transfers by contacting us at privacy@reportingflow.io.

8. How Long We Keep Your Data

Account data: Retained for the duration of your subscription and deleted within 90 days of account closure, unless we are required to retain it by law.
Advertising performance data: Retained for a maximum of 25 months from the date of collection. You may request earlier deletion at any time.
Financial records: Retained for 6 years as required by UK law.
Support correspondence: Retained for 2 years from the date of the last communication.
Usage logs: Retained for 12 months for security and debugging purposes.

9. Your Rights

You have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete data.
Right to erasure: Request deletion of your data where there is no legitimate reason for us to continue processing it.
Right to restrict processing: Request that we limit how we use your data.
Right to data portability: Receive your data in a structured, machine-readable format.
Right to object: Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@reportingflow.io. We will respond within 30 days. If we are unable to comply, we will explain why.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK at ico.org.uk, or with your local data protection supervisory authority in the EU.

9.2 California Users (CCPA / CPRA)

If you are a California resident, you have the following additional rights:

Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, why we collected it, and with whom we shared it.
Right to delete: Request deletion of personal information we have collected, subject to certain exceptions.
Right to correct: Request correction of inaccurate personal information.
Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioural advertising. No opt-out is required.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA request, contact us at privacy@reportingflow.io. We will respond within 45 days.

10. Cookies and Tracking

ReportingFlow uses a minimal number of cookies that are strictly necessary for the platform to function (for example, session cookies to keep you logged in). We do not use advertising cookies, third-party tracking cookies, or analytics cookies that identify you individually.

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging into ReportingFlow.

11. Security

We implement industry-standard security measures to protect your personal data, including:

Encryption of data in transit (TLS/HTTPS)
Encryption of data at rest
Access controls restricting who within our organisation can access personal data
Regular security reviews

No method of electronic transmission or storage is 100% secure. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

12. Meta Platform Data — Special Notice

ReportingFlow connects to the Meta Marketing API on your behalf. When you authorise this connection:

We access only the ad account data you explicitly grant us permission to access.
We use this data solely to generate reports for you and your clients.
We do not use your Meta advertising data to target advertising, build user profiles, or for any purpose not directly related to your ReportingFlow subscription.
We do not sell, licence, or share your Meta advertising data with any third party other than our authorised sub-processors listed in Section 6.
When you disconnect your Meta account or close your ReportingFlow account, we delete your advertising platform data within 90 days.

Our use of Meta platform data complies with Meta's Platform Terms (developers.facebook.com/terms).

13. Children's Privacy

ReportingFlow is a business-to-business service and is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the 'Last Updated' date at the top of this document and, where the changes are material, notify you by email or by displaying a prominent notice within ReportingFlow.

Your continued use of ReportingFlow after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: