Privacy Policy

1. Who We Are

ReportLab is a marketing analytics SaaS platform operated by IMC Media PTY LTD, a company incorporated in South Africa. For privacy enquiries, contact us at info@reportlab.co.za.

2. Information We Collect

Account information: When you register, we collect your name, email address, and a hashed password. We never store your password in plain text.

Platform credentials (OAuth tokens): When you connect advertising platforms (Google, Meta/Facebook, LinkedIn, TikTok, X), we store encrypted OAuth access tokens. These tokens allow us to fetch performance data on your behalf. We do not store your platform account passwords.

Advertising and analytics data: We retrieve campaign performance data, audience data, and analytics data from your connected platforms solely to generate your reports. This data is stored in your account and is not shared with other users.

Billing information: Payments are processed by PayFast. We do not store credit card or bank account details. We retain a record of transactions (amount, date, credits purchased) for accounting purposes.

Usage data: We log basic activity (pages visited, reports generated, errors) for security and service improvement purposes.

Cookies: We use session cookies to keep you logged in. See our Cookie Policy for details.

3. How We Use Your Information

• To create and manage your account
• To connect to your advertising platforms and retrieve performance data
• To generate marketing reports, charts, and Smart Insights
• To process payments and manage your credit balance
• To send transactional emails (account creation, billing receipts)
• To maintain the security and integrity of the Service
• To comply with legal obligations under South African law

We do not sell your personal information or your clients' advertising data to any third party.

4. Third-Party Services

To deliver the Service, we share limited data with the following processors:

• Google LLC — OAuth authentication and retrieval of Google Analytics / Google Ads data
• Meta Platforms, Inc. — OAuth authentication and retrieval of Meta Ads data
• LinkedIn Corporation — OAuth authentication and retrieval of LinkedIn Ads data
• TikTok Pte. Ltd. — OAuth authentication and retrieval of TikTok Ads data
• X Corp. — OAuth authentication and retrieval of X Ads data
• Anthropic, PBC — AI language model used to generate report insights. Report data is sent to Anthropic's API to produce text. Anthropic's privacy policy applies: anthropic.com/privacy
• PayFast (Network International) — Payment processing for credit top-ups and subscriptions
• Railway (Railway Corp.) — Cloud hosting provider where the Service runs

Each third party is bound by its own privacy policy and data processing terms.

5. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, we will delete your personal information and all associated reports within 30 days, except where retention is required by law (e.g. financial records retained for 5 years under the Companies Act).

OAuth tokens may be revoked at any time by disconnecting the platform in your account settings or directly from the relevant platform's security settings.

6. Data Security

We encrypt OAuth access tokens at rest using AES-256 encryption. Passwords are hashed using PBKDF2-SHA256. All data is transmitted over HTTPS/TLS. Access to production data is restricted to authorised personnel only.

7. Your Rights (POPIA)

Under the Protection of Personal Information Act (POPIA), you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that inaccurate information be corrected
• Deletion — request that your personal information be deleted ("right to be forgotten")
• Objection — object to the processing of your personal information
• Complaint — lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za

To exercise any of these rights, email info@reportlab.co.za. We will respond within 30 days.

8. Data Deletion Requests

To request full deletion of your account and all associated data, email info@reportlab.co.za with the subject line "Data Deletion Request" and the email address associated with your account. We will complete the deletion within 30 days and confirm via email.

Facebook / Meta users: If you connected your Meta account to ReportLab, you can request deletion of your associated data directly through Facebook (Settings & Privacy → Settings → Apps and Websites → Remove). Facebook will automatically notify us via our data deletion callback endpoint at reportlab.co.za/webhooks/meta/delete. You can check the status of your deletion request at reportlab.co.za/deletion/status/[your-confirmation-code].

9. Children's Privacy

The Service is intended for business use by individuals aged 18 and older. We do not knowingly collect personal information from children under 18.

10. Changes to This Policy

We may update this policy from time to time. We will notify registered users by email of material changes. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact

IMC Media PTY LTD (Registration No. 2019/502353/07)
Email: info@reportlab.co.za
Website: reportlab.co.za