Privacy policy

1. Controller

The controller is NorteCFO LLC, a limited liability company organized in Wyoming, United States, owner of the Repporti brand. For any privacy matter, write to [legal contact email pending].

2. The promise: your figures never go through our servers

We say “your figures”, not “your data”, because we do process some personal data (your account’s). What we never receive are financial figures or your clients’ data:

• Repporti has no field to upload trial balances, financial statements or files.
• Our server only delivers the prompt text and checks your plan.
• Your reporting profile and client profiles store an alias, country, accounting framework, report language, currency, unit, fiscal year-end and entity size. Never figures, real names or tax IDs.
• The MCP server only receives item IDs and parameters; it rejects figures.

3. What data we process

• Account: email, name (optional) and a hashed password (never in plain text). If you sign in with Google or Microsoft, we receive your verified email, your name and an identifier for that account; never your password.
• Reporting profile: country, accounting framework, report language, currency, unit, fiscal year-end and entity size, to adapt the prompts.
• Usage: which item you copied, its version, the country, framework and report language, and a license fingerprint, to apply fair use, prevent abuse and handle claims.
• Visits without an account: an identifier derived from your IP with a salted hash (the IP isn’t stored in plain text), to limit the free copy.
• Country and language: the country we detect or you choose, to show you the regional price, and the interface language.
• Orders: plan, price, payment currency, discount applied, code used and order status. Card details, once payments are active, will be handled directly by the payment processor.
• Lists: your email if you subscribe to “Report Fridays” or a waitlist, the language and where you subscribed from.
• Studio: the data you send us in the form (name, email, company, country and your message). We ask you not to send figures.
• Support and security: a log of administrative actions on your account, including support “view as” access.

4. What we use it for

• Providing the service and managing your account, your profile and your plans (performance of contract).
• Applying fair use, preventing fraud and defending ourselves against claims (legitimate interest).
• Sending you “Report Fridays” or waitlist notices (your consent, which you can withdraw with one click).
• Meeting legal and accounting obligations.

5. Cookies

In this version we only use necessary or preference cookies:

• rp_session: keeps you signed in (30 days).
• rp_idioma: remembers the interface language you chose.
• rp_perfil: stores your reporting profile if you don’t have an account yet (no figures).
• rp_pais: remembers the country you choose for pricing.
• rp_anon: controls the free copy without an account.
• rp_bar_oculta: remembers that you closed the announcement bar (7 days).

We don’t use analytics or advertising cookies. If we ever add them, we’ll ask for your permission first.

6. Providers and transfers

We use providers for hosting, database, email delivery, sign-in (Google and Microsoft, if you choose them) and, once payments are active, payments (planned: Stripe). Some are outside your country, mainly in the United States; we sign data processing agreements with them. [list of providers and transfer safeguards pending legal review]

7. How long

• Account and profile data: while the account is active and for the legal period afterwards.
• Usage events: 12 months.
• Identifier for visits without an account: 30 days.
• Orders: the period required by the applicable accounting law.
• Newsletter and lists: until you unsubscribe.

8. Your rights

You can access, rectify and erase your data, object to its processing, request its portability and withdraw your consent, to the extent granted by the law of your country (for example, the GDPR in the European Union and the United Kingdom, the LGPD in Brazil, ARCO rights in Mexico, Law 1581 of 2012 in Colombia, the CCPA/CPRA in California or PIPEDA in Canada). Write to [legal contact email pending] and we’ll reply within the legal deadlines.

If you’re not satisfied, you can contact the data protection authority in your country.

9. Recommendations when using your AI

• Anonymize before you paste: use codes instead of names, tax IDs or employees (“Client 07”, not the legal name).
• Use your AI on a business plan or with training on your data turned off.
• Whatever you paste into your AI is processed by that AI’s provider under its own terms, not by Repporti.

10. Changes

We’ll publish any change with its date. If the change is material, we’ll notify you by email before applying it.