Privacy Policy

Last updated: 13 October 2026

This policy explains what personal data reportfor.agency ("we"), run by Zuhaib Asad, collects on this website, why, and your choices. Questions: info@reportfor.agency.

Google user data (summary). The reportfor.agency app requests no Google user data scopes from any user today. We use our own Google Cloud service account to manage only our own Google Ads, Analytics 4, Tag Manager and Search Console accounts. We access no data of visitors, clients or other people. We do not sell or share this data, and we do not use it for advertising or AI training. Read the full Google user data section.

1. What we collect

• Demo form. Your agency name, work email and how many clients you report on. We also record the country your request came from (from Cloudflare), your browser type and the campaign source of your visit (see below).
• Campaign source. If you come to the site from one of our ads or from a link with campaign tags, we keep the tags from that link: utm_source, utm_medium, utm_campaign, utm_content, utm_term and the Google Ads click ID (gclid), plus the first page you opened. They tell us which ad or link brought you. We save them with your demo form request, and we pass the utm_ tags to Calendly when you book a call. If you come without these tags, we keep nothing.
• Contact form. Your name, email, agency name (optional) and message. We also record the country your message came from (from Cloudflare) and your browser type. To stop spam, we check each message automatically and keep a short log of blocked attempts (reason and email address).
• Live chat. Your chat messages, your email if you give it, the page you chatted from, the country (from Cloudflare) and your browser type. A person from our team reads and answers the chat. We do not use an AI bot.
• Email and calls. What you send to our addresses, and what you enter when you book on Calendly (plus the campaign source, if you have one).
• Analytics, only if you accept cookies. Pages viewed, clicks, scroll depth, time spent in each section, device and browser type, approximate location, referring site and campaign source.
• Advertising, only if you accept advertising cookies. That you came from one of our ads, the pages you viewed, and whether you asked for a demo or booked a call. Google and Meta receive this, with your IP address and browser type.

The free demo reads your CSV inside your browser. We do not upload it and we cannot see it.

2. Why we use it, and our legal basis

We do not sell your data.

3. Cookies, analytics and advertising

Nothing from Google Analytics, Google Ads or Meta loads until you choose on the cookie banner. The banner has three buttons: "Accept all" turns on both uses below. "Accept essential" and "Decline" turn on neither of them; the site then keeps only what it needs to work (see the end of this section). The two uses are:

• Analytics (Google Analytics 4, through Google Tag Manager). Counts visits, pages, clicks and the campaign source, so we see which pages are useful. Cookies: _ga and _ga_<id> (up to 2 years). Data kept in Google Analytics for 14 months.
• Advertising (Google Ads and Meta Pixel). Tells Google and Meta (Facebook, Instagram) that you came from our ad and whether you asked for a demo or booked a call. This measures our ads and lets us show our ads to people who visited the site. Cookies: _gcl_au (Google, about 90 days), _fbp and _fbc (Meta, about 90 days). Google and Meta also use this data under their own policies: Google, Meta. For the collection and transfer of this data to Meta, we and Meta Platforms Ireland Ltd are joint controllers. We do not send your email or name to Meta or Google from this site.
• We do not use Meta's automatic form reading ("automatic advanced matching") or automatic button tracking. The free demo page (/demo/) does not load the Meta Pixel.

How to say no or change your mind: click "Accept essential" or "Decline" on the banner. To change your choice, click "Cookie settings" in the page footer at any time. If you withdraw a choice, we delete the cookies of that use in your browser and stop sending data. You can also control ads at Google My Ad Center and Meta ad preferences.

The site also stores three items in your browser storage: your cookie choice, a marker that you already filled in the demo form, and, if you use the live chat, a random chat ID (plus your email if you give it) so you can see our replies when you come back. These are needed for the site to work and are not used for tracking.

The demo-form marker is also a small cookie (rfa_lead) for reportfor.agency and creativedashboard.reportfor.agency, so the sample dashboard opens without a second form. It holds no personal data.

If we send your agency a personal link to a sample dashboard, we record when it is opened, the country and the device type (no IP address), and our team gets a note in Slack. The link sets a small cookie (rfa_kit) on creativedashboard.reportfor.agency so the dashboard opens without a form. It expires after 60 days at most.

If you arrive with campaign tags, the site also keeps the campaign source (the utm_ tags, gclid and your first page) in session storage. It stays in that browser tab only and is deleted when you close the tab. It is not a cookie. The site adds it to links to our booking and demo pages, so the demo form and Calendly get it. It goes to Google Analytics only if you accept cookies.

4. Who receives data

• Cloudflare: hosting, security, our lead database (D1) and email delivery.
• Google: analytics and advertising (only with your consent), fonts, and the Google services described in section 7. Fonts load from Google when you open a page, so Google receives your IP address.
• Meta Platforms (Facebook, Instagram): advertising measurement, only with your consent.
• Calendly: if you book a call.
• Slack: our team receives and answers live chat messages in Slack, and notes when a personal sample-dashboard link is opened. Messages sent to our WhatsApp number are also copied to a private Slack channel, so our team can read and reply.
• Zernio: our WhatsApp provider, for messages sent to and from our WhatsApp number.
• Our email provider: to send and receive mail.

Some of these providers process data outside your country, including in the United States. They use standard contractual clauses or equivalent safeguards.

5. How long we keep it

• Demo form details, contact form messages and live chats: up to 24 months, unless you become a client or ask us to delete them sooner.
• Client records: for the length of the contract and the period the law requires.
• Analytics data: 14 months in Google Analytics.
• Opens of personal sample-dashboard links (see section 3): 12 months.
• Advertising cookies: see section 3 (about 90 days).

6. Client data

If you become a client, you may give us read-only access to your clients' ad and analytics accounts. We use it only to build your reports. For that data, you are the controller and we are your processor. We sign a data processing agreement (DPA) and an NDA before we start.

7. Our Google OAuth app ("reportfor.agency")

Short answer. The reportfor.agency app does not request any Google user data scopes from any user today. It does not ask visitors or clients to sign in with Google. It does not access, store or share Google user data of any person.

What we do use. reportfor.agency uses its own Google Cloud service account to manage only its own Google Ads, Google Analytics 4, Google Tag Manager and Google Search Console accounts. We added the service account as a user in those accounts. This is our own business data (tag settings, analytics settings, campaign settings and totals such as impressions, clicks, cost and conversions). It is not the data of a user who signed in to our app. We use it only to keep our own website tracking and our own advertising correct.

If this changes. If the app ever asks users for Google data, we will list every scope here first, say why we need it, and follow the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use. reportfor.agency's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data. We do not use it for advertising, and we do not use it to train artificial intelligence or machine learning models. No person reads it, except where the law requires it or where it is needed for security.

Retention. Today we hold no Google user data. Results from our own accounts (settings and totals) are kept only as long as we need them to run our own site and advertising. Then we delete them. If the app later collects user data, we will keep it only as long as needed to give the feature to that user, and delete it when the user asks or revokes access.

Protection. The service account key is kept in a protected folder outside our website, our code and our database. We never print it, send it or put it in our code. Only the operator has access.

Your rights. If you think we hold Google data about you, email info@reportfor.agency. We will tell you what we hold and delete it. We reply within 30 days.

Revoke access. If you ever grant any app access to your Google data, you can remove it at myaccount.google.com/permissions.

8. Your rights

You can ask to see, correct, delete, restrict or export your personal data, object to our use of it, or withdraw consent. Email info@reportfor.agency. We reply within 30 days. You can also complain to your local data protection authority.

9. Changes

If we change this policy, we change the date above.

This page is a plain-language policy written for our current setup. It is not legal advice.