Privacy Policy

1. Who we are

Ed & Sy Inc (“we,” “us,” or “Company”) operates Report Rosetta (the “Service”). We are the data controller for the personal data we collect in connection with the Service. Contact us at edmel@ednsy.com or via the contact form on the Service.

2. Data we collect

Account

When you sign in with a magic-link email, we collect your email address and associate it with your account. This is stored and processed by our authentication provider (Supabase) to manage your session and account.

Usage

We track how many briefings you generate per month to enforce free and paid limits. We store a user ID (when logged in) or an anonymous session ID, the month, and the count (and whether you are on a paid tier). This is stored in our database (Supabase).

Briefings

When we save a briefing (e.g. for share links), we store the briefing text (what it says, key findings, so what, what to ignore), a share token, and your user ID or session ID and creation time. We do not store your original report content (the document or text you pasted or uploaded). Report content is processed in memory and sent to our AI provider (Anthropic) only to generate the briefing; we do not retain it. We also do not save a briefing for sharing if our systems detect that the briefing output contains sensitive personal or financial data (e.g. SSNs, card numbers).

Waitlist

If you join the waitlist for a paid tier (e.g. Pro or Team), we collect your email address and the tier you are interested in. This is stored in our database.

Contact form

When you submit the contact form, we receive your name, email, subject, and message. This is sent to us by email (via Resend) and is not stored in our database. We use it only to respond to your inquiry.

Analytics

We use analytics to understand how the Service is used and to improve it. We use PostHog (client-side): it collects page views, page leave events, and referral/UTM parameters. When you are logged in, we may associate your user ID and email with these events (person profiles are stored only for identified users). We also use Vercel Analytics for general usage metrics (e.g. page views). See the Cookies section below for how these tools use cookies and similar technologies.

3. How we use your data

We use the data above to: provide and operate the Service (including authentication, usage limits, and share links); communicate with you (e.g. magic-link emails, replies to contact form or waitlist); improve the Service and analyze usage; and comply with legal obligations. Our legal bases for processing include: performance of our contract with you (providing the Service), our legitimate interests (analytics, security, improvement), and where applicable your consent (e.g. for marketing or optional analytics).

4. Third parties

We use the following third-party services, which process personal data on our behalf or in connection with the Service:

• Supabase (United States / EU): authentication and database (account, usage, briefings, waitlist).
• Anthropic (United States): we send report text to Anthropic’s API to generate briefings. Anthropic does not train on customer content per their policy; we do not retain report content after processing.
• Resend (United States): sending contact form emails and optionally magic-link emails.
• PostHog (United States / EU): client-side analytics (page views, events, and when logged in, user ID and email).
• Vercel (United States): hosting and server-side analytics.

Each provider has its own privacy policy and data processing terms. Where we transfer data from the EEA/UK to countries that are not deemed adequate, we rely on appropriate safeguards (e.g. Standard Contractual Clauses or equivalent) as required by applicable law.

5. Retention

We retain account and usage data for as long as your account is active and as needed to provide the Service and comply with law. Briefings are retained until you delete your account or we remove them (e.g. upon termination). Waitlist data is retained until you ask us to remove it or we no longer need it for the waitlist. Contact form data is not stored in our database; email copies are retained according to our email retention practices. Analytics data is retained according to our analytics providers’ policies (e.g. PostHog, Vercel). We may retain some data longer where required for legal, security, or fraud purposes.

6. Security

We use HTTPS, access controls, and secure authentication. We do not store your raw report content. We run checks to block sensitive data (e.g. SSNs, card numbers) from being stored in briefings. No system is completely secure; you use the Service at your own risk.

7. Your rights

Depending on where you live, you may have the right to: access your personal data; correct inaccurate data; request deletion; request a copy of your data (portability); object to or restrict certain processing; withdraw consent where processing is based on consent; and lodge a complaint with a supervisory authority. To exercise these rights, contact us at edmel@ednsy.com or via the contact form. We will respond within the time required by applicable law.

8. Cookies and similar technologies

We use cookies and similar technologies for analytics and essential operation of the Service:

• PostHog: analytics (page views, events, UTM/referrer). PostHog may set cookies or use local storage to identify your browser and, when you are logged in, to associate activity with your account. You can learn about opting out in PostHog’s documentation or via your browser settings.
• Vercel Analytics: general usage metrics (e.g. page views). Check Vercel’s documentation for details on cookies or similar tech.

You can disable or block cookies in your browser settings; some features or analytics may not work fully if you do. We do not currently use a cookie consent banner; by using the Service you consent to the use of cookies as described here. If we add a consent mechanism later, we will update this policy and the Service accordingly.

9. International transfers

Your data may be processed in the United States and other countries where our providers operate. If you are in the EEA, UK, or another jurisdiction that restricts transfers, we ensure appropriate safeguards (e.g. Standard Contractual Clauses or adequacy decisions) are in place where required.

10. Updates

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last updated” date. Material changes may be communicated by email or a notice on the Service. Continued use after the effective date constitutes acceptance of the updated policy.

11. Contact

For privacy questions or to exercise your rights, contact Ed & Sy Inc at edmel@ednsy.com or via the contact form on the Service.