Privacy Policy

1. Information we collect

• Account information — your name, email address, and a securely hashed password, or your Google profile information if you sign in with Google.
• Client workspace data — the client and ad account details you add to organise your reports (account names, currency, timezone).
• Uploaded report files — the CSV, TSV, or Excel exports you upload to generate a report, and the PowerPoint reports we generate from them.
• Optional third-party API keys — if you choose to enable AI-written insights, the Anthropic and/or Gemini API keys you provide, stored against your client workspace.

2. How we use your information

We use the information above solely to operate NextReport, specifically to:

• authenticate you and keep your account secure;
• generate the PowerPoint reports you request from your uploaded data;
• call the AI provider(s) you've configured, using your own API keys, to write report insights on your behalf; and
• maintain and improve the reliability of the service.

We do not sell your data, and we do not use your uploaded ad data to train any models.

3. Google user data

If you choose Sign in with Google or Connect Google Drive, we receive Google user data only as described below and only to provide NextReport features you request. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Sign in with Google — we receive your Google account ID, name, email address, and profile picture. We use this solely to create and secure your NextReport account and to identify you when you sign in.
• Connect Google Drive — with your consent we request the Google Drive drive.file scope. We use it only to upload a report file you have just generated into a Google Drive folder you designate (by pasting a folder link). We do not browse, list, or read other files in your Drive except the files this app creates for that upload.
• Connect Google Ads — with your consent we request the Google Ads API https://www.googleapis.com/auth/adwords scope (read-only reporting access), plus openid and email to identify the connected Google account. We use this solely to list Google Ads customer accounts you can access, fetch read-only campaign performance metrics you request for report generation, and verify that API access works. We do not create, edit, or manage ads, budgets, or campaigns on your behalf.
• Connect Google Analytics (GA4) — with your consent we request the https://www.googleapis.com/auth/analytics.readonly scope, plus openid and email. This is a separate OAuth grant from Google Ads and Google Drive. We use it only to list GA4 properties you can access, let you link one property per client workspace, and run read-only Analytics reports (for example sessions, channels, and conversions) for Website Traffic reports you generate. We do not modify your Analytics configuration.

OAuth access and refresh tokens for Google Ads and GA4 are stored in our database and are used only to perform the actions above on your behalf until you disconnect in Account settings or revoke access in your Google Account permissions.

4. Sharing, transfer, and disclosure of data

We do not sell your personal information or Google user data. We do not share Google user data with third parties for their independent advertising, marketing, or analytics.

We disclose or transfer data only in these circumstances:

• Service providers (processors) — companies that host and operate NextReport on our behalf, including Vercel (application hosting), Supabase (PostgreSQL database), and Vercel Blob (generated report file storage). They process data only under our instructions to provide the service.
• AI providers (optional) — if you enter your own Anthropic and/or Google Gemini API keys, report text you choose to send for insights is transmitted directly to those providers using your keys; we do not use Google sign-in data for that purpose.
• Legal and safety — when required by applicable law, regulation, legal process, or to protect the rights, safety, and security of NextReport, our users, or others.
• Business transfer — if we are involved in a merger, acquisition, or sale of assets, user data may transfer as part of that transaction, subject to this policy.

Some service providers may process data in the United States or other countries. Where required, we rely on appropriate safeguards for international transfers.

5. Data protection and security

We treat account credentials, OAuth tokens, and uploaded advertising data as sensitive and apply technical and organizational measures to protect them, including:

• Encryption in transit — all communication with NextReport uses HTTPS (TLS).
• Encryption at rest — data stored with our infrastructure providers (Supabase, Vercel Blob) is encrypted at rest by those platforms.
• Access controls — passwords are stored using one-way hashing; Google OAuth tokens are accessible only in connection with your authenticated account and the features you enable.
• Least privilege — we request the minimum Google OAuth scopes needed (profile/email for sign-in; drive.file for optional Drive uploads; adwords for read-only Google Ads reporting; analytics.readonly for read-only GA4 website reporting).
• Monitoring and updates — we maintain the application and dependencies with security patches as part of normal operations.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at hello@nextreport.in.

6. Where your data is stored

Account and workspace data is stored in a PostgreSQL database hosted by Supabase. Generated report files are stored using Vercel Blob storage, accessible only to your authenticated account. The application itself is hosted on Vercel.

7. Cookies

We use a single session cookie, set by our authentication provider (NextAuth), to keep you signed in. We do not use advertising or tracking cookies.

8. Data retention and deletion

We retain your account data and generated reports for as long as your account is active. You may request deletion of your account and all associated data at any time by emailing us at hello@nextreport.in, or by following the instructions on our User Data Deletion page.

9. Your rights

You may access, correct, export, or delete your personal data at any time. Contact us using the details below and we will respond promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above.

11. Contact us

Questions about this Privacy Policy? Email us at hello@nextreport.in.