Privacy Policy

1.1 Who we are

ClientReportly (clientreportly.com) is operated by Ömer Aydoğdu, a sole proprietorship in Türkiye, Yenikent Mahallesi, Nefise Sokak No:19, Odunpazarı/Eskişehir, Türkiye ("we", "us"). Contact: support@clientreportly.com.

We act in two roles:

• Controller for the data of people who use ClientReportly as an agency or as a team member ("Agency Users").
• Processor for the data that agencies put into ClientReportly about their own clients ("Client Data"). The agency decides why and how that data is used. We process it on the agency's instructions under our Data Processing Agreement.

1.2 What we collect

What we ask a connected tool for is read-only and smaller than what the tool holds: we do not request task descriptions or notes, comments, attachments, assignees or followers, custom fields, due dates, tags or links to the task, and the permissions we ask for do not let us change anything in your tool. Fields we did not ask for can still arrive inside a provider's answer; they pass through memory and are written nowhere — not to our database, not to our logs and not to our error-tracking service.

What we keep is smaller still: for each of the three stages, the number of tasks and a limited number of task titles (today at most 50), together with the board's name, the names of the lists or sections you mapped and the time we last read them. We keep that summary so the progress figure can be shown in the client portal and in your reports without calling your tool each time a page is opened. Task titles are part of what your own clients see: the portal shows a few of them per stage and the PDF report prints them in its completed list (see 1.5 and Annex I of the Data Processing Agreement).

Where an Agency User connects Notion, the same list reads in Notion's own words: the name and provider ID of each database you shared with us; the ID of the property you chose to track progress and the names of that property's options, which become the stages; and, for the rows that property places in a mapped stage, their titles and which of those options they carry. If you also set a project filter, so that one database can serve more than one project, we keep the ID of the filter property, its type and the value you filter on: an option ID for a select, status or multi-select column, or, for a title or text column, the text you typed, which can be the name of a client or of a project.

Where Notion is the connected tool, which pages and databases we can see at all is your own choice in Notion's permission screen: a database you did not share there is not visible to us, and we cannot widen that choice from the product — sharing one more means running the authorization again. The connection carries no write permission, so nothing in your workspace can be changed through it. We also ask Notion for its "No user information" capability: a person's name or email address is not part of what Notion answers with, and we request neither the "created by" and "last edited by" of a row, nor the content of a page (the blocks inside it), nor its comments.

1.3 Why we use it

We use no advertising trackers. We do not sell personal data or use it for targeted advertising. We do not profile people and take no automated decisions with legal effect. We do not use your data, or anything we read from a project management tool you connect, to train, develop or fine-tune machine-learning models, and we do not use it to build features for other customers. We send transactional emails only (verification, password reset, invitations, notifications). We send no marketing email.

We use one analytics service, Google Analytics, on our public pages, and only if you accept it. Section 1.10 says what it sets, what we send to it and how to withdraw your consent.

To improve the service and measure how setup is going, we record your account's product milestones (for example, the date you added your first client or created your first report) on our own servers only, to produce aggregate statistics. These records are not sent to any third-party analytics service, are not used for marketing, and are deleted together with your account.

Where an agency connects Notion, Notion's own developer terms, in the version last updated on 2 April 2026, bind us to the same narrow use: what we read from a workspace may be used only to make that integration work — showing and refreshing a project's progress in the portal and in reports — and not for analytics, product metrics, logs, error reports or the training of machine-learning models. Those terms also require the terms of service and privacy policy of this product to stay reachable from inside it, which is what these pages are.

1.4 Agencies and their clients

If you are a client of an agency that uses ClientReportly, the agency is responsible for your data and for telling you how it is used. Contact the agency first to access, correct or delete it. We help the agency answer your request.

Agencies must have a lawful basis for the data they enter, must inform their own clients, and must not upload special categories of personal data (such as health data) unless the law allows it and they take responsibility for it.

A white-label portal may not show our name. This policy and the Data Processing Agreement still apply to the processing we do for the agency.

1.5 Who receives data

We have written data processing terms with our service providers. Paddle acts as an independent seller and payment provider under its own terms, and Google sign-in and any project management tool an agency connects (today Trello, Asana or Notion) are used at the agency's own choice and under the agency's own account with that provider; none of them is a sub-processor for Client Data. A provider is named here once it is available in the product. We share data with authorities only when the law requires it.

Google Analytics is used on our own public pages only. It is not a sub-processor for Client Data, it is never loaded in a client portal or on an agency's own domain, and nothing an agency enters in the product is sent to it.

1.6 International transfers

Our servers are in the EU (France). We operate from Türkiye and can reach the data from there. Where needed we rely on adequacy decisions, on the EU-US Data Privacy Framework for certified US providers, or on standard contractual clauses. For data subjects in Türkiye, the information required by Article 9 of the Turkish Personal Data Protection Law (6698) is in our Turkish KVKK notice (Aydınlatma Metni), at https://clientreportly.com/kvkk-aydinlatma. We have written data processing terms with our service providers. Backups are encrypted before they leave our servers.

1.7 How long we keep it

1.8 Security

We encrypt data in transit (HTTPS with HSTS). We hash passwords and tokens, encrypt integration tokens, separate each agency's data from every other agency's, limit request rates, lock accounts after repeated failed sign-ins, strip secrets from error reports, and keep encrypted backups off our servers. No system is perfectly secure. If a personal data breach affects you, we notify you and the authorities as the law requires. We notify agencies without undue delay when their Client Data is affected.

1.9 Your rights

Wherever you live, you can ask us to access, correct, delete, restrict or export your personal data, to object to its use, and to withdraw consent where we rely on it. Email support@clientreportly.com. We handle these requests by email, by hand, and answer within 30 days. We may need to verify your identity first.

You can complain to a data protection authority: in Türkiye the Personal Data Protection Board (KVKK), in the EU the authority of your country, in the UK the Information Commissioner's Office.

1.10 Cookies and local storage

We use only what the service needs, plus analytics cookies if you accept them. On our public pages we show a consent banner: analytics stays off until you accept, nothing is loaded if you reject, and you can change your choice at any time from the cookie preferences button in the footer. We use no advertising cookies.

The pricing and plan pages load Paddle's script, and the sign-in and registration pages load Google's sign-in script when it is enabled. Those providers can set their own cookies under their own policies.

Google Analytics loads only after you accept, and only on our own public pages: the home, pricing and about pages, these legal pages, the blog, and the sign-in and registration pages. It is never loaded in a client portal, in the agency app, in the admin area, on an agency's own domain, or on a page whose address carries a token, such as an email verification, password reset or invitation link.

What we send is the page path, its title and the referring address, never the query string that can follow a path. We send no account identifier and no User-ID, and nothing from the checkout, including anything our payment provider returns, reaches it. Google Signals and advertising personalisation are turned off for our property, so this data is not used for advertising, and we send no events to it from our servers.

1.11 Children

ClientReportly is a business service for adults. We do not knowingly collect data from anyone under 18.

1.12 Changes

We update this policy when our practices change. We post the new date here and tell account owners by email or in the app at least 14 days before material changes take effect.

1.13 Contact

support@clientreportly.com. Ömer Aydoğdu, Yenikent Mahallesi, Nefise Sokak No:19, Odunpazarı/Eskişehir, Türkiye.