Privacy Policy

Last updated: 6 October 2026

GoReportIt ("we", "us") is the multi-tenant ticketing service at goreportit.com, operated by Andreas Philippou, an individual based in Cyprus, who is the controller named in this policy. This policy explains what personal data we handle, in which role, and what rights you have. Questions or requests can be sent to info@goreportit.com.

Controller and processor: which is which

GoReportIt is a workspace-based product. Each customer organisation runs its own private workspace, and the same data can involve us in one of two roles:

• We are the processor for the content inside a workspace: the tickets, comments, attachments, and the accounts of the people in that workspace. Your organisation decides what goes in and why, so it is the controller of that data; we only process it on the organisation's instructions to provide the service.
• We are the controller for our own public website, for the account you create when you sign up (name, email, workspace name), for contact-form messages, and for the security and server logs we keep to run the service safely.

What we collect

• Account data: your name, email address, role, and the company and groups you belong to. Accounts are created either by signing up for a new workspace or by your workspace administrator inviting you.
• Workspace content: the tickets, comments and file attachments you and your colleagues create. This is controlled by your organisation and is never shared between workspaces.
• Contact form submissions: the name, email address and message you send us through the contact form on our website.
• Technical and security data: standard server logs (IP address, request time, pages requested) and an authentication audit log (logins, password resets, signups) kept for security and troubleshooting.
• Analytics: on our public website only, and only if you accept analytics cookies, we use Google Analytics to understand how visitors use the site. See the cookie policy. We never run analytics inside the logged-in application.

How we use it

• To provide the service: showing tickets to the right people within a workspace, routing work, and keeping an audit history of changes.
• To send email notifications about tickets that concern you (assignment, replies, status changes) and account emails such as password resets and invites. You can turn off notification emails from your in-app notification preferences or the unsubscribe link in any such email; essential account and security emails are always sent.
• To respond to messages you send us through the contact form.
• To keep the service secure and to improve our public website.

We do not sell personal data, and we do not use your data for advertising.

Legal bases

Where the GDPR applies, we process workspace and account data to perform our contract (with you or with your organisation), technical, audit and security data under our legitimate interest in running a safe service, and analytics data only with your consent.

Sub-processors

We use a small number of service providers ("sub-processors") to run GoReportIt. Each processes data on our behalf under a data-processing agreement and is not permitted to use it for its own purposes, except as described in its own policies for reCAPTCHA and Analytics:

• Render (render.com) hosts the application and the database. Our production infrastructure is located in Frankfurt, Germany (EU).
• Twilio SendGrid delivers our outbound email (notifications, invites, password resets).
• Microsoft 365 hosts our contact inbox (info@goreportit.com).
• Google provides reCAPTCHA on our sign-up and contact forms, and Google Analytics on the public site if you consent.

We will update this list before adding or changing a sub-processor that handles workspace content.

How long we keep it

Workspace content and accounts are kept for as long as the organisation uses the service. When an administrator deletes a ticket or a comment, a snapshot is kept in that workspace's permanent deletion log for accountability. When a whole workspace is deleted, its tickets, comments, attachments, accounts and settings are permanently removed; a minimal security audit record (that the workspace existed and was deleted) is retained. Contact-form messages are kept in our mailbox for as long as needed to handle your request.

When an account is deleted

You can delete your own account from your settings, and an administrator can delete an account in their workspace. Please read this part carefully, because deleting an account does not erase everything about you.

Deleting an account closes it immediately and permanently. You are signed out on every device, your password and two-factor settings are destroyed, your notification settings and on-call shifts are removed, and your email address is released so it can be used again.

Tickets, comments and history stay in the workspace, and they keep your name and the email address the account used. This is deliberate. A help desk ticket is a record of work between your organisation and the people it serves, and stripping the names out of it would leave your colleagues with an unreadable and unauditable history. It is the organisation, not us, that decides how long to keep that content: they remain the controller for it, and they can delete individual tickets and comments, or the whole workspace, at any time.

If you need your name removed from workspace content as well, that is a request to the organisation that runs the workspace. See Your rights below, and we will help you reach them.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict its processing, and to complain to a supervisory authority. For data inside a workspace your organisation is the controller, so we may need to pass your request to them, or act only on their instructions. That includes asking for your name to be removed from tickets and comments after your account is deleted, as described above. For anything where we are the controller (your account, contact messages, the public site), write to info@goreportit.com and we will help.

Security

All traffic is encrypted with HTTPS (HSTS enforced). Workspaces are isolated from one another, access within a workspace is restricted by role, passwords are hashed and checked against known breach corpora, attachments are checked for type and size, sign-in is rate-limited, and every ticket deletion is logged permanently.

No method of transmission or storage is completely secure, so while we work hard to protect your data using the measures above, we cannot guarantee absolute security.

Telling you about a data breach

If we become aware of a personal data breach affecting workspace content, we will notify your organisation's administrators without undue delay and in any event within 24 hours of becoming aware, so that your organisation, as the controller, can meet its own notification obligations. The notice will set out, as far as we know it at the time, what happened, the data and people likely affected, the likely consequences, and the steps we are taking, and we will follow up as more becomes clear. Where we are the controller (your account, contact messages, the public site), we notify affected individuals and any supervisory authority as the applicable law requires.

Some of our sub-processors commit to tell us of an incident on their side "without undue delay" rather than by a fixed deadline, so the start of our own clock can depend on them; we pass on what we learn as soon as we have it. How we detect, contain and communicate an incident is set out in our internal incident response plan.

Changes

If we change this policy, we will update this page and the date above. Significant changes will be announced to workspace administrators by email.