Privacy Policy

Last updated: 17 August 2026

GoReportIt ("we", "us") operates the multi-tenant ticketing service at goreportit.com. This policy explains what personal data we handle, in which role, and what rights you have. Questions or requests can be sent to info@goreportit.com.

Controller and processor: which is which

GoReportIt is a workspace-based product. Each customer organisation runs its own private workspace, and the same data can involve us in one of two roles:

• We are the processor for the content inside a workspace: the tickets, comments, attachments, and the accounts of the people in that workspace. Your organisation decides what goes in and why, so it is the controller of that data; we only process it on the organisation's instructions to provide the service.
• We are the controller for our own public website, for the account you create when you sign up (name, email, workspace name), for contact-form messages, and for the security and server logs we keep to run the service safely.

What we collect

• Account data: your name, email address, role, and the company and groups you belong to. Accounts are created either by signing up for a new workspace or by your workspace administrator inviting you.
• Workspace content: the tickets, comments and file attachments you and your colleagues create. This is controlled by your organisation and is never shared between workspaces.
• Contact form submissions: the name, email address and message you send us through the contact form on our website.
• Technical and security data: standard server logs (IP address, request time, pages requested) and an authentication audit log (logins, password resets, signups) kept for security and troubleshooting.
• Analytics: on our public website only, and only if you accept analytics cookies, we use Google Analytics to understand how visitors use the site. See the cookie policy. We never run analytics inside the logged-in application.

How we use it

• To provide the service: showing tickets to the right people within a workspace, routing work, and keeping an audit history of changes.
• To send email notifications about tickets that concern you (assignment, replies, status changes) and account emails such as password resets and invites. You can turn off notification emails from your in-app notification preferences or the unsubscribe link in any such email; essential account and security emails are always sent.
• To respond to messages you send us through the contact form.
• To keep the service secure and to improve our public website.

We do not sell personal data, and we do not use your data for advertising.

Legal bases

Where the GDPR applies, we process workspace and account data to perform our contract (with you or with your organisation), technical, audit and security data under our legitimate interest in running a safe service, and analytics data only with your consent.

Sub-processors

We use a small number of service providers ("sub-processors") to run GoReportIt. Each processes data on our behalf under a data-processing agreement and is not permitted to use it for its own purposes, except as described in its own policies for reCAPTCHA and Analytics:

• Render (render.com) hosts the application and the database. Our production infrastructure is located in Frankfurt, Germany (EU).
• Twilio SendGrid delivers our outbound email (notifications, invites, password resets).
• Microsoft 365 hosts our contact inbox (info@goreportit.com).
• Google provides reCAPTCHA on our sign-up and contact forms, and Google Analytics on the public site if you consent.

We will update this list before adding or changing a sub-processor that handles workspace content.

How long we keep it

Workspace content and accounts are kept for as long as the organisation uses the service. When an administrator deletes a ticket, a snapshot is kept in that workspace's permanent deletion log for accountability. When a whole workspace is deleted, its tickets, comments, attachments, accounts and settings are permanently removed; a minimal security audit record (that the workspace existed and was deleted) is retained. Contact-form messages are kept in our mailbox for as long as needed to handle your request.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict its processing, and to complain to a supervisory authority. For data inside a workspace your organisation is the controller, so we may need to pass your request to them, or act only on their instructions. For anything where we are the controller (your account, contact messages, the public site), write to info@goreportit.com and we will help.

Security

All traffic is encrypted with HTTPS (HSTS enforced). Workspaces are isolated from one another, access within a workspace is restricted by role, passwords are hashed and checked against known breach corpora, attachments are checked for type and size, sign-in is rate-limited, and every ticket deletion is logged permanently.

No method of transmission or storage is completely secure, so while we work hard to protect your data using the measures above, we cannot guarantee absolute security.

Changes

If we change this policy, we will update this page and the date above. Significant changes will be announced to workspace administrators by email.