Short, because we collect almost nothing.

This website

• No analytics, no tracking pixels, no advertising cookies. This site sets no cookies at all.
• If you email us, we use your name, address, and message to reply and to administer your license. One thing you should know: to sort incoming messages faster, support messages are first read by an AI service (the Anthropic API, a US provider) that classifies them and drafts a reply for a person to review. Anthropic processes the message content for us and for nothing else. Screenshots you attach go through the same triage - so don't attach anything you wouldn't want handled that way.
• We do not sell or rent contact information, and we do not use it for unrelated marketing. Legal basis: our contract with you, and our legitimate interest in answering support quickly.
• The pricing calculator on our main page asks our license server for current prices. That request carries no personal data.

Your project data

• Prism runs on your own hardware. Reportil holds no copy of your projects, tasks, files, or engineering data. The Security page lists exactly what the app ever transmits (license validation, optional AI text you submit, optional support messages).
• The license heartbeat sends five technical fields (license id, instance id, app version, build-integrity hash, update mode) - no names, no emails, no content. Two more appear only as exceptions: a one-off report that an update failed to install, and any tamper signal the licence check has raised. The one exception you control: if you attach a screenshot to a support message, whatever is in it reaches us.

Customer and licensing records we keep

• If your employer licensed Prism: your admin gave us your work email to register your seat. That is all we hold about you - the address, tied to the license. We got it from your employer, not from you, and your employer should tell you it was registered. Your rights (clause 07) apply to you too - write to us any time.
• We send purchase, renewal, and lapse-reminder emails about your license from reportil@reportil.com. Service emails, not marketing.
• The license server keeps event logs (license and billing events) so we can trace what happened when something goes wrong, and we back up its database roughly nightly.
• Customer logos appear on our site only with the customer's agreement - purchasing a license includes it (see the terms), and it can also be given separately. Ask and we take the logo down, any time.

Payments

• Online payments are processed by our payment provider (Yaad Sarig / HYP). Card details are entered on the provider's secure page and are never seen or stored by Reportil or by Prism - we receive only the transaction result and a reference. What we keep ourselves: the payer's name and email, and the amount and VAT records tax law requires (clause 03).

Who else touches this data

Four service providers, each for one job:

We do not sell data to anyone, and these providers process it for us - not for their own purposes.

AI features, and reading a person's work (optional)

• If you enable them, these features send the text you submit to the AI provider you configure, and can read a mailbox you connect. That text is processed by that third-party provider under your agreement with them; Reportil does not store it. Where a feature makes Reportil a processor of your data, we will enter an appropriate data-processing agreement on request.
• This clause is about AI you configure - Reportil is not a party to that traffic. For the AI we use ourselves on support messages, see clause 01.
• The assistant can read a named person's work record. If someone tags a colleague in the in-app assistant, it retrieves that colleague's assigned tasks in that workspace - title, project, status, priority, start, due and completion dates - and sends those rows to the provider you configured, so the reply is grounded in the record instead of invented. That is personal data about an employee, used for something adjacent to performance review, so we say it here rather than leaving you to find it.
• Who may do it. Two conditions must both hold: the person asking and the colleague are both on that workspace, and the colleague is themselves, someone who reports to them directly or indirectly, or the asker is an administrator. Sharing a workspace is not enough on its own, and neither is holding a senior role - two team leaders in one workspace are separated only by whose team each one runs. Until reporting lines are recorded, nobody but an administrator can pull anyone else's record; an empty org chart hides the material rather than exposing it.
• What it is told not to do. The assistant is instructed never to produce a score, rating, ranking, grade or percentage for a person, never to compare two people by number, and to cite the task id behind each factual claim; the retrieved rows themselves carry a note saying they are evidence about work rather than a measure of the person. Assigned tasks do not record code review, mentoring, interviewing, incident response, support, or anything done outside Prism. Be clear about what kind of control that is: it is an instruction to the model, not a filter on its output - the access gate is enforced in code, the refusal to grade is not. Prism itself computes no rating and makes no automated decision about anyone; a manager reads the evidence and writes the judgement.
• Where the safeguard stops, stated plainly. The same rule is applied to the project-history search, so someone's work cannot be read through the back door: a passage about a person the asker may not read has its attribution removed - the actor field cleared, and that person's name replaced wherever it appears as a whole word. That is structured attribution, not a rewrite of the prose. A name shorter than three characters is left in the text, a nickname or initials are not matched, and a third person discussed inside somebody else's comment is not removed. Free-text commentary about a colleague is therefore not guaranteed to be scrubbed.
• Your responsibility, not ours. All of this runs on your server and goes to the provider you chose; Reportil holds none of it and cannot see it. Your company is the controller. If you turn the assistant on, tell your team the feature exists, decide who should hold the reporting relationships that unlock it, and check whether your local law requires an impact assessment or a works-council consultation first.

Your rights

• You can ask us for access to, correction of, deletion of, or a copy of your records (portability), ask us to restrict or object to a use of them, and withdraw any consent (a logo, for example) at any time: reportil@reportil.com. We may ask you to confirm who you are first, and we answer within the time the law sets - under the GDPR, one month.
• This applies whether you bought Prism yourself or your employer registered your seat email.
• We make no automated decisions with legal or similar effect about anyone, and we do not profile.
• You can also complain to a data-protection authority: in the EU, the authority in your country; in Israel, the Privacy Protection Authority.
• Records we must keep for legal or accounting reasons are retained for the required period.

International processing

• Our own customer and licensing records (clause 03) are hosted on AWS servers in the United States, and support triage (clause 01) sends message content to Anthropic in the US. For EU/EEA data these are international transfers, covered by the EU's Standard Contractual Clauses, which both providers incorporate in their data-processing terms.
• Reportil is an Israeli company. The EU Commission has decided Israel provides adequate data protection, so data can flow from the EU to Reportil itself without extra safeguards.
• If you enable AI features in the product, the provider you choose may process your submitted text outside your country, under your agreement with them. You choose the provider and region - including running models inside your own AWS account with Bedrock, so the text never leaves your cloud.

Changes and contact

• We may update this policy; material changes are reflected here with a new “last updated” date.
• If a security incident affects your records, we will tell affected customers without undue delay and notify authorities where the law requires it.
• Questions or requests: reportil@reportil.com. This policy is governed by the laws of the State of Israel. Reportil Ltd. · Israel.