Privacy Policy

1. Scope

This policy explains how ReportGem ("ReportGem", "we", "us", or "our") handles personal information. It applies to services that link to it, including reportgem.com, ReportGem account services, and our OAuth-protected MCP tools.

When you connect ReportGem to ChatGPT, Codex, or another compatible client, that client may separately process your information under its own privacy terms. This policy covers ReportGem's processing, not the independent processing of third-party clients or source websites.

2. Information we collect

Information you provide

• Account and contact information, such as your account identifier, email address or mobile number, login credentials, and support correspondence.
• Billing, order, and entitlement information needed to confirm paid access. Payment processors may collect payment-card or wallet details directly; ReportGem receives transaction and status information needed to administer the service.
• Research queries, filters, identifiers, and other parameters you submit to retrieve reports, filings, meeting notes, papers, charts, tables, or evidence.

OAuth, plugin, and MCP information

• OAuth client registration data, redirect URIs, requested and granted scopes, authorization state, consent and revocation events, token issue and expiry times, and account/client identifiers.
• Access and refresh tokens are stored as cryptographic hashes in the MCP authorization database rather than as reusable plaintext token values.
• Usage and reliability records may include a request identifier, account subject, client identifier, tool name, tool units, timestamp, status or error code, result count, and latency.
• The MCP usage ledger stores a one-way hash of a normalized query for metering and abuse prevention; it does not store the raw query in that ledger. Query contents are still processed as necessary to fulfill the request, and minimized operational or security logs may be retained where reasonably necessary.

Information collected automatically

We may collect IP address, browser and device characteristics, language, referring page, timestamps, pages or features used, cookies or session identifiers, and diagnostic and security events. We use essential cookies and similar technologies for authentication, security, language preferences, and service operation.

Research sources

Our service indexes and retrieves research and source metadata from licensed, public, or otherwise authorized sources. Results may contain author, organization, filing, publication, or other information present in those sources.

3. How we use information

We use information to:

• provide search, retrieval, evidence, chart, report, and research-pack features;
• authenticate users and clients, obtain consent, issue or revoke tokens, and enforce requested scopes;
• confirm entitlements, meter tool usage, apply quotas and cost controls, and administer orders;
• maintain, secure, troubleshoot, monitor, and improve the service;
• respond to support, privacy, billing, and legal requests;
• detect fraud, abuse, scraping, credential misuse, and other prohibited conduct; and
• comply with law, enforce our terms, and protect users, ReportGem, and others.

Depending on applicable law, we rely on performance of a contract, consent, compliance with legal obligations, and our legitimate interests in operating and protecting the service.

4. Sharing and international transfers

We may disclose information:

• to hosting, infrastructure, authentication, communications, payment, security, analytics, and support providers that process information for us under appropriate restrictions;
• to a third-party client when you intentionally connect and authorize that client to access ReportGem;
• to licensors or data providers where necessary to deliver licensed content and enforce applicable rights;
• when required by law, court order, regulation, or a valid government request, or when reasonably necessary to protect rights, safety, and security; and
• in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

We do not sell personal information for money. Information is stored on servers in the United States and mainland China and may be processed in other locations where our providers operate. Where required, we use contractual or other safeguards for cross-border transfers.

5. Retention and security

We keep information only for as long as needed for the purposes described above. Scheduled cleanup jobs delete records when their retention period ends:

We use administrative, technical, and organizational measures designed to protect information, including encrypted transport, scoped authorization, hashed token storage, access controls, usage limits, and monitoring. No system is completely secure, and we cannot guarantee absolute security.

6. Your choices and rights

You may disconnect a third-party client or revoke its access, update available account information, and manage browser cookies. Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent where processing relies on consent.

To make a request, email contact@reportgem.com with the subject "Privacy Request" and identify the ReportGem account involved. We respond within 15 days of receipt, or sooner where the law requires. Revoking a client's access stops it from reaching your account. It does not close your account or delete content the client already holds. We may need to verify your identity before completing a request, but we will never ask for your password, verification codes or tokens. Some information may be retained where required by law or reasonably necessary for security, fraud prevention, billing records, or legal claims. You may also complain to a competent privacy authority.

7. Other provisions

Children

ReportGem is a professional research service and is not directed to children under 18. We do not knowingly collect personal information from children under 18 without appropriate authorization.

External links and source documents

Results may link to third-party sites or documents. Their operators control their own privacy and security practices, and we encourage you to review their terms.

Changes to this policy

We may update this policy as our services or legal obligations change. We will post the updated version here and change the effective or last-updated date. We will provide additional notice when required by law.

中文说明

本政策说明 ReportGem（“我们”）如何处理个人信息，适用于 ReportGem 网站、账户、API、OAuth 授权服务、MCP 服务以及 ReportGem Research 插件。

我们可能处理您主动提供的账户和联系方式、订单及权益信息、客服沟通，以及您提交的研究查询、筛选条件和标识符；也可能处理 IP 地址、设备与浏览器信息、页面与功能使用记录、必要 Cookie、诊断和安全事件。

通过 OAuth 或 MCP 使用服务时，我们会处理客户端注册资料、重定向地址、申请与授权的权限范围、同意和撤销记录、令牌签发与到期时间，以及账户和客户端标识。MCP 授权数据库以密码学哈希保存访问令牌和刷新令牌。用量账本可能记录请求编号、工具名称、用量单位、时间、状态、结果数量、延迟、账户与客户端标识，并以单向哈希记录规范化查询；用量账本不保存查询原文，但系统会为完成请求而处理查询内容，并可能在确有必要时保留最小化的运维或安全日志。

我们将信息用于提供研究检索和证据服务、身份验证与授权、确认权益和计量用量、保障安全、处理客服与法律请求，以及遵守法律和执行服务条款。我们可能向受约束的基础设施、支付、通信、安全和支持服务商披露必要信息，也可能在您主动授权第三方客户端、法律要求、保护权利与安全或企业交易时披露必要信息。我们不以金钱为对价出售个人信息。

信息存储于位于美国和中国内地的服务器，也可能在服务商运营所在地处理。我们采取传输加密、分级授权、令牌哈希、访问控制、用量限制和监控等措施保护信息。

我们只在实现上述目的所需期间保存信息，并通过定期清理任务删除到期数据：账户资料在账户存续期间保存，注销或删除申请办理后 30 天内删除或匿名化；验证码仅在有效期内可用，失效后不保存明文；OAuth 授权请求和授权码在过期或使用后 1 天内清理；访问令牌和刷新令牌（以哈希保存）在过期或撤销后 30 天内清理；MCP 调用与用量记录保存 360 天；安全与访问日志保存 6 个月，处理具体安全事件所需部分除外；客服与隐私请求记录在办结后保存 1 年；订单、支付和会计凭证按适用的香港税务记录规定至少保存 7 年，仅限必要交易字段；灾备备份仅用于系统故障恢复，访问受限且不用于日常业务，如从备份恢复数据，会重新执行已办理的删除请求。

您可以撤销第三方客户端授权、更新可用的账户资料，并根据适用法律申请访问、更正、删除、限制、可携带或反对处理。申请请发送邮件至 contact@reportgem.com，主题注明“Privacy Request”并说明所涉账户，我们会在收到后 15 天内答复；法律规定更短期限的，从其规定。撤销客户端授权后，该客户端不能再访问您的账户，但这不等于注销账户，也不会删除客户端已保存的内容。我们可能在处理请求前核验身份，但绝不会索要密码、验证码或令牌；在法律、安全、防欺诈、账务或争议处理需要时，会保留必要部分记录。本服务面向专业研究用户，不以 18 岁以下未成年人为目标。

Contact us