Privacy Policy

1. Introduction

BankRegReports LLC ("BankRegReports," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes the information we collect from visitors and registered users of bankregreports.com (the "Website") and any related services (collectively, the "Service"), how we use that information, and the choices available to you.

This policy applies to information collected on the Website and through electronic communications between you and BankRegReports. It does not apply to information collected offline, through any other BankRegReports websites (if any), or by any third party.

By accessing or using the Website, you agree to this Privacy Policy. If you do not agree, please do not use the Service. We may update this policy periodically; continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

2. Children Under 18

The Website is not intended for anyone under 18 years of age. No one under age 18 may provide any information to or on the Website. We do not knowingly collect personal data from children under 18. If we learn that we have collected personal data from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, contact us at admin@bankregreports.com.

3. Information We Collect

What Is Personal Data

"Personal Data" means any information that identifies or could reasonably be used to identify you as an individual or your device. It does not include deidentified or aggregated data that cannot be linked back to you.

Information You Provide Directly

When you create an account or use the Service, you may provide:

• Email address and password (or Google account credentials if you use Google Sign-In)
• Profile details you choose to give at sign-up or on your profile page: your name, sector, organization, job title, role, how you plan to use the Service, and the bank you work at (if any), which we link to that institution's public record
• Billing information, collected and processed by Stripe, Inc. on our behalf. We receive a Stripe customer ID and subscription status; we do not store your card number, CVV, or full payment details on our servers.
• Billing address associated with your subscription
• Watchlist configurations and email alert preferences
• Custom peer group definitions and saved screener filters
• Any information you include in messages sent to us (e.g., via our contact form or email)
• Questions you type into the BankRegReports assistant, the in-page chat that answers questions about regulatory filings. We describe how this is stored and used in the section below.

The BankRegReports Assistant

The assistant answers questions using published regulatory filings. To operate it, your question is sent to our AI provider, Cloudflare, Inc., which processes it and returns an answer. Cloudflare acts as our processor and does not use your question to train its models.

We keep a record of each question so we can measure whether the assistant answered it and improve what it can do. That record is deliberately limited:

• Before anything is stored, we automatically remove text that looks like an email address, a phone number, a government identification number, or a long account number.
• We store the question, which page you asked it from, and whether we were able to answer. We do not store the assistant's reply unless we failed to answer, in which case we keep it so we can see what went wrong.
• If you are signed in, the record is linked to your account so we can understand which capabilities our customers need. If you are not signed in, it is not linked to you, and we do not attempt to identify you from it.
• Detailed records are deleted after 30 days. We keep anonymous counts, such as how many people asked for a capability we do not yet offer, for longer. Those counts contain no information about who asked.

Deleting your account deletes your assistant history with it. You can also ask us to delete it separately using the contact details in the "Accessing, Correcting, and Deleting Your Data" section.

Please do not type confidential, customer, or non-public supervisory information into the assistant. It answers from public regulatory filings and does not need it.

Feedback You Send Us

Some pages offer a short form to tell us that something is wrong or missing, and a search that finds nothing asks what you were looking for. Both are optional. We keep what you write, the page you sent it from, and for a search the words you searched for. If you are signed in, the note is linked to your account so we can reply and see which needs our customers share; if you are not, it is not linked to you. Before a note is stored we remove text that looks like an email address, a phone number or an account number. We read these notes to improve the Website, and deleting your account deletes your notes.

Information Collected Automatically

When you use the Website, our servers and analytics tools automatically collect:

• IP address, browser type, operating system, and device identifiers. For our high-volume analytics logs (page and bank views, in-platform searches, general activity) the IP address is coarsened to a network prefix (the final segment is removed) so it cannot identify your exact device; the full address is retained only for security-relevant records such as login attempts and abuse blocking.
• Pages visited, dashboard tools used, banks viewed, and search queries within the platform
• Referring URLs and clickstream data
• Session timestamps and duration
• Account milestones, recorded without cookies. Our own server records when an account reaches a step: sign-up, email verified, checkout started and payment received, with the date and time. Alongside each sign-up we keep two labels drawn from fixed lists: the kind of page you first landed on (for example a bank profile, a ranking or the blog) and the kind of site that sent you (search, direct or another website). We store the label only, never the web address or any search words, and we use these counts to see which pages lead to sign-ups. They set no cookie, load no third-party script, and are kept as business records after an account is deleted without your name or email address.
• Error logs and performance data

How You Found Us

If you arrive at the Website from a link that carries campaign information, we keep that information with your browser session and, if you then create an account, save it with your account as the way you first found us. It consists of any Google Ads click identifiers in the link (gclid, gbraid, or wbraid), its campaign tags (utm_source, utm_medium, utm_campaign, utm_term, and utm_content), the page you landed on, and the referring page. We use it to learn which campaigns and sources bring us users. We may also send the Google Ads click identifier, without your name or email address, to Google Ads so it can report whether an ad led to a paid subscription.

Information From Other Sources

We also hold business contact information about people who have not signed up, mainly staff at banks, credit unions, and related firms. We obtain it from commercially available business contact lists and from public sources such as institution websites and regulatory filings. It may include a person's name, work email address, work phone number, job title, employer, and business location. We use it to send business outreach email about the Service and to keep our customer records accurate. Each outreach message includes an unsubscribe link, and after you unsubscribe we do not email you again. You can also ask us to delete this information, or to stop contacting you, using the contact details in the "Accessing, Correcting, and Deleting Your Data" section.

Google Sign-In

If you authenticate using Google OAuth, we receive from Google only the information you authorize at sign-in: your Google account email address, display name, and profile picture URL. We do not receive your Google password, contacts, Gmail messages, Google Drive files, calendar, or any other Google account data.

Cookies and Tracking Technologies

Session cookies contain a random identifier that keeps you logged in as you navigate the Website. They expire within 24 hours of your last activity, or when you sign out.

Persistent cookies remember your preferences across visits (e.g., selected view modes, watchlist state). They remain until deleted.

Consent. Analytics and advertising technologies are off by default. On your first visit we show a cookie banner. If you visit from the European Economic Area, the United Kingdom or Switzerland, or your browser sends a Global Privacy Control signal, the tools below load only after you accept, and nothing is sent to Google before you do. Elsewhere, Microsoft Clarity and the advertising conversion tags still load only after you accept, while Google Analytics may send cookieless measurement pings (described below) before you choose. If you decline (or ignore the banner), Google Consent Mode keeps advertising and analytics storage denied and no analytics or advertising cookies are set. You can change your choice at any time by clearing site data in your browser.

Google Analytics 4 (cookies _ga, _gid) collects aggregated traffic data (page views, session counts, referral sources) to help us understand usage. Outside the European Economic Area, the United Kingdom and Switzerland, and without a Global Privacy Control signal, it loads before you choose and, until you accept, sends only cookieless pings: no cookies are set, but Google receives the page visited and your IP address. If you decline, it stays in that cookieless mode.

Microsoft Clarity records anonymized session interactions (clicks, scrolls, and a heatmap-style replay of page activity) so we can find and fix usability problems. It loads only after you accept cookies.

Advertising conversion tags (Google Ads, the Microsoft Bing UET tag, and the Twitter/X Ads pixel) measure whether an ad we run led to a sign-up or subscription. They load only after you accept cookies, and only when the corresponding ad campaign is active.

Email. The account, billing, and alert emails we send do not contain tracking pixels, and we do not measure whether you open them or click their links. Our email provider tells us whether a message was delivered or bounced, and we record unsubscribes. Outreach email sent through Smartlead may record whether a message was opened or a link in it was clicked.

You can manage cookies through your browser settings. Disabling essential cookies will impair login and account functionality. You may additionally opt out of Google Analytics collection using the Google Analytics Opt-out Browser Add-on.

4. How We Use Your Information

We use the information we collect to:

• Authenticate your account and provide access to the Service
• Process subscription payments and manage billing through Stripe
• Send transactional emails: account verification, password resets, billing receipts, and watchlist alerts you have enabled
• Personalize your experience (saved watchlists, peer groups, screener filters)
• Monitor platform security, detect fraud, enforce rate limits, and prevent unauthorized access
• Diagnose bugs, measure performance, and improve platform features based on aggregated usage patterns
• Comply with legal obligations and respond to valid legal process
• Notify you of material changes to the Service, Terms, or this Privacy Policy
• Send promotional communications about BankRegReports products and features (you may unsubscribe at any time)
• Send business outreach email to professionals whose contact information we obtained from other sources, as described above (you may unsubscribe at any time)
• Understand which campaigns and sources bring us users, using the first-visit information described above

We do not sell your personal information to third parties. We do not use your data to display third-party behavioral advertising.

5. Information Disclosure

We do not share, sell, rent, or otherwise disclose your personal data except in the following circumstances:

• Service providers: We share data with contractors and vendors who perform services on our behalf (hosting, payment processing, email delivery, customer relationship management, error monitoring, analytics), under contractual obligations that restrict their use of your data to the services they provide to us.
• Business transfers: If BankRegReports is involved in a merger, acquisition, asset sale, or similar transaction, your data may be transferred as part of that transaction. We will notify registered users via email before your data is transferred and becomes subject to a different privacy policy.
• Legal requirements: We may disclose your information when required by law, court order, or government authority, or when we believe disclosure is necessary to protect the rights, property, or safety of BankRegReports, our users, or the public.
• Enforcement: We may disclose information to enforce these Terms of Service, collect subscription fees, or investigate potential violations.
• With your consent: For any other purpose, with your explicit consent.

We may disclose aggregated, deidentified information (which cannot reasonably be used to identify you) without restriction.

6. User Choices

Cookies: You may set your browser to refuse all cookies or to notify you when a cookie is sent. Some parts of the Website (login, watchlists, saved settings) will not function properly without cookies.

Promotional email: Each promotional email we send includes an unsubscribe link. Transactional emails (account verification, billing, watchlist alerts you have enabled) are not affected by unsubscribing from marketing communications.

Watchlist alerts: You can enable or disable individual email alerts at any time through your watchlist settings on the platform.

Google Analytics: Use the Google Analytics opt-out add-on to prevent your visits from being included in aggregated analytics.

7. Accessing, Correcting, and Deleting Your Data

You can review and update your account information through your account settings page. To request access to, correction of, or deletion of your personal data, email us at admin@bankregreports.com. We will respond within 30 days (or within any shorter period required by applicable law).

Account deletion removes your personal profile, watchlists, and preferences. We cannot delete your personal data without also deleting your user account. Anonymized usage data may be retained after account deletion. If you unsubscribed from our marketing email, we keep a one-way fingerprint of your email address after deletion so that we never email that address again. The fingerprint cannot be turned back into your address and is not linked to any account. We will not accommodate requests that would require us to provide inaccurate information or that are not permitted by applicable law.

Data Retention

We keep personal data only as long as needed for the purposes above. Account, billing, and subscription records are retained for the life of your account. After you delete your account, we keep billing and subscription records to meet legal, tax, and audit obligations, but we remove your name, email address, postal address, and card details from them and unlink them from your account. Automatically collected usage logs are pruned on a rolling schedule: general activity and API logs after about 90 days, search and bank-view records after about 6 months, and login/security records for about 1 year, after which they are deleted or fully anonymized. Aggregated, non-identifying statistics may be kept indefinitely.

8. Jurisdiction-Specific Rights

GDPR (EEA, Switzerland, United Kingdom)

If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have additional rights under the General Data Protection Regulation, including: the right to access your data, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object to processing, and the right to withdraw consent. Our legal bases for processing are contract performance, legitimate interests (security, fraud prevention, analytics), legal obligation, and consent where indicated. To exercise any GDPR right, contact us at admin@bankregreports.com.

CCPA / CPRA (California Residents)

California residents have the right to: know what personal information we collect, use, disclose, or share; request deletion of personal information; correct inaccurate personal information; and opt out of the sale or sharing of personal information. We do not sell your personal information for money. We do use analytics and advertising cookies that may constitute “sharing” for cross-context behavioral advertising under the CPRA; these load only after you accept cookies, and you can change or withdraw that choice at any time by clearing site data in your browser. We will not discriminate against you for exercising your CCPA/CPRA rights. To submit a request, contact us at admin@bankregreports.com.

9. Data Security

We implement industry-standard technical and organizational measures to protect your personal data against accidental loss and unauthorized access, use, alteration, and disclosure. These include:

• HTTPS / TLS encryption for all data in transit
• Django's PBKDF2+SHA256 secure password hashing
• CSRF token protection on all state-changing operations
• HTTP Strict Transport Security (HSTS)
• Content-Security-Policy headers
• IP-based rate limiting and automated abuse detection
• Access to production systems restricted to authorized personnel only

You are responsible for keeping your password confidential. Where you have chosen a password to access the Service, you are responsible for maintaining its confidentiality and for all activity occurring under your account. Internet transmission carries inherent security risks; no transmission method is 100% secure. We are not liable for the circumvention of any privacy settings or security measures.

10. US Data Processing and International Transfers

BankRegReports is based in the United States. If you access the Service from outside the United States, your personal data will be transferred to, stored, and processed in the United States, which may not provide the same level of data protection as your home jurisdiction. Where we transfer the personal data of individuals in the EEA, United Kingdom, or Switzerland, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and, where applicable, our processors’ certification under the EU-US Data Privacy Framework. U.S. federal, state, and local governments, courts, or law enforcement may be able to obtain access to your information as permitted by U.S. law.

Where we transfer data internationally to third-party processors, we enter into Data Processing Agreements requiring them to comply with applicable privacy law and this Policy.

11. Third-Party Services

The following third-party services may process your data as part of operating the Service. Each is governed by its own privacy policy:

• Stripe, Inc.: subscription billing and payment processing (stripe.com/privacy)
• Google LLC: OAuth 2.0 sign-in; Google Analytics 4 and Google Ads conversion measurement, both after you accept cookies; and, through Google Workspace (Gmail), delivery of the email we send, including sign-in codes, account and billing notices, watchlist alerts, and marketing email (policies.google.com/privacy)
• HubSpot, Inc.: customer relationship management. It may hold your name, email address, job title, organization, and subscription details (legal.hubspot.com/privacy-policy)
• Microsoft Corporation: Microsoft Clarity (anonymized session analytics) and, where a campaign is running, the Bing Ads UET conversion tag. Both load only after you accept cookies (privacy.microsoft.com)
• X Corp. (Twitter/X): Ads conversion pixel, loaded only after consent and only while an X Ads campaign is active (x.com/privacy)
• Smartlead: sending and managing our business outreach email. It holds the contact details of the people we email and records replies, bounces, unsubscribes, and, where enabled, opens and clicks
• Railway Corporation: cloud hosting for the application, and for the database that serves the public regulatory dataset
• Neon, Inc.: managed PostgreSQL database hosting for account and application data (neon.tech/privacy-policy)
• Cloudflare, Inc.: content delivery, edge caching, and security and bot protection, including the Turnstile check on sign-up, password reset, and contact forms; object storage for media and for our encrypted database backups; and the AI model that answers assistant questions (cloudflare.com/privacypolicy)
• GitHub, Inc.: runs the scheduled job that creates our encrypted nightly database backups (GitHub privacy statement)
• Functional Software, Inc. (Sentry): application error monitoring. Error reports exclude request bodies, cookies, and IP addresses, and one-time links are removed from web addresses. Passwords and payment data are never sent.
• Have I Been Pwned: when you set or change a password, we send the first five characters of a one-way hash of it to check whether the password has appeared in a known data breach. Your password and email address are never sent (haveibeenpwned.com/Privacy)
• Spotify AB: the embedded player on our podcast page. Spotify receives your IP address and browser details when that page loads (spotify.com/legal/privacy-policy)

12. Changes to This Policy

We may update this Privacy Policy at any time. When we make material changes, we will update the "Last updated" date at the top of this page and notify registered users via email. Your continued use of the Service after changes are posted constitutes your acceptance of the revised Policy.

13. Contact Us

For questions, concerns, or data-related requests, contact us at:

BankRegReports LLC
PO Box 682704, Marietta, GA 30068, USA
admin@bankregreports.com