Privacy Policy

Last updated: January 2, 2026

AI Report Maker ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Google Workspace Add-on.

1. Information We Collect

When you use AI Report Maker, we collect:

• Account Information: Your Google account email address for authentication and subscription management.
• Document Content: Text content from documents you choose to process with our AI tools. This content is sent to our secure servers for processing and is not stored permanently.
• Usage Data: Information about how you use the add-on, including feature usage counts and subscription status.

2. How We Use Your Information

We use the collected information to:

• Provide AI-powered document analysis and generation services
• Manage your subscription and usage limits
• Improve our services and develop new features
• Send important service-related communications

3. Data Processing and Storage

• Document Processing: Document content is processed in real-time using Google Cloud AI services and is not permanently stored on our servers.
• User Data: Account information and usage statistics are stored securely in our database (hosted on Supabase with enterprise-grade security).
• Payment Information: Payment processing is handled by Stripe. We do not store your credit card information.

4. Data Sharing

We do not sell your personal information. We may share data with:

• Service Providers: Third-party services that help us operate (Google Cloud, Supabase, Stripe)
• Legal Requirements: When required by law or to protect our rights

5. Data Security

We implement industry-standard security measures including:

• HTTPS encryption for all data transmission
• Secure authentication via Google OAuth
• Row-level security on our database
• Regular security audits

6. Your Rights

You have the right to:

• Access your personal data
• Request deletion of your data
• Export your data
• Opt-out of non-essential communications

7. Data Retention

We retain your account information for as long as your account is active. Document content is processed in real-time and not stored. You can request deletion of your account and associated data at any time.

8. Children's Privacy

AI Report Maker is not intended for children under 13. We do not knowingly collect information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: support@aireportmaker.com

11. HIPAA Compliance and Healthcare Data

AI Report Maker has implemented technical safeguards designed to support HIPAA compliance for healthcare organizations:

Data Processing Model

• No PHI Storage: Protected Health Information (PHI) contained in documents is processed in real-time only. Document content is never stored in our databases or servers.
• Memory-Only Processing: All AI processing occurs in transient memory and is immediately discarded after the response is returned to the user.
• User's Own Storage: All documents remain in the user's Google Drive, which they control.
• PHI Processing Exclusivity: All document content containing PHI is processed exclusively through Google Cloud services (Vertex AI) covered by our Business Associate Agreement. Our application database (Supabase) is explicitly excluded from PHI handling and only stores account metadata, usage statistics, and template field labels—never document content or patient information.

Audit Logging

We maintain HIPAA-compliant audit logs that track:

• User authentication events
• AI tool usage (operation type only, not content)
• Timestamps of all operations

These logs contain only operation metadata and never include document content or PHI.

Business Associate Agreements

AI Report Maker maintains a Business Associate Agreement (BAA) with Google Cloud, which covers all AI processing of document content through Vertex AI. This ensures that any Protected Health Information processed through our AI tools is handled in compliance with HIPAA requirements.

For HIPAA-covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates requiring additional documentation, please contact us at enterprise@aireportmaker.com.

Third-Party Service Architecture

Our system is architected to ensure PHI is only processed by BAA-covered services:

• Google Cloud (BAA in place): All document content and AI processing occurs through Google Cloud Vertex AI, covered by our signed BAA.
• Supabase (No PHI): Our application database stores only account information, subscription status, and usage metadata. Document content and PHI are explicitly excluded from this system by design.
• Google Drive (User-controlled): All documents remain in the user's own Google Workspace, under their control and their organization's BAA with Google.

User Responsibilities

When using AI Report Maker with healthcare documents:

• Ensure you have appropriate authorization to process the documents
• Use the add-on only on secured devices and networks
• Follow your organization's policies for handling PHI
• Contact us to execute a BAA before processing PHI

12. Google API Services User Data Policy

AI Report Maker's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.