Right Desk Reports Privacy Policy
Effective Date: May 13, 2026 Last Updated: October 7, 2026
1. Who We Are
Right Desk Reports ("we", "us", "our") is operated by The Marketing Millennial. You can contact us at info@themarketingmillennial.com
This Privacy Policy explains how the Right Desk Reports mobile application ("the App") collects, uses, and protects your personal information.
2. What Data We Collect
Data you enter directly:
Workplace incident descriptions, dates, locations
Names of individuals involved in incidents (colleagues, managers)
Your name, employee ID, department, company name (optional — only if you enter it)
Voice recordings converted to text via your device's microphone
Data collected automatically:
App version and device type (for crash reporting only)
No tracking, no advertising identifiers, no analytics
What we do NOT collect:
Your location
Contacts
Photos stored on your device (only photos you explicitly attach to incidents)
Any data without your direct action
3. Where Your Data Is Stored
Secure cloud storage (Firestore): All incident records, notes, and saved reports are stored in Google Cloud Firestore, a secure cloud database operated by Google. Your data is scoped to your account and is not accessible to other users. Data is encrypted in transit and at rest.
Firebase Storage: Photos you attach to incidents are stored in Google Firebase Storage, also scoped exclusively to your account. Only you can access your photos.
Sent to our AI report generation service: When you tap Generate AI Report, the incident details you have selected are sent over an encrypted HTTPS connection to our secure server hosted on Railway (railway.app), which immediately forwards them to OpenAI (openai.com) to generate your report. The report text is returned to your account and saved in Firestore.
We do not retain your incident data on our Railway or OpenAI servers after report generation is complete.
4. How We Use Your Data
Purpose
Legal Basis (GDPR)
Storing your incident records securely in the cloud (Firestore)
Performance of contract / Your consent
Generating your AI HR report via OpenAI
Your explicit consent (you initiate the action)
Improving app stability
Legitimate interests
We do not use your data for advertising, profiling, or sale to third parties.
5. Third-Party Services
OpenAI (openai.com) When you generate a report, your incident data is processed by OpenAI's API. OpenAI acts as a data processor on our behalf. OpenAI's privacy policy is available at: https://openai.com/privacy
Railway (railway.app) Our report generation server is hosted on Railway. Railway processes data in transit but does not store your personal data. Railway's privacy policy: https://railway.app/legal/privacy
Google Firebase (firebase.google.com) Your incident records and photos are stored in Google Cloud Firestore and Firebase Storage. Google acts as a data processor on our behalf. Your data is encrypted and access-controlled to your account only. Google's privacy policy: https://policies.google.com/privacy
6. Microphone / Voice Data
The App requests access to your device microphone solely to enable voice-to-text input for completing incident forms. Voice is processed entirely on your device using your device's built-in speech recognition. We do not transmit, record, or store raw audio files.
You can deny microphone permission at any time in your device settings. The app remains fully functional without it — voice input is optional.
7. Sensitive Data
Incident records may contain sensitive personal data including descriptions of harassment, discrimination, and details about third parties (colleagues, managers). This data:
Is stored securely in your account on Google Cloud Firestore, encrypted in transit and at rest
Is only sent to OpenAI when you explicitly tap Generate AI Report
Is never shared with any party other than OpenAI (for report generation) at your direction
Should not be shared with unauthorized parties
8. Your Rights (GDPR EU/EEA Users)
If you are located in the EU or EEA, you have the following rights:
Right
How to exercise it
Right of access
Email us — we will confirm what data we hold
Right to deletion
Use the Delete Account feature in the app or visit rightdeskreports.com/delete-account/ — this permanently removes all your data from our servers. Email us to confirm deletion is complete.
Right to rectification
Edit your incident records directly in the app
Right to portability
Your report text can be exported as PDF at any time
Right to object
You can stop using report generation at any time
Right to withdraw consent
Delete your account at any time via the app or at rightdeskreports.com/delete-account/
To exercise any right, contact us at: sarai@themarketingmillennial.com We will respond within 30 days.
9. Data Retention
In the cloud: Incident data is retained in your account until you delete individual records, delete your account, or contact us to request deletion. Deleting the app does not delete your cloud data — you must delete your account to remove all records.
On our servers: We do not retain your personal data after report generation is complete. Server logs (which do not contain your incident content) are retained for up to 30 days for security monitoring.
10. Children's Privacy
Right Desk Reports is intended for adults in employment. We do not knowingly collect data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us immediately.
11. Data Security
We implement the following security measures:
All data transmission is encrypted via HTTPS/TLS
Incident and report data is stored in Google Cloud Firestore with role-based access controls
Photo evidence is stored in Firebase Storage, accessible only to the authenticated account owner
Our server uses bearer token authentication
No incident data is logged or retained on our Railway or OpenAI servers
12. International Data Transfers
If you are located in the EU/EEA, your data is stored on servers in the United States (Google Firebase/Firestore, Railway, OpenAI). This transfer is made on the basis of your explicit consent when you create an account and use the app. OpenAI participates in the EU-US Data Privacy Framework. Google Firebase complies with standard contractual clauses for international data transfers.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via an in-app notice. The "Last Updated" date at the top of this policy will always reflect the most recent version.
14. Contact Us
For any privacy questions, data requests, or concerns:
Sarai / The Marketing Millennial Email: sarai@themarketingmillennial.com
For EU/EEA users: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.