Privacy Policy

CallReports.ai is a product of Inventous LLC (“Inventous,” “we,” “us,” or “our”), an Illinois limited liability company. This policy describes how we handle information in connection with the CallReports.ai website and application (the “Service”).

This policy governs the Service specifically. Inventous maintains a separate privacy policy for its corporate site at inventous.com, and other Inventous products maintain their own.

The core of the Service is public regulatory data: call reports and related filings published by the FDIC, NCUA, and Federal Reserve. That data describes institutions, not individuals, and we obtain it from public sources rather than from you. Nothing in this policy restricts our use of it.

CallReports.ai is not affiliated with the FDIC, NCUA, or FFIEC.

Account information. Your email address, which is how you sign in. We use a passwordless magic link, so we do not collect or store a password.

Beta application information. If you apply for access, we collect your name, email address, and the institution name, charter or certificate number, asset size range, and role you provide.

Institution association. The institution you attach to your account, and where applicable a verified association between your email domain and an institution.

Content you provide. Documents you upload (for example, a loan policy or board packet), institutions you add to a watchlist or favorites, peer groups you define, contacts you record, reports and scenarios you generate, and questions you ask the assistant.

Technical information. Log and device data (IP address, browser and operating system, pages visited, referring URLs), product analytics events describing how the Service is used, and diagnostic data captured when an error occurs.

We use information to:

• Provide the Service, including peer benchmarking and reporting.
• Authenticate you and secure your account.
• Send transactional messages such as sign-in links, access invitations, and scheduled reports you request.
• Diagnose errors, monitor reliability, and improve the product.
• Process payments and manage subscriptions.
• Prevent abuse and comply with legal obligations.

A document you upload is used only to produce output for the institution it belongs to. It is never incorporated into a peer statistic, benchmark, or any other output shown to a different institution, and it is not used to train models.

Access is limited to users associated with that institution, enforced at the database layer and not only in the interface.

Peer comparisons are aggregates drawn from public regulatory filings. We enforce a minimum group size before any percentile or peer statistic is shown, and suppress statistics that fall below it, so a peer figure does not identify an individual institution.

We do not sell your information. We do not rent or trade it, do not share it with data brokers, and do not use it to serve advertising.

Service providers. We share information with vendors who operate the Service on our behalf, each bound to use it only to provide services to us:

• Supabase: database, authentication, and file storage.
• Vercel: hosting, delivery, and site analytics.
• Resend: delivery of transactional email.
• PostHog: product analytics.
• Sentry: error monitoring and diagnostics.
• Stripe: payment processing. Card details go to Stripe directly; we do not receive or store them.
• Anthropic: the AI model behind assistant answers and written analysis.

AI features. When you use the assistant or generate written analysis, the relevant content is sent to Anthropic to produce a response. We do not permit that content to be used to train third-party models.

Legal requirements. We may disclose information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights or the safety of others.

Business transfers. If Inventous is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction.

We encrypt data in transit and at rest, authenticate without passwords, and enforce access controls at the database layer so that a user reaches only the institutions they are associated with. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain account and content information for as long as your account is active and thereafter as needed for legitimate business or legal record-keeping. You may request deletion at any time using the contact details below. Public regulatory data is retained regardless, as it does not originate with you.

We use cookies necessary to keep you signed in and to operate the Service, along with analytics that measure product usage and performance. We do not use advertising cookies and do not serve ads.

Depending on your jurisdiction, you may have the right to access, correct, delete, or receive a portable copy of your personal information, and to opt out of non-essential communications. To exercise any of these, contact us at the address below. We will respond within 30 days.

California residents. We do not sell personal information. California residents may request access, deletion, or correction, and we will not discriminate against you for exercising those rights.

The Service is intended for business use and is not directed at individuals under 18. We do not knowingly collect information from children.

This policy is governed by the laws of the State of Illinois, without regard to its conflict-of-law principles. Disputes arising out of or relating to it follow the process described in our Terms of Service: good faith discussion, then mediation, then binding arbitration administered by the American Arbitration Association, seated in DuPage, Kane, Kendall, Will, or Grundy County, Illinois.

We may update this policy. Material changes will be posted here with a revised date, and your continued use of the Service after that date constitutes acceptance.

Inventous LLC
1411 S. Bridge Street, Yorkville, IL 60560
privacy@inventous.com
(847) 878-9685