Privacy Policy

Mammoth Report ("we", "us", "our") is a multi-platform analytics service available at mammoth.report and app.mammoth.report. We are the data controller for personal information collected through our services.

Contact: info@mammoth.report

Account information

• Email address and password (encrypted) when you create an account
• Business name and preferences set during onboarding
• Team member emails if you add collaborators

Usage data

• Pages visited on mammoth.report and app.mammoth.report
• Features used, reports generated, and alerts configured
• Session identifiers stored in your browser
• Approximate location derived from IP address (country and city only)

Platform connection tokens

When you connect advertising or commerce platforms (Meta, Google Ads, TikTok, Takealot, WooCommerce, Mailchimp), we store OAuth access and refresh tokens solely to retrieve your data on your behalf. We never store your platform passwords.

Billing information

All payment processing is handled by Paddle (our Merchant of Record). We do not store credit card numbers. We receive a subscription ID, status, and plan information from Paddle after a successful transaction.

Cookies and tracking

• Authentication cookies to maintain your login session
• Preference cookies for theme and display settings
• Analytics via Google Tag Manager and a first-party page view beacon
• Meta Pixel for conversion tracking on the marketing site

• To provide, operate, and improve the Mammoth Report service
• To retrieve and display your advertising and commerce platform data
• To send scheduled reports, alerts, and notifications you have configured
• To process payments and manage your subscription via Paddle
• To send product updates and trial reminders (unsubscribe at any time)
• To monitor for errors and service reliability issues
• To comply with our legal obligations

We do not sell, rent, or trade your personal data to any third party.

We share data only with the following service providers under data processing agreements:

• Supabase — Database and authentication. Your account data and platform tokens are stored in Supabase-hosted PostgreSQL databases.
• Paddle — Payment processing and subscription management. Paddle is the Merchant of Record for all transactions.
• Resend — Transactional email delivery (reports, notifications, alerts).
• Vercel — Hosting and edge network for our web application.
• Google Tag Manager — Tag management for analytics.

We may disclose your data if required by law or in response to valid requests by public authorities.

• Account data is retained for as long as your account is active
• Platform tokens are deleted when you disconnect a platform or delete your account
• Page view and session logs are retained for 12 months
• Billing records are retained for 7 years as required by financial regulations
• After account deletion, personal data is removed within 30 days except where legally required

Depending on your location, you may have the following rights:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your personal data
• Portability — Request your data in a machine-readable format
• Objection — Object to processing for marketing purposes
• Restriction — Request restriction of processing in certain circumstances

We extend these rights to all users globally as a matter of policy. To exercise any right, email info@mammoth.report. We respond within 30 days.

• All data encrypted in transit using TLS 1.2 or higher
• Database encryption at rest
• OAuth 2.0 for all platform connections — we never receive your platform passwords
• Role-based access controls limiting internal access to customer data

Your data may be processed in countries outside your own, including the United States, where our infrastructure providers (Supabase, Vercel) maintain servers. We ensure appropriate safeguards are in place for any international transfers.

Mammoth Report is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have done so inadvertently, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or in-app notice. The "last updated" date reflects the most recent revision.

For privacy questions, requests, or complaints: