Pallant Reports Privacy Policy

This policy explains how Pallant handles information in Pallant Reports, the private reporting tool we use to monitor our clients’ marketing accounts and to share performance reports with them. It sits alongside our website privacy policy, which covers visitors to pallant.studio.

Who we are

Pallant Reports is run by:

Five Fathoms Limited trading as Pallant
Freedom Works, Bartholomew House, 1 Black Lion Street, Brighton, BN1 1ND
Company number: 09822815
Email: hello@pallant.studio

We are the data controller for information about the people who use Pallant Reports. For the marketing data we collect from our clients’ accounts, we act on behalf of each client under our agreement with them.

What Pallant Reports is

Pallant Reports is not a public service. It is used only by:

• The Pallant team, to see how each client’s marketing is performing day to day and to prepare monthly reports.
• Client contacts we invite, who can sign in to see their own reports and dashboards, and nothing belonging to any other client.

Information from connected marketing platforms

With our clients’ permission, we connect Pallant Reports to the marketing platforms we manage for them. These include Google Ads, Google Analytics, Google Search Console, Google Business Profile, Microsoft Advertising, Bing Webmaster Tools, Meta (Facebook and Instagram) Ads, LinkedIn Ads, Plausible Analytics, WooCommerce, Shopify, CallRail, BrightLocal, Moz and Google PageSpeed Insights.

From these platforms we collect aggregated performance figures only: for example daily impressions, clicks, ad spend, conversions, website sessions, search rankings, order totals and products sold. We use them to build each client’s dashboards and monthly reports.

We do not keep personal information about our clients’ customers or website visitors:

• Every collection is checked automatically before it is saved. Anything that contains an email address, a phone number or a personal field (such as a name or street address) is not saved.
• Shop order data is reduced to totals, products and the first half of the delivery postcode (for example “BN1”), so no individual order or customer can be identified.
• Call tracking data is kept as counts, such as calls answered, never as callers’ numbers or recordings.

LinkedIn

When the Pallant team connects a LinkedIn account to Pallant Reports, we ask LinkedIn for permission to read advertising information for the ad accounts that account manages.

What we read and store:

• The names and IDs of the ad accounts, campaigns and ads we manage for our clients.
• Daily advertising results: impressions, clicks, spend, engagement, video views, leads and website conversions recorded by the LinkedIn Insight Tag.
• LinkedIn’s anonymised audience breakdowns of who saw or clicked the ads, for example by company, industry, job function, seniority or location. LinkedIn groups and approximates these figures and leaves out small groups, so they never identify an individual.
• Follower and visitor statistics for client Company Pages, where we manage them.
• The basic profile (name) of the person who connected the LinkedIn account, so we know who authorised the connection.
• The access credentials LinkedIn issues for the connection, stored encrypted.

How we use it: only to show each client their own LinkedIn results in their dashboards and reports, alongside their other marketing channels, and so the Pallant team can manage their campaigns.

What we never do: sell, rent or share LinkedIn data with anyone other than the client it belongs to; use it to target or retarget advertising; try to identify individual LinkedIn members; or combine it with data from other LinkedIn sources.

Withdrawing permission: the connection can be removed at any time from the Connections page in Pallant Reports, or from LinkedIn under Settings › Data privacy › Permitted services. When a connection is removed we delete its stored credentials straight away. You can also ask us to delete the LinkedIn data we hold by emailing hello@pallant.studio.

Google, Microsoft and Meta

Pallant Reports’ use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We handle data from Microsoft and Meta in the same way: it is used only to report to the client whose account it is, and it is never sold or used for advertising.

Information about people who use Pallant Reports

• The Pallant team sign in with their Google Workspace account. We store each person’s name, email address and role, and a log of changes they make in the tool, such as editing a report or a budget.
• Client contacts sign in using a personal link we email to them. We store their name and email address (as provided by the client) and a record of when each link was sent and used. We also log which report and dashboard pages they view, so we know whether reports are being read.
• Cookies: Pallant Reports uses only the cookies needed to keep you signed in. A client’s sign-in cookie lasts up to 90 days on that device. There are no analytics, advertising or tracking cookies in the tool.

Who processes information for us

We use a small number of trusted providers to run Pallant Reports:

• Netlify: hosts the tool and its database.
• SendGrid (Twilio): sends report emails and sign-in links.
• Anthropic: when the Pallant team asks Claude to help draft a monthly report, it is sent that month’s aggregated figures and the changes we logged. No personal information is included.
• The marketing platforms listed above: we request data from them using the connections our clients authorise.

Some of these providers may process information outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or standard contractual clauses.

Security

All connections to Pallant Reports are encrypted. Credentials for connected platforms are encrypted when stored. Access is limited to the Pallant team and to each client’s invited contacts, who can only see their own information. Sign-in links can be withdrawn at any time.

How long we keep information

• Marketing performance data and reports: for as long as we work with the client, so month-on-month and year-on-year comparisons stay accurate. When our work together ends, or when a client asks, we delete it.
• Platform connections and credentials: until the connection is removed, then deleted straight away.
• Client contacts and their sign-in records: until the contact is removed or the client relationship ends.
• Records of changes made in the tool: for as long as we hold the client’s reports.

Your rights

Under UK data protection law you have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to withdraw consent where we rely on it, and to receive it in a portable format.

To make a request, email hello@pallant.studio. We will respond within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this policy

If we change how Pallant Reports handles information, we will update this page and the date at the top. Where a change affects something you have agreed to, such as a platform connection, we will ask again.