Legal
Privacy Policy
Effective date: 19 October 2026 | Version: 1.0
1. Who we are
ReportOne is provided by Vector Tax Solutions LLC, a Delaware limited liability company within the Vector LS group(“Vector Tax”, “we”, “us”). Our registered office is at 16192 Coastal Highway, Lewes, Delaware 19958, United States. Our Delaware file number is 10495189. Contact us at privacy@vectorls.io about privacy matters or at contact@vectorls.io for general support. Our Legal Information contains further company details. For the website, business-contact and other processing described below that we undertake for our own purposes, Vector Tax Solutions LLC is the responsible controller.
This Policy explains how we handle personal information relating to website visitors, enquiries, business contacts and user-account administration. It also explains our role when clients use ReportOne to process information about investors, account holders and controlling persons.
2. Information processed for clients
Clients use ReportOne to collect information, manage declarations and prepare CRS/FATCA reporting. For personal information in client files, declarations and reports (“Client Data”), we generally act as a processor or subprocessor on documented client instructions. The responsible controller determines why that information is processed. An administrator or adviser may act on its behalf. The controller may be the relevant fund, financial vehicle or institution, rather than the administrator that operates the account.
Our client agreement and data-processing terms govern this processing. This Policy does not give us additional rights to use Client Data. We do not use it for unrelated business, advertising, model training or independent development, testing, evaluation or improvement of ReportOne or another product. Necessary validation, troubleshooting and defect correction within the instructed service remain permitted. Only genuinely anonymous and aggregated service statistics, identifying neither an individual nor a client, may be used for wider improvement, subject to confidentiality.
If you receive a self-certification request, the notice displayed with that request identifies the responsible controller and links to its privacy information about the purpose, legal basis, recipients, retention and use of your information. Contact the identified organization about the request. We assist the responsible client with requests concerning Client Data.
3. Information and sources
We handle two kinds of information. First, we receive information about people who visit our website, contact us or use and administer a client account. They supply it directly, their organization supplies it, or it is generated when they use the website or service. The table below describes this information.
| Information | Examples |
|---|---|
| Enquiries and business contacts | Name, business email, company, role, telephone if provided, correspondence and demo arrangements |
| Account administration | Name, email, organization, role, authentication identifiers, permissions and account events |
| Billing and support | Invoice/contact details, payment status, contractual records and support correspondence |
| Technical and security records | Timestamps, IP address, browser/device information, access and audit events |
Information in client reporting files
Separately, clients or their authorized administrators upload information about investors, account holders, people controlling corporate investors and, where relevant, directors or other people identified in reporting documents. Authorized integrations may also supply this information. These individuals may never visit ReportOne or hold a user account.
Client Data can include names, addresses, birth details, tax residence and tax identifiers, investment/account balances and income, reporting classifications, self-certifications, supporting documents and generated XML/PDF files or reports. We process it on the responsible client’s instructions, as explained in section 2.
Please provide only information needed for the relevant task. Use the designated client workflow for investor documents, tax identifiers and financial records; do not put them into public enquiry forms or ordinary support emails. Health information, religious beliefs and criminal-record information are not normally required for this reporting workflow. If unrelated sensitive information is included accidentally, notify the responsible client or our support team without resending the material, so that appropriate access restrictions and removal can be arranged.
4. Our own processing purposes
Where GDPR applies to our controller processing, the following bases apply. They do not replace the client controller’s legal basis for Client Data.
| Purpose | Legal basis |
|---|---|
| Answer enquiries and arrange demos | Legitimate interests in responding and developing business relationships; pre-contractual steps where the individual is personally entering a contract |
| Administer business relationships and user accounts | Legitimate interests in providing and administering the service; contractual necessity where the individual is a contracting party |
| Manage billing and required records | Applicable EU or Member State legal obligations where GDPR Article 6(1)(c) applies; otherwise legitimate interests in maintaining business records, meeting other applicable legal requirements and handling claims |
| Protect the website and service | Legitimate interests in preventing misuse and protecting information, and applicable legal duties |
| Optional marketing or technologies | Consent where required; otherwise the basis permitted for the specific activity, with applicable opt-out rights |
We balance legitimate interests against individuals’ rights and reasonable expectations. You can request further information about that assessment. Required fields are identified; without necessary information we may be unable to respond or provide the requested function. Optional marketing is not required to obtain a demo or use the service.
5. AI-assisted functions
ReportOne uses Google Vertex AI/Gemini for document extraction and analysis within the authorized client workflow. Relevant providers and locations are described in section 7 and in our client data-processing terms.
We do not use Client Data, or authorize AI providers to use it, for model training or independent product development, testing or evaluation. Necessary service validation, troubleshooting and defect correction remain subject to client instructions and confidentiality. The applicable provider terms and approved configuration govern temporary retention, caching, security monitoring and logging; those arrangements must remain within the authorized processing scope. A training restriction does not mean zero retention.
Automated extraction and validation can produce errors. Authorized users must review relevant source information and outputs before reporting or other decisions. We do not use the controller processing described in this Policy to make solely automated decisions with legal or similarly significant effects about individuals. Client-controlled activities remain subject to the client’s instructions, responsibilities and applicable law.
6. Recipients
Access is limited to the relevant purpose and safeguards. Recipients include authorized personnel; approved hosting, authentication, document-processing, email, website-security (including Cloudflare, Inc.) and support providers; professional advisers for relevant business matters; and authorities where disclosure is lawfully required and permitted.
For Client Data, vendor, contractor and partner access must be covered by the client’s authorized processing arrangements. A client, cooperating partner or group company does not receive access to another client’s information merely because it uses or works with ReportOne. Optional integrations operate within the agreed scope.
We do not sell Client Data or use it for targeted advertising. We do not sell or share personal information for cross-context behavioral advertising. Any disclosure in a corporate transaction must respect applicable law, confidentiality and the purposes and safeguards governing the information; it does not authorize unrelated exploitation of Client Data.
7. Locations and international transfers
Core application processing and storage are configured on Google Cloud in Belgium, with document analysis through the configured EU endpoint. Supporting services, including authentication and transactional email, involve processing in the United States. This public website is served through Cloudflare, Inc., a United States provider with a global network. Authorized technical support may involve access from Israel. Vector Tax is established in the United States. European hosting does not mean all processing or access remains in Europe.
Where GDPR transfer rules apply, we use the relevant adequacy decision or appropriate safeguards, with any necessary assessment and additional protections. Reliance on the EU–US Data Privacy Framework applies only to the currently certified recipient and covered processing; it does not certify ReportOne or the Vector group. Contact privacy@vectorls.io for information about safeguards and a copy where available, subject to lawful redactions.
We assess public-authority requests, limit disclosure to what is lawfully required and permitted, and notify the relevant client where lawful. A foreign authority’s request does not itself establish a lawful basis for disclosure under GDPR. Applicable transfer safeguards and client processing terms govern our response for Client Data.
8. Retention and security
Client Data follows the client’s lawful instructions and the agreed service lifecycle, including export, active deletion and separate backup expiry. Protected backup copies are unavailable for ordinary use during expiry, and relevant deletion instructions are reapplied if a backup is restored. The client determines its statutory investor/tax-record retention obligations; these do not automatically require ReportOne to store all records for the same period.
We keep our own records, including enquiries, user-account records, security logs and support records, only for as long as needed for the purposes described in this Policy. Billing and contractual records are retained for the periods required by applicable accounting, tax and limitation rules, measured from the relevant transaction or end of the relationship. Relevant records may be retained longer for an identified legal obligation or legal claim; access and use are restricted to that purpose, with deletion when the need ends.
We apply technical and organizational safeguards appropriate to the service and the information handled. No system guarantees absolute security. This Policy does not reduce our binding client security obligations.
9. Rights and requests
Depending on applicable law and circumstances, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. Rights are subject to legal conditions and exceptions, including lawful recordkeeping. You may withdraw consent without affecting earlier lawful processing, and object to direct marketing at any time.
Contact privacy@vectorls.io. We may request information reasonably needed to verify identity and locate records. Do not send a passport, full tax identifier or financial documents unless we arrange a secure process. Where GDPR applies to our response as controller, we normally respond within one month, subject to permitted extensions and explanations.
For information processed on client instructions, we coordinate the request with the responsible client and assist under our processing terms. A direct request to ReportOne does not itself authorize deletion or disclosure of another organization’s reporting records.
You may complain to the competent data-protection authority, particularly in the country where you habitually reside, work or believe an infringement occurred. Contact details are available through the European Data Protection Board’s directory of supervisory authorities.
10. Cookies, US disclosures and updates
Our Cookies page describes the technologies used on this website, their purposes and your choices. Optional technologies requiring consent remain inactive until consent and can be disabled through the available controls.
Depending on applicable US law, you may have additional rights concerning your personal information, including a right to appeal a refused request. Contact privacy@vectorls.io to exercise a right or appeal. Where the law requires an appeal process, we provide the applicable instructions and explain our response. We do not discriminate unlawfully for exercising privacy rights. Additional jurisdiction-specific disclosures, where applicable, form part of this Policy.
We publish updates with their effective date and version and give additional notice where appropriate or required. Updates do not themselves authorize new uses of Client Data or amend client agreements.
Provider: Vector Tax Solutions LLC, 16192 Coastal Highway, Lewes, Delaware 19958, United States. Delaware file number: 10495189.
Privacy: privacy@vectorls.io. Support: contact@vectorls.io.