How we operate, in plain terms

About

Data Report Card grades how the companies in your life handle your personal data: whether you can get it, take it elsewhere, and delete it, and how hard they make it. Every grade is our assessment against a published rubric, built from facts we can point to and source. Like any rating system, it is ultimately our opinion and judgement call based on facts, but not a legal or factual conclusion.

Data Report Card is operated by Bricolage Inc., a Delaware corporation. Bricolage Inc. also builds consumer software. We disclose this because honesty about who runs a ratings site is part of earning your trust. It changes nothing about how the grades are made:

• Companies cannot pay for, sponsor, or influence their grade. No paid placement, no "verified partner" tier, no way to buy a better score.
• Our other products and this site do not share your data. They are separate services. Nothing you do here is sent to another product, and nothing from those products feeds these grades.
• The grades come from the rubric, not from our commercial interests — including companies whose products overlap our own.

If you think a grade is wrong, tell us.

Privacy

Effective June 28, 2026

The short version: we never receive the contents of your data.

When you use Data Report Card to collect your data footprint, your data moves directly from each company to your own device. Your exports and your account contents stay on your device. We never receive them, store them, or see them.

What we do collect

If you contribute to our research. You can optionally tell us about your experience requesting your data from a company. We store only a small set of non-identifying facts about that experience: which company, which jurisdiction, which data right, how many days the company took, whether the response was verified, and the signing domain of the confirmation email (a domain like example.com, never an address). We do not accept or store your name, your email, the email itself, its contents, or your data export — our server actively rejects any submission that tries to include them. You get an opaque receipt code to check your contribution's status; it is the only identifier and is not linked to you.

Connecting an account (optional). For a few providers, the secure sign-in step requires a one-time exchange that passes through our server. In that step a short-lived authorization code and access credential pass through in memory only — used once, never written to disk, never logged. Your actual data is fetched directly by your browser from the provider and written to your device; it never passes through our server.

Subscribing to our newsletter (optional). If you subscribe to our newsletter, your email address is collected and processed by Substack, Inc., our newsletter provider, under its own privacy policy and terms. We use it only to send you the newsletter, and you can unsubscribe from any issue. We never sell it, and we never use it to build a profile of you.

Ordinary website operation. Our site is served through a hosting and security provider (Cloudflare, Inc.), whose systems may log standard request metadata such as IP address and browser type at the network edge. We do not store your IP address in our own records.

What we never do

• We never sell your data.
• We never receive the contents of your data exports.
• We never build a profile of you from your contributions.

Analytics and cookies

We do not use third-party advertising or tracking cookies, and we do not load third-party analytics. The only data stored in your browser is functional and stays on your device. The only cookie we set is a session cookie used solely to sign in to our private, staff-only review area; it is never set when you browse the public site.

Contact: hello@datareportcard.com · Bricolage Inc., 2118 Wilshire Blvd. Suite 1098, Santa Monica, CA 90403.

Methodology

Why our grades are opinions on disclosed facts

A Data Report Card grade is our opinion, formed by applying a published rubric to facts we disclose and source. We show our work so you can check it and, if a fact is wrong, correct it.

• Public rubric. Each grade is built from a fixed set of dimensions — access, portability, friction & speed, deletion, whether the company sells or shares your data, and whether it trains AI on it — scored the same way for every company.
• Sourced facts. Every factual cell links to its source: a company's policy, a regulator filing, documentation, or an observation we describe and date.
• Enforcement counts, and it's recency-weighted. When a regulator or court has issued a verified fine, settlement, or judgment for violating data-rights law, we deduct points from the /12 total after the rubric score: −2 points for a verified action (severity 1 — opt-out failures, deceptive ad-targeting, disclosure lapses), or −4 points for the most serious records (severity 2 — reserved for unlawful large-scale data transfer, children's data, a breach causing demonstrable harm, or documented repeat offenses). Severity tracks the nature of the violation, not the size of the fine. Penalties are recoverable — a record weighs at full strength for about five years, then ramps down to zero by about eight years, conditional on no subsequent verified action (any new judgment resets the clock, so repeat offenders never age out). When a penalty decays to zero the record stays visible on the company's page; it simply stops moving the grade. We state only the verifiable fact — "no further verified action in N years" — never an inference that a company has reformed. Each penalty links to the regulator's own record and shows the full arithmetic — what the company scored on practices alone, the deduction, and the final grade. Data practices on paper and conduct in the world are different things, and a grade should reflect both.
• Opinion where it's labeled. When we characterize ("makes this hard," "best in class"), that is editorial judgment based on the disclosed facts above it — not a claim that a company has done anything unlawful.
• We update. Facts change. When a company changes a practice and we can source it, the grade changes.

A grade is not a legal ruling, a finding of wrongdoing, or a measure of a company's overall integrity. It is a structured, sourced opinion about specific data practices, against a public rubric.

Disclaimer

Data Report Card provides general information and our assessment of companies' data practices against a published rubric. It is not legal advice and not a legal ruling. Grades and commentary are our opinion based on the facts we disclose and source, which may change over time and may contain errors.

Company names and trademarks belong to their respective owners and are used to identify the companies we discuss. Their use does not imply affiliation with or endorsement by those companies.

We make no warranty that the information is complete, current, error-free, or that it accurately represents your own experience with your data or the companies. If you believe a fact is wrong, see Corrections — we want to fix it.

Corrections & disputes

We grade from sourced facts, and facts change. We have one process for anyone — including a graded company — who wants something corrected, reconsidered, or removed.

If a sourced fact is wrong, that's a correction:

• Tell us which company, which dimension, and which fact you believe is incorrect.
• Point us to a source — a policy page, documentation, or filing — showing the correct fact.
• Send it to hello@datareportcard.com.

We review every correction. When a sourced fact is wrong, we fix it and, where it affects the grade, we re-score. Correcting a fact is the way to prompt a re-review.

For everything else, the same address reaches us:

• If you disagree with a grade or our characterization, tell us why and share anything we should consider. We may update our assessment, but we don't remove or change a grade simply because a company disagrees with our opinion. A grade is protected opinion based on disclosed facts — not a claim of wrongdoing.
• If you believe content infringes your rights (for example, copyright, or material a third party submitted), tell us what the content is, where it appears, and the basis for your request, and we will review and act where appropriate.
• Company names and trademarks belong to their owners and are used only to identify the companies we discuss; this does not imply affiliation or endorsement (see Disclaimer).

We aim to respond to good-faith requests promptly. This process does not waive any rights or defenses available to us, including for protected opinion.

Terms of Use

Effective June 28, 2026

These terms govern your use of Data Report Card (the "Site"), operated by Bricolage Inc. By using the Site, you agree to them.

• The Site is informational. Content is our assessment against a public rubric, provided "as is," without warranties. It is not legal, financial, or professional advice.
• Your contributions. If you submit information about your experience with a company, you confirm it is truthful and that you have the right to share it. You grant us a non-exclusive, royalty-free license to use the non-identifying information you submit in our published research.
• Acceptable use. Don't attempt to break, overload, or gain unauthorized access to the Site, and don't submit false data to skew results.
• Intellectual property. The Site, the rubric, the grades, and the compilation of data are owned by Bricolage Inc. Company names and marks belong to their owners.

Limitation of liability

THIS WEBSITE IS FOR GENERAL INFORMATION PURPOSES ONLY. INFORMATION IS BELIEVED TO BE ACCURATE, BUT IT IS PROVIDED AS-IS, WITH NO WARRANTIES ARE GIVEN AS TO ITS COMPLETENESS, APPLICABILITY, OR ACCURACY. USE OF THE WEBSITE IS AT THE USER’S OWN RISK. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL BRICOLAGE INC. BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR REVENUES, WHETHER INCURRED DIRECTLY OR INDIRECTLY, OR ANY LOSS OF DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES, RESULTING FROM (A) YOUR ACCESS TO OR USE OF OR INABILITY TO ACCESS OR USE OUR WEBSITE; (B) ANY CONDUCT OR CONTENT OF ANY THIRD PARTY ON THE WEBSITE; OR (C) UNAUTHORIZED ACCESS, USE, OR ALTERATION OF YOUR TRANSMISSIONS OR CONTENT.

IN NO EVENT SHALL THE AGGREGATE LIABILITY OF BRICOLAGE INC. FOR ALL CLAIMS RELATING TO THE WEBSITE EXCEED ONE HUNDRED U.S. DOLLARS ($100). THE LIMITATIONS OF THIS SUBSECTION SHALL APPLY TO ANY THEORY OF LIABILITY, WHETHER BASED ON WARRANTY, CONTRACT, STATUTE, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT BRICOLAGE INC. HAS BEEN INFORMED OF THE POSSIBILITY OF ANY SUCH DAMAGE.

Governing law and jurisdiction

These Terms and any dispute or claim arising out of or in connection with them, their subject matter, or any use of the website, shall be governed by, and construed in accordance with, the laws of the State of California, without giving effect to any choice or conflict of law provision or rule. Each party irrevocably agrees that the state and federal courts located in Los Angeles County, California shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with these Terms or their subject matter.

Contact: hello@datareportcard.com · Bricolage Inc., 2118 Wilshire Blvd. Suite 1098, Santa Monica, CA 90403.