OneReport Privacy Policy

Effective: April 15, 2026 | Last Updated: April 15, 2026

OneReport is the online reporting tool your local law enforcement agency uses to take non-emergency reports. When you file a report through OneReport, your report is delivered to that agency and stored on its behalf. OneReport is operated by CaseX, Inc., doing business as Corveris ("Corveris," "we," "us," or "our").

This Privacy Policy explains what information we process, why we process it, who receives it, and the choices and rights available to you. We have written it to be plain and specific. If any section is unclear, please contact us at privacy@corveris.com.

If you are reporting an emergency or a crime in progress, stop and call 911. OneReport is for non-emergency reports only.

At a Glance

The following summary is provided for convenience and does not replace the full terms of this Policy.


Who gets your report	The law enforcement agency you are filing with. Your report is delivered directly to that agency and stored for its official use.
Where it is stored	In the United States, in Amazon Web Services GovCloud - the cloud environment designed for U.S. government and criminal-justice workloads.
Who can access your report	Only authorized personnel of the receiving agency. Corveris personnel do not have access to report contents unless the agency explicitly grants access (for example, to assist with a support request).
How it is protected	Encrypted in transit (TLS) and at rest (AES-256), hosted in AWS GovCloud, with detailed access logging.
Do we sell your data	No. We do not sell your personal information, and we do not share it with advertisers.
Do we train AI on your report	No. We do not use the contents of your report to train machine-learning models. AI features that assist you while filing operate within your session.
How long it is kept	In accordance with your agency's records-retention schedule, and as required by applicable law. Corveris does not independently determine how long reports are retained.
Your rights	You may request access to, and correction of, your personal information, and you may delete the account you created at the time of reporting. Reports themselves cannot be deleted once submitted - they are preserved as official records of the receiving agency.

1. Who We Are and How This Policy Is Organized

OneReport is operated by CaseX, Inc., a Delaware corporation doing business as Corveris, with its principal place of business at 2261 Market Street STE 10176, San Francisco, CA 94114. In this Policy, "OneReport" refers to the reporting platform (including our websites at corveris.com and any agency-branded instance of the platform), and "Corveris" refers to the company that operates it.

Because OneReport is used in two very different ways, this Policy is organized in two parts, followed by provisions that apply to both:

Part A - For People Filing Reports. If you are a member of the public using OneReport to submit a report to a law enforcement agency, this is the part that applies to you.
Part B - For Agency and Business Users. If you are an employee of a law enforcement agency, a Corveris customer, or otherwise have an account to administer or use OneReport, this part applies to you.
Part C - Provisions That Apply to Everyone. Security, legal disclosures, state-specific rights, and how to contact us.

Controller and processor roles. When a member of the public submits a report, Corveris acts as a processor or service provider on behalf of the law enforcement agency, which is the controller of the report and its contents. For agency and business accounts (registration, login, product usage), Corveris acts as a controller.

Part A. For People Filing Reports

A.1. Information We Collect When You File a Report

You will only be asked for information that is relevant to the type of report you are filing. The specific fields depend on the agency, the report type, and any follow-up questions the agency has configured. Categories that may be collected include:

Contact and identity information: name, date of birth, address, phone number, email address, and, where the report type requires it, a government-issued identification number (such as a driver's license or state ID). The phone number or email address you provide to begin reporting may also be used by Corveris, on behalf of the receiving agency, to send you messages about case status and other updates related to your report.
Incident information: your description of what occurred, including responses to guided questions and free-text narratives, along with any photos, documents, or other files you choose to attach.
Property information: descriptions, serial numbers, or other identifying information about property involved in the incident.
Vehicle information: VIN, make, model, year, color, license plate, and registration details, where relevant to the report.
Insurance information: insurer, policy number, and coverage details, where relevant to the report.
Information about other people: names and descriptions of witnesses, suspects, or other parties you include in your narrative. If you submit information about other people, you represent that you have a lawful basis to do so.
Session and technical information: IP address, device type, browser, approximate location derived from IP, and timestamps, collected automatically to operate and secure the service.

Sensitive information. Some report types may require sensitive identifiers (for example, a government ID number or, in limited cases, a photograph or fingerprint where the agency's process requires it). We collect sensitive information only where the agency has determined it is necessary for the report type, and we protect it as described in Section C.1 (Security).

Children under 16. If you are under 16, please do not submit a report without a parent or guardian. If an agency's report type is intended to collect information about a minor (for example, a report filed on behalf of a child), the parent or guardian should complete the form.

A.2. Why We Collect It

We collect the information above for a narrow set of purposes:

To prepare and deliver your report to the law enforcement agency you are filing with.
To allow the agency (or its designee) to contact you about your report, request additional information, or provide a case number or status update. Corveris may send these communications on the agency's behalf using the phone number or email address you provided to begin reporting.
To operate, secure, and troubleshoot the platform, including detecting and preventing fraud, abuse, and attempts to submit false reports.
To comply with legal obligations, including responding to valid legal process.

We do not use the contents of your report for advertising, marketing, or commercial profiling, and we do not sell it.

A.3. Who Sees Your Report

Your report is shared with:

The law enforcement agency you are filing with, which is the recipient and controller of your report. The agency determines who within the agency has access and how long to retain the report.
Service providers that support the platform, including our cloud hosting provider (Amazon Web Services, Inc., in AWS GovCloud). These providers store and transmit information on our behalf and are contractually limited from using it for their own purposes.

Corveris personnel do not have routine access to the contents of your report. Our staff receive access to reports only when the receiving agency explicitly grants access - for example, to investigate a support issue, fix a platform defect, or respond to the agency's written request. Access, when granted, is limited to the personnel, scope, and duration specified by the agency, and every access event is logged and available to the agency on request.

Third parties, where legally required, such as in response to a valid subpoena, court order, or similar legal process directed to Corveris. Where lawful, we will notify the affected agency before disclosure.

We do not disclose your report to advertisers, data brokers, or other third parties for their own marketing purposes.

A.4. How Long We Keep It

Reports cannot be deleted once submitted. When you submit your report, its contents are transferred to the receiving agency and preserved as an official record in that agency's records management system. From that moment forward, the report is an agency record and may not be withdrawn, deleted, or edited - by you, by Corveris, or by the agency outside its own lawful records-management processes. Reports are retained in accordance with the agency's retention schedule and applicable public-records and criminal-justice laws, which Corveris does not control.

The account you created at the time of reporting - which holds your contact details and the list of reports you have submitted through OneReport - is separate from the agency's record of the report itself. You may request deletion of that account at any time, as described in Section A.6. Deleting your account does not delete, withdraw, or modify any report you have already submitted.

A.5. How We Use AI

OneReport uses artificial intelligence to make reporting easier and more accurate. Our commitments regarding AI are:

AI assists you during your session. AI features may help structure your narrative, ask clarifying questions, and check for completeness before submission.
We do not train models on the contents of your report. Report contents, attachments, and personally identifying information you submit are not used to train or fine-tune machine-learning models, whether by Corveris or by our service providers.
A human agency official reviews your report. AI does not make enforcement decisions. Law-enforcement actions taken on the basis of your report are made by the receiving agency.

A.6. Your Rights

Subject to applicable law, you have the right to:

Confirm whether we process personal information about you and request a copy.
Correct inaccurate personal information held in your OneReport account.
Delete the account you created at the time of reporting. You may ask us to delete your OneReport account and its associated contact information at any time. Reports you have already submitted are not affected by account deletion - see below.
Opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions producing legal or similarly significant effects - none of which we engage in with report data.
Designate an authorized agent to exercise these rights on your behalf.

Reports cannot be deleted or withdrawn once submitted. A submitted report is an official record of the receiving agency and is preserved in that agency's records management system. Corveris does not have the ability to delete, withdraw, or alter a submitted report, and agencies are likewise bound by public-records and criminal-justice laws that restrict the destruction of such records. If you believe a report contains a factual error, contact the receiving agency directly; the agency - not Corveris - determines how corrections are handled under its records policies.

To exercise a right, email privacy@corveris.com. We will verify your identity before responding. Where a right cannot be honored because the information is part of an official law-enforcement record, we will tell you, identify the responsible agency, and - where applicable under state law - explain how to appeal.

Part B. For Agency and Business Users

This Part applies if you have a OneReport account as an employee of a law enforcement agency, as a Corveris customer, or otherwise in an administrative or professional capacity.

B.1. Account Information

When you create or are assigned a OneReport account, we process your name, employer or agency, work email address, office and mobile telephone numbers, role, and authentication credentials. We use this information to provision your account, authenticate you, and support your use of the platform.

B.2. Usage and Diagnostic Information

We automatically collect information about how agency and business users interact with the platform, including actions taken within the application, pages viewed, features used, IP address, device and browser characteristics, and timestamps. We use this information to operate and secure the service, to diagnose and fix issues, and to improve the platform.

B.3. Communications and Marketing

We may contact you at your business contact information to deliver transactional notices (such as service status, security alerts, and changes to this Policy), to provide customer support, and - where permitted - to share information about features, webinars, or training. You may opt out of marketing communications at any time by following the unsubscribe instructions in the message or by emailing privacy@corveris.com. Transactional and service-related messages cannot be opted out of while you have an active account.

B.4. Product Improvement and AI

We may use aggregated and de-identified usage data - data that does not identify you, any member of the public, or the contents of any report - to monitor performance, improve the platform, and develop new features, including AI features. We do not use the contents of reports to train machine-learning models. Any AI training we conduct uses synthetic data, aggregated or de-identified telemetry, or data we are separately licensed to use.

Part C. Provisions That Apply to Everyone

C.1. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include:

Hosting in Amazon Web Services GovCloud (U.S.), the cloud environment designed for U.S. government and criminal-justice workloads.
Encryption of personal information in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
Role-based access controls and multi-factor authentication, with access to report contents disabled for Corveris personnel by default and enabled only on explicit agency authorization.
Logging and monitoring of all access to systems and records, with access logs available to the receiving agency on request, and regular security assessments.
Background-checked personnel for any roles eligible to receive agency-granted access, and contractual confidentiality obligations with all personnel and service providers.

No system is perfectly secure. If we learn of a security incident affecting your information, we will notify the affected agency and, where required by law, affected individuals, in accordance with applicable breach-notification laws.

C.2. Service Providers and Subprocessors

We engage a limited set of service providers to support the operation of OneReport. These providers are contractually bound to process personal information only to provide services to Corveris and are not permitted to use it for their own purposes. A current list of subprocessors is provided below and is updated as subprocessors change.

Provider	Service Provided	Location
Amazon Web Services, Inc.	Cloud hosting (AWS GovCloud)	United States

C.3. Legal Disclosures

We may disclose personal information where we reasonably believe doing so is required to: (i) comply with applicable law or valid legal process, including subpoenas and court orders; (ii) enforce our Terms of Use; (iii) protect the rights, property, or safety of Corveris, our users, or others; or (iv) respond to an emergency involving a risk of death or serious physical injury. Where a legal request is directed to Corveris and relates to an agency's reports, we will, where lawful and practicable, notify the affected agency before producing records.

C.4. Storage and International Users

OneReport stores information in the United States. If you access OneReport from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States. Corveris does not market OneReport to consumers outside the United States.

C.5. Children

OneReport is not directed to children under 16, and we do not knowingly collect personal information from children under 16 other than in the context of a report filed by a parent or guardian about or on behalf of a minor. If you believe a child has provided personal information to us other than through such a report, please contact privacy@corveris.com and we will take appropriate steps.

C.6. Legal Bases for Processing

Where required by applicable law, our legal bases for processing personal information include: (i) the necessity of processing to perform a contract (including with agency customers); (ii) our and our customers' legitimate interests in operating and securing the platform and delivering reports to law-enforcement agencies; (iii) compliance with a legal obligation; and (iv) consent, where we ask for it.

C.7. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice that is appropriate under the circumstances - for example, by posting a prominent notice on our websites, by notifying agency administrators, or, where required by law, by direct notice to affected individuals. The "Last Updated" date at the top of this Policy indicates when it was most recently revised. Historical versions are available on request.

C.8. Business Transfers

If Corveris is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred to the successor entity as part of that transaction. Any successor will remain bound by the commitments in this Policy with respect to information received in that transfer, unless and until you receive notice of, and (where required by law) consent to, changes.

Part D. U.S. State Privacy Rights

This Part provides additional disclosures required by the privacy laws of certain U.S. states. It supplements, and does not limit, the rights described above.

D.1. California (CCPA/CPRA)

If you are a California resident, you have the rights described under "Your Privacy Rights" in Part A, as well as the following:

Right to know. You may request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties to which we disclose it - all of which are described in this Policy.
Right to correct and delete. You may correct inaccurate account information and delete the OneReport account you created at the time of reporting. Reports cannot be deleted once submitted: they are official records of the receiving agency, exempt from deletion under applicable law-enforcement and public-records laws.
Right to limit use of sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit under the CCPA.
Right to opt out of sale or sharing for cross-context behavioral advertising. We do not sell personal information and we do not share it for cross-context behavioral advertising.
Right to non-discrimination for exercising any of these rights.

"Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

D.2. Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia

If you are a resident of Colorado, Connecticut, Montana, Oregon, Texas, Utah, or Virginia, you have the rights described in Part A, including the rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not engage in any of those activities with report data. To appeal a decision we make about your request, follow the instructions in our written response to your request.

D.3. Nevada

We do not sell personal information as defined by Nevada law. Nevada residents may nonetheless submit a request to opt out of any potential future sale at privacy@corveris.com.

Contact Us

If you have questions about this Policy, or wish to exercise any privacy right described above, please contact:

CaseX, Inc. (d/b/a Corveris) - Attn: Privacy

2261 Market Street STE 10176, San Francisco, CA 94114

privacy@corveris.com