Privacy Policy

This policy explains how [COMPANY LEGAL NAME] handles personal data in Audit Assistant. [COMPANY LEGAL NAME] (company number [COMPANY NUMBER]), [REGISTERED ADDRESS]. ICO registration number: [ICO REGISTRATION NUMBER].

Questions or requests: privacy@auditassist.app.

1. Two roles

• We are the controller for account and billing data: who uses the service, how to contact them, and what they have bought.
• We are a processor for the audit data your organisation puts into the service. Your organisation is the controller of that data and decides what goes in. Section 9 sets out our commitments as your processor.

2. What we collect as controller

Card details are entered on Stripe's payment page and never reach us.

3. Audit data we process for your organisation

This is whatever your users upload or create: documents, evidence, interview transcripts, datasets, test results, observations and reports. It can include personal data about your staff or your own clients. We use it only to provide the service to your organisation.

4. AI processing

AI models from Anthropic (and, only if Anthropic is unavailable, OpenAI or Google) read the text needed for each AI action. Search uses embeddings from OpenAI. Before any text leaves for an AI provider, we replace these with placeholders:

• payment card numbers
• bank account numbers, including IBANs and UK sort code and account number
• national ID numbers, such as UK National Insurance numbers
• personal email addresses
• phone numbers

The original values are not sent and are not restored. Names and work email addresses are not masked, because who raised or approved something is often the audit point. Under their commercial terms, these providers do not use API data to train their models. Analytics never sends a dataset to an AI provider; only column headings and a few masked sample values are sent, to suggest how columns map to a test.

5. Who we share data with

Only the providers that run the service, listed with what each receives on the Sub-processors page. We do not sell personal data or use it for advertising.

6. International transfers

Our database is hosted in the EU. Some providers, including the AI providers, process data in the United States. Where data leaves the UK, it is protected by the UK International Data Transfer Agreement or Addendum, or by the provider's certification under the UK Extension to the EU-US Data Privacy Framework. [DECISION: confirm the transfer mechanism for each provider.]

7. How long we keep data

• Account data: while your organisation's account is open, then for 30 days after it closes, unless we must keep it longer.
• Purchase records: 6 years, for UK tax and accounting rules.
• Audit data: when your organisation deletes something, it disappears from the service straight away. The stored file and its search index are erased on request to {L.privacyEmail}, and in any case within 30 days after the account closes. [DECISION: automatic erasure within N days of deletion, once built.]
• Backups: deleted data leaves backups as they expire. [DECISION: confirm the backup retention period.]

8. Your rights

You can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, or to withdraw consent where we rely on it. Email privacy@auditassist.app. We reply within one month.

If your data is in the service because an organisation uploaded it as audit data, we will pass your request to that organisation, which is the controller.

You can complain to the Information Commissioner's Office (ico.org.uk), though we would like the chance to help first.

9. Data processing terms (for customers)

When we process personal data for your organisation, we:

• process it only on your documented instructions, which are these terms and your use of the service;
• ensure that people with access are bound by confidentiality;
• keep it secure, with:
  • encryption in transit
  • organisation-level separation enforced on every request
  • administrator and auditor roles
  • masking of the identifiers listed in section 4 before AI processing
• use only the sub-processors listed on the Sub-processors page, under written terms at least as protective. We will give you 30 days' notice of a new one, and you may object;
• help you respond to data subject requests and meet your security, breach notification and impact assessment duties;
• tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data;
• delete or return your data when the agreement ends (Terms, section 12);
• make available the information needed to show we meet these duties, and allow for reasonable audits.

If you need a signed DPA, email privacy@auditassist.app.

10. Browser storage and cookies

We use no advertising or analytics cookies. The app keeps your sign-in session and a few display preferences in your browser's storage, such as where you last left the assistant button. These are strictly necessary, or only remember your own choices.

11. Changes

We will post changes here and tell customers about material changes by email.