1. Governing Law & Jurisdiction
This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 (DPDP Act). Where we process data of individuals located in the United Arab Emirates, we also comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL). For individuals in the European Economic Area or United Kingdom, we additionally adhere to the GDPR and UK GDPR respectively.
2. Information We Collect
1. Personal Data:
Name, email address, professional title, and organisation name, provided during registration or demo requests.
2. Financial Data (Uploaded Content):
Ledgers, spreadsheets, trial balances, and financial records uploaded for AI-driven analysis by our tool, Athena. This data is treated as strictly confidential.
3. Usage Data:
IP addresses, browser type, device identifiers, pages visited, and interaction patterns with our platform.
3. How We Use Your Information
We process your personal data only for specific, lawful purposes:
4.
Providing AI-driven audit insights and anomaly detection — Legal basis: Performance of contract.
5.
Maintaining and improving platform performance — Legal basis: Legitimate interests.
6.
Sending service-related communications and security alerts — Legal basis: Performance of contract / legitimate interests.
7.
Complying with legal obligations — Legal basis: Legal obligation.
8.
Analytics and website performance measurement (with consent) — Legal basis: Consent.
Important:
We do not sell your personal or financial data to third parties for any purpose.
4. AI Data Privacy & No-Training Guarantee
Unlike consumer AI tools, AuditSense does not use your uploaded financial data to train any public AI or LLM models. Your uploaded data is processed in a session-isolated environment. AI processing is conducted exclusively via enterprise API connections to third-party AI providers under contractual terms that prohibit use of customer data for model training.
For full details, please refer to our Data Security & AI Privacy Statement.
5. Data Storage & Security
9. In-Transit:
All data transmitted between your browser and our servers is protected using TLS encryption via our reverse proxy layer.
10. Application-Level Encryption:
Sensitive credentials such as API keys are encrypted at the application level using AES-256-GCM prior to storage.
11. Infrastructure:
Our services are deployed on cloud-hosted infrastructure. We are working toward formal certification of our hosting environment (SOC 2 Type II, ISO 27001) and will update this policy when those certifications are in place.
12. Data Residency:
We are in the process of confirming and documenting data residency for all infrastructure components. This policy will be updated to reflect confirmed hosting regions upon completion.
6. Data Retention
We are committed to the following retention periods, which are applied manually at this stage of our platform development. Automated lifecycle enforcement is on our engineering roadmap:
13. Account & Personal Data:
Retained for the duration of your subscription plus 3 years, or as required by applicable law.
14. Uploaded Financial Records:
Retained for the duration of your active subscription. Upon account termination, financial data is deleted or anonymised within 30 days, unless you request earlier deletion or applicable law requires longer retention.
15. Usage & Audit Logs:
Retained for 12 months from creation. Automated purge policies are planned for a future release.
7. Third-Party Service Providers & Sub-Processors
We share data with the following categories of trusted third-party sub-processors, who are bound by data processing agreements:
16. Cloud Infrastructure:
Our platform is hosted on cloud infrastructure. Specific provider and region details will be published here once formally confirmed.
17. AI Processing:
Enterprise API providers including OpenAI, Anthropic, Google, and DeepSeek. These providers are used under API terms that prohibit training on customer data.
18. Analytics:
Google LLC — for website analytics via Google Analytics. Analytics cookies are opt-in only; see our Cookies Policy.
19. Email & Communications:
Transactional email service providers for service and security notifications.
8. International Data Transfers
Where your data is transferred outside India or the UAE (for example via AI API processing or analytics services), we ensure such transfers are subject to appropriate contractual safeguards including Standard Contractual Clauses (SCCs) or equivalent protections required by applicable law.
9. Data Breach Notification
In the event of a personal data breach, we will notify the relevant supervisory authority within the timeframe required by applicable law (72 hours under GDPR; as required under India DPDP Act rules and UAE PDPL), and will notify affected individuals without undue delay where there is a high risk to their rights.
10. Your Rights
Depending on your location and applicable law, you may have the right to access, correct, erase, or port your personal data, to object to or restrict processing, and to withdraw consent at any time. To exercise these rights, contact:
20. Email:
privacy@auditsense.ai
21. Website:
https://www.auditsense.ai/privacy
11. Updates to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify registered users by email prior to the change taking effect. The version number and effective date at the top of this document will be updated accordingly.
