Privacy Policy

1. Who is responsible

The data fiduciary (controller) is Hikmah Technologies, Navi Mumbai, India, for every customer and visitor.

Inside your workspace it is different. The audit data your organisation stores there, including the names and work details of its staff, belongs to your organisation, which decides what goes in. For that data we act only on your organisation's instructions, as its processor.

2. What we collect

• The trial form: your name, work email, company, country, and, if you give them, your phone number and what your team audits. Also the page you came from, any campaign tags in the link, your IP address and the country it belongs to, and your browser's user agent.
• Your workspace: the name and email of each user, sign-in records and an audit trail of changes. The content your organisation adds is its data (section 1).
• Payment: the provider (Razorpay or PayPal) collects your card or bank details; we never see or store them. We keep the invoices, the amounts, your billing address and your GSTIN if you give one.
• Email: the messages you send us and our replies.
• This website: for visitors outside the EU, the EEA, the UK and Switzerland, Google Analytics records pages visited, the buttons clicked (such as "Start free trial" or "Book a call"), and your approximate location and device. It uses cookies. For visitors in those regions, or when we cannot tell the country, it does not load at all. A small cookie of ours holds only whether it may load.

3. Why we use it

• To set up and run your workspace, and to send you its links and service emails (the contract with you).
• To send the trial reminders and the payment link (the contract, and our legitimate interest in turning a trial into a customer).
• To bill you and keep accounting and tax records (a legal obligation).
• To keep the service secure and find faults, from sign-in records and logs (legitimate interest).
• To understand which pages help visitors, through Google Analytics, only for visitors outside the EU, the EEA, the UK and Switzerland (legitimate interest; you can block it in your browser).

4. Who else processes it

We use these providers to run the service. Each sees only what its job needs:

• Cloudflare: the network in front of the website and the workspaces.
• Amazon Web Services: stores workspace files and the encrypted backups, in Mumbai, India.
• Resend: sends email.
• Razorpay (India) and PayPal (elsewhere): take payments and issue invoices.
• Google Analytics: website statistics, for visitors outside the EU, the EEA, the UK and Switzerland only.
• An AI provider, only if your organisation turns AI drafting on with its own key.

5. Where it is kept

Your workspace stays in India: its application and database run on Hikmah Technologies' own infrastructure, and its files and backups are with Amazon Web Services in Mumbai. Trial requests are kept in our own database in India.

Some providers may handle some data outside India, including in the EU and the United States: Cloudflare (the network), Resend (email), PayPal, Razorpay and Google Analytics. Where the GDPR applies, we rely on the European Commission's standard contractual clauses, or an equivalent safeguard, for any transfer outside the EU or UK.

6. How long we keep it

• A trial request that does not become a customer: 12 months, then deleted.
• A workspace: while you have a plan; after it ends, the steps in section 5 of the Terms apply (deletion on day 60, including uploaded documents; a final backup of the database, without the documents, is kept 90 days, then deleted).
• Hourly backups: 30 days.
• Invoices and payment records: as long as tax law requires, which is eight years in India.
• Website analytics (Google Analytics): 14 months.

7. How we protect it

Each customer has a separate database, a separate file storage area and separate keys. Connections are encrypted, backups are encrypted at rest, and sensitive actions in the workspace ask for a second factor. Only Hikmah Technologies' staff who run the service can reach the infrastructure.

If a breach affects your personal data, we tell you, and the authorities where the law requires, without undue delay and in any case within 48 hours of becoming aware of it.

8. Your rights

Under the DPDP Act you may ask for a summary of the personal data we hold about you and how we use it, have it corrected, completed or erased, withdraw consent where we rely on it, and nominate someone to exercise these rights if you cannot. Under the GDPR you may also restrict or object to our use of it, and receive it in a portable form.

For data in an organisation's workspace, ask that organisation first; we help it answer.

To exercise a right, email info@auditeasepro.com. We answer within 30 days.

9. Grievances and complaints

Grievance Officer (DPDP Act): Arshad Ansari, info@auditeasepro.com. Please put "Grievance" in the subject. We answer within 30 days. If you are not satisfied with the answer, you may complain to the Data Protection Board of India. Under the GDPR you may complain to the data protection authority where you live or work.

10. Children

AuditEase Pro is for organisations. We do not knowingly collect data from anyone under 18.

11. Changes

We update this policy when what we do changes. The version date is at the top of this page, and we email workspace admins about any change that matters.