Privacy Policy

1. What We Collect

When you use AuditShield, we collect:

• Domain names you submit for scanning
• Email addresses when you provide them to receive scan results
• Scan results — the compliance data generated by our automated analysis of your submitted domain
• Payment information is handled entirely by Stripe and is never stored on our servers
• Usage data — standard server logs including IP address, browser type, and timestamps

2. How We Use Your Data

• To perform the compliance scan you requested
• To deliver scan results and reports to you
• To send you the email notification if you provided an email address
• To maintain your account and subscription (if you subscribe)
• To improve the Service — we may analyse aggregated, anonymised scan data to improve detection accuracy

We do not sell your data. We do not use your scan results for any purpose other than providing the Service to you.

3. Legal Basis for Processing

Under UK GDPR, our legal bases for processing your personal data are:

• Performance of a contract — processing necessary to provide the scanning service you requested
• Legitimate interests — improving the Service, protecting against misuse, and standard business operations
• Consent — where you have explicitly opted in (e.g., marketing emails)

4. Data Storage and Retention

Scan results are stored in Supabase (EU-hosted infrastructure). We retain your scan data for the duration of your subscription plus 30 days after cancellation. Free scan results are retained for 90 days. You may request deletion of your data at any time by emailing privacy@auditshield.site.

5. Third-Party Services

We use the following third-party services to operate AuditShield:

• Stripe — payment processing. Stripe's privacy policy applies to payment data.
• Supabase — database hosting. Data is stored in the EU.
• Vercel — application hosting. Server logs are retained per Vercel's privacy policy.
• Resend — transactional email delivery for scan results.

We have data processing agreements in place with all third-party processors.

6. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to processing based on legitimate interests
• Request a copy of your data in a portable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email privacy@auditshield.site. We will respond within 30 days.

7. Cookies

Our website uses only essential cookies necessary for the Service to function — session management, CSRF protection, and load balancing. We do not use analytics cookies, marketing cookies, or tracking pixels on our own site. We do not load any third-party tracking scripts.

8. International Transfers

Your data is stored and processed within the European Economic Area and the United Kingdom. We do not transfer personal data outside the EU/EEA/UK without adequate safeguards in place.

9. Data Protection Contact

For privacy-related inquiries or to exercise your data rights:

• Email: privacy@auditshield.site
• Data controller: Pure Light Ltd (Company No. 17433578), 66 Paul Street, London, EC2A 4NA, United Kingdom

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes to This Policy

We will notify subscribers of material changes to this policy via email. The latest version will always be available at auditshield.site/privacy.