Privacy Policy
Plain answers on what personal data we handle, why, where it is stored and what you can ask us to do with it.
01 Who this policy covers
This policy explains how we handle personal data when you visit our website, request a free readiness check, contact us, or use the compliance automation platform as a customer, employee of a customer, auditor or vendor responding to a questionnaire.
For data inside a customer workspace, the customer is the Data Fiduciary (or controller) and we act as a Data Processor on their instructions under our data processing agreement.
02 Data we collect
- Account and contact data: name, work email, company, designation, employee band, frameworks of interest and target audit dates you give us.
- Integration metadata: configuration settings, policy states, account lists and logs read from connected tools to test controls, such as whether MFA is enforced or whether backups succeeded.
- Workspace content: policies, risks, vendor records, evidence files and comments that you or your team upload.
- Usage and security logs: sign-in events, IP addresses, browser type and actions taken in the platform, kept to secure the service and support audits of our own.
03 What we do not collect
Integrations are read-only and scoped to what each control needs. We do not query production databases, read customer records held in your systems, or read the content of email or documents unless you upload them as evidence.
04 How we use data
- To create and secure your workspace and send login credentials.
- To run evidence checks, calculate readiness and notify control owners.
- To respond to enquiries and provide support.
- To meet legal, tax and accounting obligations.
- To improve the reliability and security of the service using aggregated, de-identified usage data.
We do not sell personal data. We do not use customer workspace data to train shared or third-party AI models.
05 AI processing
AI features classify collected evidence as matching or missing against a control and draft policy text. Outputs are suggestions. A person in your organisation reviews and approves evidence before it is shared with an auditor.
06 Storage, residency and security
Customer data is stored in India by default. Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Access by our staff is limited to named roles, requires MFA and is logged.
If a customer chooses a different hosting region, data for that workspace is stored in the chosen region.
08 Retention
Workspace data is kept for the life of the subscription and deleted within 30 days of termination, unless you export it earlier or law requires longer retention. Enquiry data from the website is kept for up to 24 months. Security logs are kept for up to 12 months.
09 Your rights
Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may request access to, correction, completion or erasure of your personal data, withdraw consent where processing relies on consent, and nominate another person to exercise your rights. If your data sits in a customer workspace, we will pass your request to that customer.
To exercise these rights or raise a grievance, use the Contact us page and choose "Something else". We respond within the time limits set by law.
11 Personal data breaches
If a breach affects personal data we process, we will notify affected customers without undue delay so they can meet their own obligations, and notify regulators and individuals where the law requires us to.
12 Changes
We may update this policy as the service or the law changes. Material changes will be notified to customers by email or in the platform before they take effect.