1. Who We Are
AuditFront is operated by The Modular Company Poland Radosław Korbecki in Poland. AuditFront is a SaaS tool for running internal compliance readiness assessments. We act as the data controller for your personal data.
Contact: support@auditfront.com
Data Protection: privacy@auditfront.com
2. Data We Collect
2.1 Account Data
When you register (directly or via social login), we collect:
- Email address
- Full name (if provided by your identity provider)
- Authentication provider identifier used by the configured identity provider
2.2 Audit Data
Data you enter while using the Service - audit questions, answers, scores, evidence attachments, advisory notes, and reports. This data may contain information about third-party organisations you are assessing.
You are the data controller for any personal data contained in your audit content; we process it on your behalf.
2.3 Payment Data
If you subscribe to a paid plan, payment processing is handled entirely by Paddle, our merchant of record. We never see or store your credit card number, bank details, or billing address. Paddle shares with us only your email, subscription status, and transaction IDs so we can activate your plan.
2.4 Usage Data
Inside the app (app.auditfront.com):
- We collect server-side logs: timestamps, request paths, response times, and error codes.
- We collect aggregated performance metrics (e.g. average response time, disk usage) to keep the Service running smoothly.
- We log login events (email and IP address) for security monitoring.
- We record a controlled set of first-party conversion events, such as assessment start, progress milestones, account creation, report preview, checkout, and purchase.
- These events may include a guest or account identifier, original source and campaign, marketing landing path, framework, and allow-listed counts or percentages.
- Product telemetry never stores audit answers, evidence content, advisory notes, or filenames.
- We do not use Google Analytics, tracking pixels, fingerprinting, or third-party analytics inside the app.
On the marketing website (www.auditfront.com):
- Our website delivery layer counts successful public HTML requests by hour, page, referral hostname or known campaign source, country and broad request category. These aggregate counters contain no visitor IP addresses, cookies, browser identifiers or individual visit records, and do not link visits. Counts are retained for up to 180 days. Hosting-provider operational logs are separate.
- Our own servers receive an anonymous record of each page view and of assessment, template download and tagged call-to-action clicks: page path, destination, placement and referral source. These records carry no visitor identifier and store nothing on your device, so they cannot be linked to you or to each other. Marketing events do not store IP addresses or browser user-agent strings. Public page and placement attribution accompanies assessment links.
- If you choose "Allow cookies", we also use Google Analytics 4 to understand how visitors find and use the site, with Google signals and advertising features turned off. It runs only on www.auditfront.com and is not loaded on app.auditfront.com or auth.auditfront.com; its cookies are scoped to www.auditfront.com.
- With the same consent, a random session-storage identifier (expires after 30 minutes) links your website events and is passed to the app to connect a marketing click with app activity. Measurement events are retained for up to 180 days by default.
- No session recordings or fingerprinting are used. Do Not Track or Global Privacy Control switches off all website measurement.
- You can reject cookies in the first-visit banner or reopen "Cookie settings" in the site footer.
We do not use advertising cookies, retargeting, or social media tracking anywhere.
3. Legal Basis for Processing (GDPR Art. 6)
- Contract performance (Art. 6(1)(b)) - processing necessary to provide the Service you signed up for.
- Consent (Art. 6(1)(a)) - Google Analytics cookies and the session link between the marketing website and the app, only after you choose "Allow cookies". You can withdraw consent at any time through "Cookie settings".
- Legitimate interest (Art. 6(1)(f)) - security monitoring, fraud prevention, and product improvement based on aggregated usage patterns.
- Legal obligation (Art. 6(1)(c)) - where we are required to retain data by applicable law.
4. How We Use Your Data
- Provide and maintain the Service
- Authenticate you via your identity provider
- Process payments and manage subscriptions (via Paddle)
- Monitor service health and investigate security incidents
- Respond to support requests
5. Data Sharing & Sub-processors
We share personal data only with the sub-processors listed on our Sub-processor List. We do not sell personal data. All sub-processors are bound by data processing agreements.
6. Data Retention
- Account data: retained while your account is active, then deleted within 30 days after account deletion.
- Audit data: retained while your account is active. You can delete individual audits at any time.
- Server logs and metrics: retained for up to 30 days, then automatically purged.
- First-party product events: retained for up to 180 days, then automatically purged.
- Payment records: retained as required by tax and accounting regulations (typically 7 years). Managed by Paddle.
7. Your Rights (GDPR Art. 15-22)
You have the right to:
- Access - request a copy of the personal data we hold about you.
- Rectification - ask us to correct inaccurate data.
- Erasure - ask us to delete your personal data ("right to be forgotten").
- Data portability - receive your data in a structured, machine-readable format.
- Restriction / Objection - restrict or object to certain processing activities.
- Complaint - lodge a complaint with your local data protection authority.
To exercise any of these rights, contact us at privacy@auditfront.com. We will respond within 30 days.
8. Data Security
Data is encrypted in transit using TLS. Infrastructure is hosted on dedicated EU infrastructure in Germany. Access to production systems is restricted to authorised personnel using key-based authentication.
9. International Transfers
Your data is processed and stored within the European Union. Where a sub-processor is based outside the EU (e.g. Google LLC for OAuth and, with your consent, website analytics; Paddle for payments; Resend Inc. for transactional email), transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission. See our Sub-processor List for details.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you at least 14 days in advance by email or through the Service. Continued use of the Service after the changes take effect constitutes acceptance of the revised policy.