1. Who We Are
AuditFront is operated by The Modular Company Poland Radosław Korbecki in Poland. AuditFront is a SaaS tool for running internal compliance readiness assessments. We act as the data controller for your personal data.
Contact: support@auditfront.com
Data Protection: privacy@auditfront.com
2. Data We Collect
2.1 Account Data
When you register (directly or via social login), we collect:
- Email address
- Full name (if provided by your identity provider)
- Authentication provider identifier used by the configured identity provider
2.2 Audit Data
Data you enter while using the Service - audit questions, answers, scores, evidence attachments, advisory notes, and reports. This data may contain information about third-party organisations you are assessing.
You are the data controller for any personal data contained in your audit content; we process it on your behalf.
2.3 Payment Data
If you subscribe to a paid plan, payment processing is handled entirely by Paddle, our merchant of record. We never see or store your credit card number, bank details, or billing address. Paddle shares with us only your email, subscription status, and transaction IDs so we can activate your plan.
2.4 Usage Data
Inside the app (app.auditfront.com):
- We collect server-side logs: timestamps, request paths, response times, and error codes.
- We collect aggregated performance metrics (e.g. average response time, disk usage) to keep the Service running smoothly.
- We log login events (email and IP address) for security monitoring.
- We record a controlled set of first-party conversion events, such as assessment start, progress milestones, account creation, report preview, checkout, and purchase.
- These events may include a guest or account identifier, original source and campaign, marketing landing path, framework, and allow-listed counts or percentages.
- Product telemetry never stores audit answers, evidence content, advisory notes, or filenames.
- We do not use Google Analytics, tracking pixels, fingerprinting, or third-party analytics inside the app.
On the marketing website (www.auditfront.com):
- We use Google Analytics 4 (GA4) with IP anonymisation to understand how visitors find and browse the site.
- GA4 runs only on www.auditfront.com and only after you allow analytics. It is not loaded on app.auditfront.com or auth.auditfront.com.
- First-touch source, campaign, and landing path are held in session storage and carried to the app only when you choose to open an assessment.
- You can reject analytics in the first-visit banner or reopen "Cookie settings" in the site footer.
We do not use advertising cookies, retargeting, or social media tracking anywhere.
3. Legal Basis for Processing (GDPR Art. 6)
- Contract performance (Art. 6(1)(b)) - processing necessary to provide the Service you signed up for.
- Legitimate interest (Art. 6(1)(f)) - security monitoring, fraud prevention, and product improvement based on aggregated usage patterns.
- Legal obligation (Art. 6(1)(c)) - where we are required to retain data by applicable law.
4. How We Use Your Data
- Provide and maintain the Service
- Authenticate you via your identity provider
- Process payments and manage subscriptions (via Paddle)
- Monitor service health and investigate security incidents
- Respond to support requests
5. Data Sharing & Sub-processors
We share personal data only with the sub-processors listed on our Sub-processor List. We do not sell personal data. All sub-processors are bound by data processing agreements.
6. Data Retention
- Account data: retained while your account is active, then deleted within 30 days after account deletion.
- Audit data: retained while your account is active. You can delete individual audits at any time.
- Server logs and metrics: retained for up to 30 days, then automatically purged.
- First-party product events: retained for up to 180 days, then automatically purged.
- Payment records: retained as required by tax and accounting regulations (typically 7 years). Managed by Paddle.
7. Your Rights (GDPR Art. 15-22)
You have the right to:
- Access - request a copy of the personal data we hold about you.
- Rectification - ask us to correct inaccurate data.
- Erasure - ask us to delete your personal data ("right to be forgotten").
- Data portability - receive your data in a structured, machine-readable format.
- Restriction / Objection - restrict or object to certain processing activities.
- Complaint - lodge a complaint with your local data protection authority.
To exercise any of these rights, contact us at privacy@auditfront.com. We will respond within 30 days.
8. Data Security
Data is encrypted in transit using TLS. Infrastructure is hosted on dedicated EU infrastructure in Germany. Access to production systems is restricted to authorised personnel using key-based authentication.
9. International Transfers
Your data is processed and stored within the European Union. Where a sub-processor is based outside the EU (e.g. Google LLC for OAuth, Paddle for payments, Resend Inc. for transactional email), transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission. See our Sub-processor List for details.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you at least 14 days in advance by email or through the Service. Continued use of the Service after the changes take effect constitutes acceptance of the revised policy.