Cookie Preferences

We use cookies to ensure the best experience on our website. Functional cookies are essential, while others help us improve our service. You can manage your preferences below. For more info, read our Cookie Policy.

    Privacy Policy

    Last updated: 27 September 2026

    1. Who We Are

    AuditVault is operated by Auditvault Limited, a company registered in England and Wales with company number 16924533, of 4-6 Greatorex Street, London, E1 5NF ("AuditVault", "we", "us"). This policy explains how we collect and use personal data when you visit auditvault.co.uk or use the AuditVault platform, and the rights you have under the UK GDPR and the Data Protection Act 2018.

    2. Our Role: Controller and Processor

    We are the controller of the account, billing, usage and website data described in this policy.

    For the documents, evidence, supplier records and other content our customers upload or connect, the customer organisation is the controller and we are its processor. We process that content only on the customer's instructions, under our Data Processing Agreement. This includes people who appear in that content, such as supplier contacts and employees asked to acknowledge a policy. If you are one of them, please contact the organisation that holds your data. We will pass on any request we receive.

    3. Information We Collect

    • Account data: your name, business email address, organisation, role, and sign-in details such as single sign-on and multi-factor authentication settings.
    • Billing data: billing contact, subscription and invoice details. Card payments are handled by Stripe. We never see or store your full card number.
    • Usage and technical data: the features you use, AI credit consumption, IP address, browser and device information, and security logs.
    • Support and correspondence: messages you send us, including through the in-app help chat.
    • Website analytics: pages visited and how you arrived, collected through Google Analytics cookies, but only if you allow analytics cookies.

    4. How We Use It and Our Lawful Bases

    • To provide the Service, including creating and securing your account, running the features you use, and sending service emails such as invitations, alerts and receipts. Lawful basis: performance of our contract with you or your organisation.
    • To bill for the Service and keep financial records. Lawful bases: contract and legal obligation.
    • To keep the Service secure, for example to detect abuse, fraud and unauthorised access and to enforce fair use. Lawful basis: our legitimate interest in protecting the Service and our customers.
    • To support and improve the Service, by answering your questions and understanding which features are used. Lawful basis: legitimate interests.
    • Website analytics. Lawful basis: your consent, which you can withdraw at any time through Cookie settings in the site footer.

    We do not sell personal data, use it for advertising profiles, or make decisions with legal or similarly significant effects about you by automated means.

    5. AI Processing

    AI features use Anthropic Claude models through Amazon Bedrock, called on-demand in the AWS London region (eu-west-2) only. Anthropic does not receive your data, and neither we nor our providers use your data to train or fine-tune AI models. AI answers are generated from your own organisation's content and are never shared with other customers. How AI processing stays in the UK.

    6. Who We Share It With

    We share personal data only with the service providers that help us run AuditVault: AWS for hosting, AI and email; Supabase for our database; Clerk for sign-in; Stripe for payments; and Google for website analytics. Each one is bound by a written contract to protect the data and to use it only to provide its service to us. The full current list is on our Subprocessors page. We may also disclose data where the law requires it, or as part of a sale or reorganisation of our business, subject to this policy.

    7. Where Your Data Is Stored

    Customer content, our database and AI processing are in the United Kingdom (AWS London, eu-west-2). Clerk, Stripe and Google may process limited account, billing and analytics data outside the UK, including in the United States. Where they do, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

    8. How Long We Keep It

    • Account and usage data: for as long as your account is active. After your account closes, we delete or anonymise it, subject to the other points in this list.
    • Customer content: for as long as your organisation keeps it. Administrators can set an automatic retention period in Settings. Deleted suppliers stay in the recycle bin for 90 days before they are permanently removed. After a subscription ends, content is available for export for 30 days and is then deleted.
    • Billing records: for as long as tax and company law require, normally six years.
    • Backups: deleted data may remain in encrypted backups until those backups rotate out.

    9. Security

    Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), and each customer's data is isolated at database level. Our Security page explains our measures and our certification status.

    10. Cookies

    We use strictly necessary cookies for sign-in and security. We use Google Analytics cookies only if you accept them, and you can change your choice at any time through Cookie settings in the site footer. See our Cookie Policy.

    11. Your Rights

    Under UK data protection law you have the right to:

    • Access your personal data and receive a copy of it
    • Have inaccurate data corrected
    • Have your data erased
    • Restrict or object to our processing, including processing based on legitimate interests
    • Receive your data in a portable format
    • Withdraw consent at any time, where we rely on consent

    To exercise any of these rights, email support@auditvault.co.uk. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to resolve your concern first.

    12. Children

    AuditVault is a business service and is not intended for anyone under 18. We do not knowingly collect children's personal data.

    13. Changes to This Policy

    We may update this policy from time to time. We will show the date of the latest change at the top of this page and tell account holders about significant changes by email or in the Service.

    14. Contact Us

    For questions about this policy or your personal data, email support@auditvault.co.uk or write to Auditvault Limited, 4-6 Greatorex Street, London, E1 5NF.