Privacy policy

Who we are

HumanAudit Inc. is a Delaware C-Corporation. For the purposes of the UK and EU General Data Protection Regulation we act as a data controller for information you give us directly, and as a data processor for data we access in your systems during a scan. Contact: privacy@humanaudit.ai, or by post at 1111B S Governors Ave, STE 47918, Dover, DE 19904, United States.

What we collect

Information you give us. When you request a scan we collect your name, work email address, company name, role, the sources you indicate you can connect, and anything you write in the message field. We use it to arrange and deliver the scan and for nothing else.

Information from a connected source. If you authorise a read-only connection we access application and identity metadata: application names and identifiers, granted scopes, creation and last-use timestamps, and the directory fields needed to resolve an owner — display name, work email, account status. This may include personal data about your employees, which is why a Data Processing Agreement is signed before any connection where that applies.

What we never collect. Secret, token or key values. Message, email, document or source-code content. Anything beyond the metadata described above.

Website analytics. This site uses Google Analytics 4 in a cookieless configuration: it records which pages are read, roughly where in the world the visitor is, and which site or search referred them. It writes nothing to your browser — no cookie, no local-storage entry, no identifier of any kind — so it cannot recognise you on a second visit and cannot follow you to any other site. IP addresses are anonymised before processing. There are no advertising trackers, no cross-site identifiers, no session recording and no fingerprinting. Standard server logs recording IP address, user agent and requested path are retained for 30 days for security and diagnostic purposes.

If you would rather not be counted at all, any content blocker or the browser’s “do not track” extensions will stop it, and nothing on this site breaks when you do. We do not detect or work around blockers.

Legal basis

For scan requests: your consent, and our legitimate interest in responding to a commercial enquiry you initiated. For connected-source data: our contract with you, and your explicit authorisation through the OAuth consent screen. You may withdraw consent at any time by disconnecting from your own admin console.

How long we keep it

• Scan metadata from connected sources: 90 days, then deleted.
• OAuth credentials for our connection to your systems: until you disconnect.
• Our audit log of what we accessed: 12 months.
• Contact details from a scan request: 24 months, or until you ask us to delete them.
• Server logs: 30 days.

Immediate deletion on request, at any time, for any reason, confirmed in writing.

Who we share it with

We do not sell your data, we do not share it with advertisers, and we do not add you to any marketing list you did not ask to join. We will notify you before adding a sub-processor that handles customer data.

Named sub-processors, so you do not have to ask:

• Formspree — processes the scan-request form on /scan and relays it to us by email. It receives whatever you type into that form: name, work email, company, and the optional role, sources and message fields. Nothing else on this site sends data anywhere.
• Google Analytics 4 — measures which pages are read and where visitors arrive from. Configured to store nothing on your device: client_storage: "none", so no _ga cookie and no identifier is written to your browser. IP addresses are anonymised, Google Signals is off, and advertising personalisation is off. Because nothing is stored, we cannot recognise you across visits and we do not try to.
• Hosting and email providers — named on request, and named to you before you connect anything.

There is no tag manager, no advertising pixel, no session recording, no heatmap, no chat widget and no fingerprinting on this site, and we set no cookies at all — not ours, not anyone else’s. The only third-party origins any page contacts are Google (web fonts, and the cookieless analytics above) and, on /scan at the moment you submit the form, Formspree.

Since we are inviting you to check: this site writes exactly one thing to your browser, and only if you use it. Clicking the light/dark toggle stores ha-theme in local storage so the page remembers your choice. It is not an identifier, it never leaves your device, and clearing site data removes it. Everything above is verifiable in your browser’s network and storage tabs, and we would rather you looked than took our word for it.

We may disclose information where legally required. If we receive such a request we will notify you unless legally prohibited from doing so.

Where it is held

Data is currently hosted in the United States. For transfers of personal data from the UK or EEA we rely on Standard Contractual Clauses. EU data residency is on our roadmap and is not yet available; if that is a requirement for you, tell us before connecting.

Your rights

Depending on where you live you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to processing, receive it in portable form, and complain to a supervisory authority. Email privacy@humanaudit.ai and we will respond within 30 days. We do not charge for this and we will not make it difficult.

Security

Encryption in transit and at rest, tenant isolation, role-based internal access with multi-factor authentication, and an immutable log of every access to customer data. Full detail on the security page, including an honest statement of which certifications we do not yet hold.

Children

This is a business product. We do not knowingly collect data from anyone under 18.

Changes

If we make a material change we will update the effective date above and, where we hold your contact details, tell you directly rather than relying on you to notice.