Privacy Policy
1. Who we are
iAudited is provided by Pinnokkio LLC, a Michigan limited liability company located at 145 S. Livernois Road, #325, Rochester, MI 48307, USA (“iAudited”, “we”, “us”).
This policy covers our website, iaudited.com, the iAudited web and mobile applications and desktop clients (the “Service”), and our communications with you.
Controller. Pinnokkio LLC is the controller of the personal data described in this policy. The exception is the content your organization uploads to the Service (such as audit questions, responses and its user list): for that content, your organization is the controller and we process it only on its instructions, as its service provider (processor).
Privacy contact. Email support@iaudited.com with any privacy question or request.
2. Information we collect
When you visit our website
- Usage information. We use Google Analytics to understand how you access and use our website: for example, how you arrived at the site, whether you have visited before, how long you stay and which pages you visit.
- Location information. Google Analytics processes your IP address to give us general information about where in the world visitors are located.
- Server logs. Our web server keeps standard access logs, which may record your IP address, browser type, the pages requested and the date and time.
When you use the Service
- Account information. To let users sign in, the Service processes account details that your organization provides, such as users’ names, work email addresses and roles.
- Device information. We collect information about the number and type of devices you use to connect to the Service, and their operating systems (e.g., iOS, Android, Windows).
- Location from a mobile device. Only if you choose to share it.
- Anonymous statistics. Such as bandwidth used and the total number of users.
- Troubleshooting data. Only with your organization’s explicit permission.
- Uploaded content. On our Seller-managed cloud, content your organization uploads is end-to-end encrypted and only your organization can use the decryption keys. Our personnel cannot read it. On a Client-managed (on-premises) installation, we have no access to any data.
When you contact us or buy from us
- Information you email to us. If you email us, we receive your email address and whatever you include in the message.
- Business and billing information. To quote, invoice and support your organization, we process business contact details (names, work emails and phone numbers of your purchasing, accounts-payable and administrator contacts), company name and address, tax identifiers and purchase-order numbers.
We may also link the information above with data we receive from partners such as Google Analytics, to help understand your needs and provide you with a better experience.
3. How we use it, and our legal bases
| Information | Why we use it | Legal basis |
|---|---|---|
| Website usage and location information (Google Analytics) | Understand how our website is used, improve it and tailor our communications | Our legitimate interests; your consent where the law requires it |
| Server logs | Operate and secure the website and prevent abuse | Our legitimate interests |
| Information you email to us | Answer your request, provide support and respond to sales enquiries | Our legitimate interests; steps you ask us to take before entering a contract |
| Account and device information | Provide the Service, authenticate users, remember settings, and support and secure the Service | Performance of our contract with your organization; our legitimate interests |
| Mobile location | Provide features that use location | Your consent, which you can withdraw in your device settings |
| Anonymous statistics | Plan capacity and manage the Service | Our legitimate interests |
| Troubleshooting data | Diagnose and fix problems | Your organization’s explicit permission |
| Business and billing information | Quote, invoice, collect payment, and keep accounting and tax records | Performance of our contract; compliance with legal obligations |
4. Who we share it with
iAudited is not in the business of selling or renting your information. We do not share your information with any third parties for their own advertising purposes. We share only the minimum information necessary, in these cases:
- Service providers that process data on our behalf, under contracts that require them to protect it:
- Google (Google Analytics): website analytics.
- Amazon Web Services: cloud hosting and storage for Seller-managed configurations.
- The providers that host our website and our email.
- Paddle.com. Paddle is our online reseller and the Merchant of Record for orders processed through Paddle. For those orders, Paddle receives your organization’s billing contact details, company details and payment information in order to invoice, collect payment, calculate taxes and handle refunds. Paddle processes this information as an independent controller under the Paddle Privacy Policy.
- Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
- Authorities, where required by law (see Legal requests).
- A successor business, if Pinnokkio LLC is involved in a merger, acquisition or sale of assets. Any successor must continue to protect your information in line with this policy.
5. Where your data is stored
For Seller-managed configurations, your organization chooses the country where its Service data is stored, and we will not transfer that data out of that country unless your organization asks us to.
We are based in the United States. Website analytics, server logs, emails and billing information are processed in the United States and, through our service providers, possibly in other countries. Where the law requires safeguards for international transfers, we rely on the contractual safeguards in our providers’ data processing terms, such as the European Commission’s Standard Contractual Clauses.
6. How long we keep it
- Google Analytics data: kept for the data-retention period set in our Google Analytics account, then deleted automatically.
- Server logs: kept only as long as needed for security and troubleshooting, then deleted.
- Emails and support requests: kept as long as needed to handle your request and keep a record of our dealings with you.
- Account information and uploaded content: kept for as long as your organization’s contract is active. When your organization terminates and asks us to, we immediately and permanently delete the content it uploaded to the Seller-managed cloud.
- Troubleshooting data: deleted once the issue is resolved.
- Business and billing records: kept for as long as tax and accounting laws require.
7. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent; and
- complain to your data protection authority.
If you are in Mexico, these include your ARCO rights (access, rectification, cancellation and opposition).
To exercise any right, email support@iaudited.com. We may need to verify your identity, and we will respond within 30 days. If your request concerns content your organization uploaded to the Service, please contact your organization first, since it controls that content; we will help it respond.
8. How we protect it
- Communications between your devices and our network are encrypted with TLS and AES-256.
- Storage on the Seller-managed cloud is encrypted and automatically backed up with redundancies.
- Uploaded content is end-to-end encrypted, and only your organization can use the decryption keys.
- Anonymous statistics are available only to designated admins, and troubleshooting data only with your organization’s explicit permission.
- No one on our side will ever ask you for your password.
- We notify affected customers of any data-security breach of their data within 3 business days.
9. Cookies Policy
What are cookies?
Cookies are small data files that a website you visit may save on your device. They usually include an anonymous unique identifier. A cookie cannot retrieve any other data from your hard drive or pass on computer viruses.
Functional cookies (the Service)
Functional cookies are necessary for the Service and its features to work as intended. For example, we use them to recognize and remember you when you are logged in, so we can maintain your settings and preferences, such as your language and region, and your logged-in state. These cookies do not track your browsing activity on other websites. The Service is the only place we use them.
Analytics cookies (our website)
On our website, Google Analytics sets cookies that help us understand how visitors use the site, as described in section 2. To learn more, see How Google uses information from sites or apps that use its services. To opt out of Google Analytics on all websites, install the Google Analytics opt-out browser add-on.
Payment pages
If you open a Paddle checkout or payment page from our website, Paddle may set its own cookies to process the payment and prevent fraud. Those cookies are governed by the Paddle Privacy Policy.
Managing cookies
You can block or delete cookies in your browser settings. If you block functional cookies, you will not be able to sign in to the Service.
10. Legal requests
We vigilantly protect the privacy of your account. We will not disclose your information to law enforcement or other governmental authorities unless we believe it is required to comply with warrants, court orders, subpoenas, or other lawful government requests. More detail is in Chapter 5 of our Terms of Service.
11. Children
The Service is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.
12. Changes and contact
We may update this policy from time to time. We will post the updated version on this page with a new date, and will notify active customers by email of material changes.
Pinnokkio LLC
145 S. Livernois Road, #325
Rochester, MI 48307, USA
Privacy contact: support@iaudited.com