Privacy policy
Version 2, draft, not reviewed by counsel, based on legal-tpl-privacy-policy v1
Last updated: 29 October 2026 · Version: 2
1. Who we are
aiactaudit.ai (aiactaudit.ai) is run by Human Synthesis SRL, Sat Buciumeni, Comuna Buciumeni, nr. 279, Dâmbovița County, 137065, Romania, registered in the trade register under J15/860/12.06.2024, VAT RO50224420 ("we", "us"). For the data in this policy we decide why and how your personal data is used: we are the controller.
Data our customers enter about their clients. Experts use aiactaudit.ai to keep a register for their own clients. For the data they enter about those clients and the clients' staff (client workspaces, contact people, AI inventory rows, evidence notes, classification answers), we act as processor for the customer, under our data processing agreement: https://aiactaudit.ai/dpa. The customer decides about that data; if you are a client or a member of a client's staff, please contact the expert who invited you first. We help them answer you.
Contact for anything about your data: privacy@aiactaudit.ai.
2. What data we use, why, and on what legal basis
| What we use it for | Data | Legal basis | Recipients | How long we keep it |
|---|---|---|---|---|
| A1. Creating and running your account: sign-up, sign-in, optional second factor, team, language, how you found us | name, email, firm, market, language, password (stored hashed), optional second-factor secret and recovery codes, list of signed-in devices, the referral source of the link you came from | performance of our contract with you | Cloudflare (hosting, database, storage, and sending verification, password reset and invitation emails through our own email service) | while your account exists; see section 7 |
| A2. Providing the service: client workspaces, intake links, AI inventory, classification, obligations register, timeline, reminders, change log, export, law-watch alerts | client name, language and market; names and emails of client contact people; AI inventory rows and evidence notes (these may contain personal data of client staff); classification answers and results with their versions; register lines, dates and reminder settings; change log; alerts | performance of our contract with the account holder; for data the customer enters about its clients and their staff we are processor under the data processing agreement | Cloudflare (hosting, and sending reminders and alerts); never any AI provider | as A1; after the contract ends, export for 30 days, then deletion within 90 days |
| A3. Payments, invoices and tax records | billing name and address, VAT number, plan and quantities, payment status, invoice copies (card data stays with our payment provider) | contract, and legal obligation for invoices and tax records | Stripe Payments Europe, Ltd. (payments, invoices, tax calculation); our accountants for Romanian e-invoicing (e-Factura) | invoices and accounting records 10 years (Romanian law) |
| A4. Customer support and the contact form | name, email, firm, market, number of clients (range), subject, message | contract for customers; our legitimate interest in answering people who write to us | Cloudflare (form submissions and the notification email) | 2 years after the last message |
| A5. Security, fraud and abuse prevention: bot protection on every public form (Cloudflare Turnstile), sign-in logs, blocked-access logs, rate limits | IP address, device and browser signals, sign-in and activity logs | our legitimate interest in keeping the service and our customers' data safe | Cloudflare (hosting, Turnstile) | 90 days, longer if needed for an incident |
| A6. Improving the service: statistics per market from our own records | plan, market, counts of clients, trials and conversions; the statistics contain no identifiers | our legitimate interest in improving our products | Cloudflare | statistics kept; the source records as A1 to A3 |
| A7. Service messages: trial notices, reminders, renewal reminders, read-only notices, security emails | email, account state | performance of our contract with you | Cloudflare (email sending) | email log 90 days |
| A8. News about our similar products, if you are a customer (we send none today) | email address | our legitimate interest (direct marketing to customers); you can unsubscribe in every message and in your account | Cloudflare (email sending) | until you unsubscribe; we then keep only your address on a do-not-contact list |
| A10. Records of your acceptance and consent: terms, data processing agreement, cookie choices | user, document, version, date and time, how it was given; cookie choices are stored without your IP address | legal obligation to prove acceptance and consent | Cloudflare | 5 years after the account ends |
| A11. Law watch | public official law texts only; no personal data | not personal data | Anthropic (Claude) receives public law texts only, never personal data | as long as we keep our law records |
| A12. Our operator panel and staff accounts | staff email, password (stored hashed), second factor, operator log | contract, and our legitimate interest in operating the service | Cloudflare | while the staff account exists; operator log 1 year |
| A13. Public law and schedule data for our sister site euaiactaudit.com | no personal data | not personal data | none | not applicable |
| Newsletters and offers if you are not a customer, and offers from partners (we offer none today) | email address, your preferences | your consent | Cloudflare (email sending) | until you withdraw consent |
| Complying with the law and defending legal claims | the data needed for the purpose | legal obligation; our legitimate interest in defending our rights | authorities, courts and advisers when needed | as long as the purpose requires |
Where we rely on legitimate interest, we have balanced it against your rights and freedoms; you can ask us for this assessment and you can object at any time (section 6).
Data marked as required in our forms is needed to provide the service; without it we cannot create the account or fulfil the order. Optional data is marked optional.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Classification results in the service are rule-based, run by the user, and informational only.
3. Where your data comes from
From you (forms, account, use of the service), from the expert who invites you as a client contact, from your device (logs, cookies with your consent), and from our payment provider (payment status).
4. Who receives your data
We do not sell your personal data. We share it only with:
- Service providers who process it for us under contract and our instructions: hosting and infrastructure (Cloudflare, Inc.), email delivery (Cloudflare Email Sending and Email Routing, through our own service Aiosis Emails), payments (Stripe Payments Europe, Ltd.). The current list: https://aiactaudit.ai/subprocessors.
- AI processing: our law watch sends public official law texts to Anthropic (Claude) to rate their relevance and set tags. No personal data and no data you or your clients enter is ever sent to any AI provider. Anthropic is listed on the sub-processors page for transparency.
- Authorities, courts and advisers when the law requires it or to defend our rights.
- A buyer or successor of all or part of our business, who must keep this policy's protections.
- Partners for their own marketing only with your consent.
5. Where data is stored and transfers outside the European Economic Area
Cloudflare stores our database and files (Cloudflare D1 and R2) and serves the site from its global network. Our configuration does not fix a storage region, so Cloudflare chooses the location, which may be outside the European Economic Area.
Some providers are in other countries. We transfer data only to countries the European Commission recognises as adequate, including US companies certified under the EU-US Data Privacy Framework, or under the Standard Contractual Clauses approved by the Commission. Our providers use the Data Privacy Framework or the Standard Contractual Clauses. Ask us for a copy of the safeguards.
6. Your rights
You can ask us to: access your data and get a copy; correct it; delete it; restrict its use; receive it in a portable format; and object to uses based on legitimate interest. You can object to direct marketing at any time, with no reason needed. Where we rely on consent you can withdraw it at any time, without affecting earlier use.
How: in your account settings (export your data at /app/privacy, delete your account at /app/account/delete) or by email to privacy@aiactaudit.ai. We answer within one month (at most three months for complex requests, and we tell you why). We may ask you to confirm your identity. For data an expert entered about you as a client contact or client staff, we pass your request to that expert and help them answer it.
You can complain to us first; you also have the right to complain to a data protection authority, in particular in the country where you live or work: Romania ANSPDCP (dataprotection.ro), France CNIL (cnil.fr), Italy Garante (garanteprivacy.it), Spain AEPD (aepd.es), Greece HDPA (dpa.gr), Ireland DPC (dataprotection.ie), United Kingdom ICO (ico.org.uk). Our lead authority is the Romanian ANSPDCP.
7. How long we keep data
- Account data: while your account is active. If a subscription lapses unpaid, the account stays read-only for 90 days, then we delete it after 30 days' notice. When you delete your account, we remove it within 30 days; backups are overwritten within 90 days.
- Client data you entered: you can export it for 30 days after the contract ends; we then delete it within 90 days, including backups.
- Invoices and accounting records: as long as tax law requires (Romania 10 years; other countries 5 to 10 years).
- Support messages: 2 years after the last message.
- Security logs and email logs: 90 days, longer if needed for an incident.
- Operator log: 1 year.
- Marketing: until you unsubscribe or withdraw consent; we then keep only your address on a do-not-contact list.
- Records of consent and of your acceptance of our terms: 5 years after the account ends.
- Cookies: at most 13 months.
8. Security
We protect your data with encryption in transit, access limited to people who need it, two-factor sign-in for staff and optional two-factor sign-in for users, a separate key for every customer on every record so no customer can see another's data, bot protection on every public form, backups and regular security reviews. No system is perfect; if a breach puts your rights at risk we will tell the authority and, when the risk is high, you. If it concerns data we process for a customer, we tell that customer within 48 hours.
9. Children
aiactaudit.ai is not meant for children under 16. The service is for businesses and professionals aged 18 or over. We do not knowingly collect children's data; if we learn we have, we delete it. Parents can contact us at privacy@aiactaudit.ai.
10. Cookies
We use cookies and similar technologies. Non-essential ones are used only with your consent. Inside the app (/app) we use only strictly necessary cookies. Details and your choices: https://aiactaudit.ai/cookies; you can change your choice at any time with the "Cookie settings" link at the bottom of every page.
11. Changes to this policy
We may update this policy. We show the date of the last change at the top. Important changes are announced by email or in the service at least 30 days before they take effect.