Legal
Privacy notice.
This notice describes what AuditSahi collects, why, how long it is kept, who sees it and the rights you have. It is written to be read, and it describes what the product does today.
Draft pending legal review. The company details marked [[NEEDS]] are to be filled in before this notice is relied on.
Who we are
AuditSahi is operated by O Square Technologies, a sole proprietorship, of R 121, Phase 8B, Industrial Focal Point, Mohali, SAS Nagar, Punjab 160071. For anything in this notice, write to support@auditsahi.com. Under the Digital Personal Data Protection Act, 2023 we are the data fiduciary for the personal data described here.
What we collect and why
| What | Why | Basis |
|---|---|---|
| Your name, work email and phone number | To create your account, let you sign in and reach you about the service. | Your consent when you sign up, and performing the service you asked for. |
| Your password | To let you sign in. It is stored only as a salted scrypt hash. We cannot read it. | Performing the service. |
| A session cookie named cy_session | To keep you signed in. It is a random token, marked HttpOnly and SameSite, and it expires 30 days after sign-in, after 7 days without use, or when you sign out. It is the only cookie we set. | Strictly necessary for the service. |
| What you tell us about your organisation | Its type, licences, size, state and the people you name as owners of duties, so the rules engine can work out what applies and who is responsible. | Performing the service. |
| Documents you upload | To read them against your obligations. We extract the text and keep the text with its verdicts. The uploaded file itself is deleted from our server as soon as the text has been extracted. | Performing the service. |
| Your newsletter address, if you subscribe | To send you a short email when a rulebook changes. Nothing else is sent to it. | Your consent, given by ticking the box. You can withdraw it with the unsubscribe link in any email. |
| Service records | A log of actions in the product (for example that a document was uploaded or a policy approved) and of errors, so we can run the service and answer an auditor's question about what happened when. | Performing the service and our legitimate interest in running it. |
We do not use analytics or advertising trackers on the site or in the product. We do not buy data about you or combine it with data from elsewhere.
Documents and the people named in them
Documents you upload may contain personal data about other people, such as the names of directors, officers or staff in a policy or in Board minutes. You are the data fiduciary for that data and we process it as your data processor, on your instructions, for the purpose of reading the document against your obligations. Please upload only what the audit needs.
How documents are read
Each document is read by two independent AI models. Today those models are called through OpenRouter, a model routing service, and the document text and your organisation's profile are sent to the models for that purpose. The current model providers and the countries in which they process the text are [[NEEDS: current model providers and processing locations]]. We do not claim that this processing happens only in India today. We are moving document reading onto infrastructure in India, and this notice will be updated when that is complete.
Whether the providers retain the text or use it to train models is governed by their terms: [[NEEDS: confirm provider retention and training terms]]. The results they return are kept with your organisation only. Every verdict shows the line in your document it rests on, and a person in your organisation can overrule any verdict.
Where your data lives
Our server is in Mumbai, India. Account details, organisation profiles, extracted document text, verdicts, approvals and service records are stored there. Backup arrangements: [[NEEDS: backup arrangements and location]].
When you visit the site or the product, your browser fetches the typefaces from Google Fonts, which means Google receives your IP address and the page address as part of that request. We do not send Google anything else.
Who we share it with
- The AI model providers above, for reading documents, to the extent described.
- Our hosting provider, which operates the server in Mumbai, under contract.
- Google, only to the extent your browser fetches typefaces as described above.
- The mail service that delivers the newsletter and notices to account holders, which receives your email address and the message: Hostinger, our email provider. Hostinger does not publish where its email service stores mail, so we do not claim that mail is processed only in India. No email has been sent yet.
- O Square Technologies staff with administrator access, who can see accounts and organisations in order to run the service and answer questions about it.
- Nobody else sees your organisations. The three fictional sample organisations are shown to anyone who opens the demo; the organisations you create are visible to you and to administrators.
- A regulator, court or authority where the law requires it.
We do not sell personal data and we do not share it for advertising.
How long we keep it
- Account details: for as long as the account exists. When you delete the account they are removed at once, as described below.
- Session cookies: 30 days after sign-in, 7 days without use, or until you sign out.
- Organisation data, extracted document text and verdicts: until you delete the document or the organisation in the product, or ask us to delete the account.
- Newsletter addresses: until you unsubscribe.
- Service and error records: one year, then deleted.
Your rights
The DPDP Act gives you these rights, and we honour them whether or not the relevant section is yet in force.
- Access. You may ask for a summary of the personal data we hold about you and who it has been shared with.
- Correction and erasure. You may ask us to correct, complete, update or erase your personal data. You can delete a document, an organisation or your whole account yourself in the product. Deleting the account, from the Account page, removes it at once together with every organisation you created and everything in them, and the service records that name you. You can also ask us by email to support@auditsahi.com.
- Withdrawing consent. You may withdraw consent for the newsletter at any time with the link in any email, and for the account by deleting it.
- Grievance. You may raise a grievance with our grievance officer, Kunal Sarin, at kunal.sarin@osquare.tech. We respond within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
- Nomination. You may nominate a person to exercise these rights on your behalf if you die or become unable to act.
Children
AuditSahi is a service for businesses and their advisers. It is not directed at children and we do not knowingly collect personal data from anyone under eighteen.
Changes to this notice
When this notice changes, the date at the top changes and the previous version is available on request. Material changes, such as a change in where documents are read, will be told to account holders by email.