1. Controller
This Privacy Policy describes how Sagbrain Global Pte. Ltd. ("we", "us") processes personal data through AuditToDesk. It is written to comply with Japan's Act on Protection of Personal Information (APPI) and the EU General Data Protection Regulation (GDPR).
2. Information we collect
- Account data: email, hashed password, locale preference, plan tier.
- Scan data: URLs you submit and the resulting scan artifacts (DOM, screenshot, HTTP headers, network log).
- Usage logs: hashed IP, user-agent, action timestamps.
- Payment data: we do not store card numbers — payments are processed by Stripe.
3. Purposes
- Operating the Service (running scans, producing reports, matching agencies)
- Account management and authentication
- Billing and payment processing
- Abuse and threat detection
- Building anonymised benchmark statistics
- Legal compliance (court orders, tax filings, security incident reporting)
4. Sharing with third parties
We do not sell or rent personal data. If you choose to be introduced to a particular agency via our marketplace, we share your diagnostic results and contact details with that agency — this is your explicit, action-driven instruction to share.
5. Sub-processors
- AWS: hosting, database, storage. Primary region: ap-northeast-1 (Tokyo).
- Google Cloud (Gemini API):AI diagnosis engine (see “5-A. No use as AI training data” below)
- Stripe: payment processing
- Sentry: error tracking (technical logs only)
- Resend / AWS SES: transactional email
5-A. Use of Scanned Content for AI Training
AuditToDesk sends scanned website content (HTML, screenshots, and metadata) to the Google Gemini API solely for the purpose of generating your diagnosis report. This data is not used to train AI models. Retention follows Google's data retention policy, which may include temporary retention for abuse-monitoring purposes.
Google's Gemini API Terms of Service explicitly prohibit the use of API request data for training, improving, or fine-tuning AI models. AuditToDesk does not share scanned content with any other AI sub-processor for training purposes.
We do not use your scanned site content for:
- Training or fine-tuning any AI model
- Sharing with third parties for model improvement
- Any purpose beyond generating your diagnosis report
6. International transfers
Our sub-processors operate in Japan, the US, and the EU. For transfers of EU residents' data outside the EU, we rely on the European Commission's Standard Contractual Clauses (SCCs). Japan-region data is stored in ap-northeast-1 (Tokyo) by default.
7. Retention
- Account data: deleted within 30 days of account deletion.
- Scan artifacts: raw data (screenshots, captures) is deleted after 90 days; anonymised metadata is retained for benchmark statistics.
- Payment records: retained for 7 years to satisfy legal obligations.
- Audit logs: retained for 3 years.
8. Your rights
You have the right to:
- access the personal data we hold about you;
- request correction, completion, or deletion;
- object to processing or restrict it (e.g., for direct marketing);
- data portability (GDPR residents);
- lodge a complaint with your supervisory authority.
Send requests to privacy@audittodesk.com — we acknowledge within 48 hours and fulfill your request within 14 days after verifying your identity.
10. Security
We follow controls inspired by ISO 27001, including encryption (TLS 1.2+ in transit, AES-256 at rest), least-privilege access control, and regular vulnerability scans. See our Security page for more.
11. Children
The Service is not directed to anyone under 18. We do not knowingly collect personal data from minors.
12. Changes to this policy
We will notify you of material changes at least 30 days before they take effect.
13. Contact
For any privacy questions, contact our Data Protection lead at privacy@audittodesk.com.