Privacy notice
Last updated: 3 November 2026
This notice describes how Md R Rafi, trading as Auditably.co, handles information used to operate the website and reporting software. Business contact: 11 Jalan SS15/4, Subang Jaya, Selangor, Malaysia. Contact [email protected] for privacy questions or requests.
1. What the service handles
- Accounts and subscriptions: email address, authentication records, organisation membership, role and subscription status. Supabase handles password authentication; application records do not store plaintext passwords. Paddle handles payment details.
- Reporting work: reporting cycles, disclosures, figures, units, method notes, evidence metadata, uploaded files and generated exports. These are stored by the service when you save or upload them. Spreadsheet parsing in the browser does not mean that data you later import remains only in the browser.
- Activity history: actions, named users, timestamps and relevant before/after values. Applied instructed changes also retain the instruction in the activity log.
- Diagnostic: answers and context remain in browser storage until you request the emailed report. That request sends the answers, context, score, email and optional company name to the report service. The request also carries normal connection information; the Worker records a salted IP hash, user-agent information and supplied campaign tags. A report request does not enrol you in automatic marketing follow-ups.
- Enquiries: the name, email and message you submit, optional reporting context and a source-page label where provided. These are used to reply and understand the enquiry.
2. Why information is used
We use information to provide accounts and reporting features, control access, process subscriptions, deliver requested reports, answer enquiries and operate and secure the service. Where applicable, processing relies on the relevant contractual, legal, legitimate-interest or consent basis for that purpose. We do not sell personal information or provide customer evidence to advertising systems.
3. Services involved
| Service | Information and purpose |
|---|---|
| Supabase | Authentication, application and diagnostic records, organisation membership and evidence metadata. |
| Cloudflare | Website hosting, API requests, page analytics and R2 storage for uploaded evidence and generated exports. |
| Paddle | Payment, tax and subscription processing as merchant of record. We receive subscription and transaction identifiers and status. |
| Resend | Requested email reports, account or invitation messages and contact enquiries, including their contents. |
| PDFShift | Report HTML needed to render diagnostic and auditor-pack PDFs. Report content may contain customer disclosures and activity information. |
| OpenAI (optional) | Model requests using a key you supply. The two request paths are described below. |
| Google Fonts and public script CDNs | Requests for public browser assets expose connection information such as IP address to the serving provider. |
4. Optional model features
Drafting sends the selected prompt from your browser to OpenAI using your key. Instructed changes send your instruction and key through our Worker, which constructs a catalogue of the reporting cycle for the model request. That catalogue can include disclosure titles and statuses, current values, units and evidence filenames; the evidence files themselves are not included. Applied instructions and resulting changes are retained in activity history.
The application holds your model key for the browser session and does not deliberately persist it. We do not train models on customer content. The model provider's processing and retention are governed by the terms of your provider account. Review the information you send and do not include data you are not permitted to share.
5. Storage locations and transfers
The configured Supabase database region is Tokyo. Cloudflare R2 and the other providers are separate services and may process information in other locations. We do not offer a customer-selected region or a promise that all data stays in Tokyo. Ask us to confirm your required contractual and transfer terms before uploading information subject to residency restrictions.
6. Retention and deletion
Account and reporting records are retained to provide the service, preserve the reporting history and meet applicable obligations. Subscription and transaction records may need to be retained after cancellation. Browser diagnostic state can be cleared with the restart control or by clearing site storage.
For account closure, exports or deletion, contact us. We will confirm the scope and applicable retention requirements, including activity records, stored files and backups. An append-only log prevents ordinary edits and deletes; it is not a promise that personal data can never be removed through an authorised administrative process. We do not publish an automated purge interval or a guaranteed deletion deadline for every data category.
7. Your requests and rights
Depending on applicable law, you may have rights to access, correction, deletion, portability, restriction, objection and withdrawal of consent. Contact us using the address above; we may need to verify your identity. Requests are handled within applicable legal deadlines. You may also raise a concern with the relevant data protection authority.
8. Browser storage and analytics
The app stores authentication state in your browser. The diagnostic stores progress locally. The public website uses Cloudflare page analytics. Infrastructure and CDN requests expose normal connection information to their providers. Customer evidence, answers and model keys are not included in marketing event payloads. Any future analytics integration must preserve that boundary.
9. Security and scope
Connections use HTTPS. Access checks and database policies restrict application records by organisation, and uploaded evidence carries a SHA-256 digest. These controls do not establish that evidence is accurate or guarantee an assurance outcome. See the trust page for current limitations, including recovery and incident readiness. Do not use the service for children's data or submit personal information unnecessary for your reporting work.
10. Changes and contact
Material changes to data handling will be reflected in this notice and communicated where required. For questions, requests or an agreement covering your organisation's data, contact [email protected] before uploading sensitive evidence.