1. Who we are
"Audita" refers to the business operated from India that publishes audit-ready ISO documentation toolkits at audita.in and audita.one. We are the data controller (under GDPR / DPDP terminology) for personal data collected through these sites.
2. What we collect
When you buy we collect:
- Your name, email, company, country, optional tax ID (GSTIN / VAT / EIN / ABN), billing address and optional phone
- The legal entity the licence is issued to (if different from the billing party)
- Order details — toolkit purchased, version, amount, currency, payment status
- Watermarking metadata stamped into your downloads — licence key, your entity name, download number, IP at download time
Automatically when you visit we collect:
- Anonymised, aggregated visit counts via Plausible Analytics — no cookies, no personal data, no cross-site tracking
- Server access logs (IP, user-agent, timestamps) retained for 30 days for security and abuse-prevention
- A session cookie if you sign into the customer dashboard — strictly necessary, no consent prompt required
We do not collect government IDs, social security numbers, passport numbers, payment card details, or biometric data. Card details are handled directly by Razorpay (see §4).
3. Why we collect it
- To fulfil your order — issue licences, generate GST / export-of-services invoices, send confirmation and download emails
- To prove the licence chain — the licensed entity's name is stamped into every downloaded file via standard document properties and a visible footer, so the audit-readiness of the deliverable can be traced back to the original purchase
- To comply with tax law — GST invoices in India must include buyer name, address and (for B2B) GSTIN; we are required to retain these for 6 years
- To prevent abuse — download throttling, signature verification, fraud detection
- To improve the product — aggregate, anonymous Plausible counters (page views per toolkit, conversion rates). No individual profiling.
4. Who we share with
- Razorpay (payment processor) — receives your name, email, billing address and amount to process payment. Subject to Razorpay's privacy policy. We never receive or store your card details.
- Amazon SES (transactional email) — receives your email address to deliver order confirmations, download links and refund notices. Stored in Mumbai (ap-south-1).
- Government / tax authorities — invoice data is retained per Indian GST law (6 years) and may be furnished to the GST department on lawful request.
- No marketing third parties. We do not sell, rent or trade personal data. We do not load Google Ads, Facebook Pixel, LinkedIn Insight, or any cross-site tracker on Audita.
5. Where data is stored
Order, customer and licence data is stored in a MySQL database on infrastructure located in India. Watermarked downloads are generated on-demand and not retained on disk after delivery. Email goes through Amazon SES Mumbai. Plausible counters are stored in EU (Plausible's hosting). We have not (yet) transferred personal data outside India for marketing or profiling purposes.
6. How long we keep it
- Order & invoice data: 6 years (Indian GST retention requirement)
- Customer records: for the life of the customer relationship, or 6 years after last activity, whichever is longer
- Licence keys & download log: 6 years
- Server access logs: 30 days
- Waitlist signups: until you unsubscribe or until launch, whichever comes first
7. Your rights
Under India's Digital Personal Data Protection Act 2023 (DPDP) and the EU GDPR, you can:
- Access — request a copy of the personal data we hold on you
- Correct — ask us to fix incorrect data
- Erase — ask us to delete your data (we are obliged to retain order/invoice records under tax law, but everything outside that scope will be erased)
- Withdraw consent — for any processing that relied on consent
- Lodge a complaint — with India's Data Protection Board or your home country's authority
To exercise any of these, email hello@audita.in. We aim to respond within 7 working days; DPDP requires response within 30 days at the outside.
8. Security
All traffic is HTTPS-only with HSTS. Customer-dashboard access is via signed, time-limited magic-link URLs — no passwords stored for buyers. Admin access is gated by a two-factor combination of database flag and email allowlist. Database backups are encrypted. Payment data never touches our servers.
9. Cookies
We use a single strictly-necessary session cookie when you're signed into the customer dashboard. No advertising cookies, no analytics cookies, no third-party cookies. Plausible Analytics runs without cookies. Because we do not set any non-essential cookies, no cookie-consent banner is required.
10. Children
Audita products are sold to organisations and adult professionals. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, write to hello@audita.in and we'll delete it.
11. Changes to this policy
If we materially change how we handle personal data we'll update this page and email existing customers. The "Last updated" date at the top of this page always reflects the current version.
12. Contact
Email: hello@audita.in
Postal: Audita, Chennai, India (full registered-office address will be added on company incorporation)