Privacy Policy

AuditPulse is an AI compliance diagnostic service operated from Australia. We produce structured compliance reports that map an organisation's AI systems against the EU AI Act, NIST AI RMF, ISO 42001, and SOC 2. This policy explains what we collect when you use the service and what we do with it.

• •Assessment answers. The responses you give to the diagnostic questions about your AI systems, data handling, and governance practices.
• •Contact details. Your email address, and where you provide them, your name and company name, so we can deliver your report.
• •Payment information. Processed entirely by Stripe. We never see or store your full card number.
• •Usage data. Standard analytics such as pages viewed and approximate location, collected only where you have accepted analytics cookies.

We use your assessment answers to generate your compliance report, and your email address to deliver it and to respond if you contact us. We also use assessment answers in anonymised, aggregated form to build sector benchmarks, so we can show how a given score compares with similar organisations. Those benchmarks contain no company or contact details. We use aggregated, non-identifying usage data to understand which parts of the service are useful. We do not sell your information, and we do not use your assessment answers to train any AI model.

We rely on a small number of service providers. Each processes information only to deliver the service:

• •Stripe. Payment processing. Stripe receives your payment details directly and handles them under its own privacy terms.
• •Supabase. Database storage for your submission record and report metadata.
• •Resend. Transactional email delivery, used to send your report and receipts.
• •Anthropic. The Claude API generates the analysis in your report from your assessment answers. Anthropic processes this content to return a result and does not use it to train models.
• •Vercel. Hosting and delivery of the website and application.
• •Google Analytics. Website analytics, loaded only after you accept analytics cookies.

We operate from Australia, and several of the providers above store or process information in the United States and the European Union. Where information leaves Australia, we rely on the contractual protections offered by those providers. If you are in the EU or the UK, you retain the rights available to you under the GDPR regardless of where processing occurs.

Assessment answers and reports are stored securely for as long as needed to provide the service and to meet our record keeping obligations, after which they are deleted or anonymised. Anonymised benchmark records contain no contact details and may be retained indefinitely. Contact details are kept only for service delivery and are never sold or shared. If you ask us to delete your data, we will do so unless we are required to keep a record of the transaction.

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Email damon@getauditpulse.io and we will respond within a reasonable period. If you are in Australia and you are not satisfied with our response, you can refer the matter to the Office of the Australian Information Commissioner.

We use a small number of cookies. Some are necessary to operate the site. Analytics cookies load only after you accept them through the consent banner, and you can decline without losing access to any part of the service.

Information is transmitted over encrypted connections and stored with providers that offer encryption at rest. No system is perfectly secure, but we limit who can access your information and keep that access to what is needed to run the service.

Questions about this policy can be sent to damon@getauditpulse.io.