Audit It

1. Introduction

This Privacy Policy explains how Audit It Limited ("Audit It", "we", "us" or "our") collects, uses, stores, shares and protects personal data in connection with our Software-as-a-Service platform (the "Platform"), our websites, and related services.

Audit It provides tools that enable marketing agencies and freelancers (our "Customers") to capture leads and generate automated marketing audits, including audits of advertising performance. This policy describes the personal data involved in those activities and the rights available to the individuals it relates to.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR) where applicable, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other applicable United States privacy laws where they apply to our processing.

Where a Customer or authorised user connects a Google account to the Platform, Section 6 (Google User Data and the Google Ads API) applies in addition to the rest of this policy.

2. About Audit It and the Platform

The Platform allows a Customer to build a branded contact form that captures the contact details of the Customer's prospects and, at the same time, runs an instant automated audit. Audit It offers four audit products: search engine optimisation (SEO), user experience (UX), web development and Google Ads performance audits.

The audit outputs are made available to the Customer to help them advise their own clients and prospects. Audits are generated automatically and are advisory only.

3. Data Protection Roles

Audit It's role under data protection law depends on the data in question:

• Controller – for Customer account data, billing data and security data that we determine the purposes and means of processing.
• Processor – for prospect data and advertising data, which we process only on the documented instructions of the Customer.

Customers act as controllers of the prospect data and advertising data they collect and connect through the Platform, and are responsible for the lawful collection and use of that data, including providing any required notices and obtaining any required consents.

4. Categories of Data We Collect

We collect and process the following categories of data:

We do not store full payment card details. Card payments for the Platform are processed by a third-party payment processor, and we do not access the payment or financial account information held in a connected advertising account.

5. How We Use Personal Data

We use personal data to:

• provide the Platform and generate audit reports requested by Customers and their users;
• deliver insights and outputs to Customers;
• administer accounts, process billing and provide customer support;
• maintain, secure, monitor and improve the Platform and prevent fraud and abuse;
• communicate with Customers about the service and, where permitted, about related offerings; and
• comply with our legal and regulatory obligations.

6. Google User Data and the Google Ads API

6.1 Overview

This section explains how Audit It accesses, uses, stores, shares and deletes data obtained through Google APIs, including the Google Ads API, and how that handling complies with the Google API Services User Data Policy. It applies whenever a Customer or authorised account owner connects a Google account to the Platform.

6.2 Data we access

With the user's authorisation, and using read-only access only, Audit It may access the following categories of Google Ads data:

• campaign identifiers and structure;
• ad groups, ads and ad creative data;
• performance metrics, such as impressions, clicks, click-through rate (CTR), conversions, cost data and return on ad spend (ROAS); and
• campaign configuration settings, such as bidding strategies and targeting parameters.

6.3 How we access it

Audit It accesses Google Ads data only through Google's secure OAuth 2.0 authorisation framework, and only after the user has explicitly granted access. We request the minimum scopes necessary to provide the audit, and we request access in context. Audit It uses strictly read-only access and does not create, edit, modify or publish campaigns, budgets, advertisements or account settings, and does not access billing, payment or financial account information held in the connected Google account.

6.4 How we use it

Data obtained through the Google Ads API is used solely to generate the automated audit reports that the user has requested, in order to help advertisers understand and improve their advertising performance. It is not used for any other purpose.

6.5 Limited Use commitment

The following statement is the central commitment governing our handling of Google user data:

Consistent with those Limited Use requirements, Audit It affirms that information received from Google APIs is not:

• used or transferred for serving advertising, including retargeting, personalised or interest-based advertising;
• used or transferred to determine creditworthiness or for lending purposes;
• sold, or transferred to data brokers, information resellers or other information service providers;
• used to train, fine-tune or improve generalised or non-personalised artificial intelligence (AI) or machine-learning (ML) models, nor transferred for such purposes; or
• read by any human, except: (a) with the user's explicit prior consent for specific data; (b) where necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymised and is used for internal operations in accordance with applicable law.

Audit It does not aggregate Google Ads data across customers and does not use it to build any independent profile of, or commercial relationship with, the connected advertiser. We process advertising data strictly on behalf of the Customer and the authorised account owner.

6.6 Storage and retention

Raw Google Ads data is processed transiently for the sole purpose of generating the requested audit and is not retained beyond what is necessary to produce that audit. Only the resulting audit report and minimal operational logs are retained (see Section 11). OAuth tokens are encrypted, access-controlled and automatically deleted within 24 hours.

6.7 Sharing

Google user data is made available only to the authorised advertising account owner and to the Customer (form owner) who requested the audit, and solely for that purpose. It is not disclosed to any other third party, except to subprocessors that are strictly required to host, secure or deliver the service and that are bound by contractual confidentiality and data-protection obligations consistent with this policy and with Google's requirements.

Customers and authorised account owners may export an audit report, including a report containing Google Ads data, as a PDF document. Exports are available only to those same authorised recipients, only from within their authenticated Audit It account, and are delivered over encrypted (HTTPS) connections. We do not provide public or unauthenticated links to audit reports.

6.8 Revoking access and deleting your data

You may revoke Audit It's access to your Google account at any time:

• by disconnecting the Google integration within the Audit It platform;
• by removing Audit It's access in your Google Account security settings at https://myaccount.google.com/permissions; or
• by contacting us at contact@auditit.io.

On revocation, Audit It stops accessing the relevant Google data and any associated OAuth tokens are deleted. You may also request deletion of audit reports generated from your Google data by contacting us.

7. Lawful Bases for Processing (UK/EU)

Where the UK GDPR or EU GDPR applies, we rely on the following lawful bases:

8. Automated Processing

Audit reports are generated automatically. They are advisory only and are intended to support human decision-making. They do not produce legal or similarly significant effects on individuals, and we do not use them to make solely automated decisions of that kind within the meaning of Article 22 of the UK/EU GDPR.

9. Data Sharing and Subprocessors

We share personal data only where necessary, and only with:

• subprocessors that provide services such as cloud infrastructure and hosting, security and monitoring, analytics, payment processing and communications;
• the authorised account owner and the Customer who requested an audit, in respect of that audit; and
• competent authorities, regulators or advisers where required by law or to protect our rights.

All subprocessors are engaged under written data processing agreements that require them to protect personal data, keep it confidential and process it only in accordance with our instructions. We do not sell personal data. Our current subprocessors are:

We will update this list when our subprocessors change. Google Ads is not a subprocessor: it is the advertising platform whose data our users choose to connect for audits, and our handling of that data is described in Section 6.

Cloudflare Turnstile recipient

10. International Data Transfers

The Platform is hosted in the United States by Replit, Inc., and some of our other subprocessors listed in Section 9 also process personal data in the United States. This means that personal data we handle, including data processed on behalf of our Customers, is transferred outside the United Kingdom and the European Economic Area.

Where we transfer personal data internationally, we rely on appropriate safeguards: the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it; otherwise, the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, supplemented by additional measures where appropriate. Transfers to jurisdictions covered by UK adequacy regulations (such as the European Economic Area, which covers our Zoho EU email hosting) do not require additional safeguards. Further information about the safeguards we use is available on request.

11. Data Retention

We apply data-minimisation and retention principles and keep personal data only for as long as necessary for the purposes set out in this policy:

12. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption of data in transit and at rest, access controls and least-privilege principles, secure handling and short-lived storage of OAuth tokens, and logging and monitoring of our systems. While no system can be guaranteed to be completely secure, we take reasonable and appropriate steps to protect the data we hold.

13. Data Breach Notification

If a personal data breach occurs, we will assess it and, where required, notify the relevant supervisory authority and affected Customers without undue delay and in accordance with applicable law. Where we act as a processor, we will notify the relevant Customer (controller) so that they can meet their own notification obligations.

14. Your Rights (UK/EU)

Subject to applicable law, individuals in the UK and EEA have the right to: access their personal data; request rectification of inaccurate data; request erasure; restrict or object to processing; data portability; and, where processing is based on consent, withdraw that consent at any time. Where we act as a processor, we will refer requests to the relevant Customer and assist them in responding. To exercise your rights, contact us using the details in Section 20.

To request access to or deletion of your personal data, email contact@auditit.io and describe your request. We may ask for proportionate information to verify your identity. We normally respond within one calendar month; where the law permits an extension for a complex or multiple request, we will explain the extension and reasons within that first month. Rights are subject to applicable legal exceptions, including necessary financial or legal record retention. Where an agency controls prospect data, we will direct the request to that agency and assist it as required. You may complain to the UK Information Commissioner's Office (ICO), including at ico.org.uk, without first having to complain to us.

15. Your Rights (United States / California)

Where the CCPA/CPRA or comparable US state privacy laws apply, eligible individuals have the right to know about and access the personal information we hold, to request its deletion, to request correction, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we will not discriminate against you for exercising your rights. You may submit a request, including through an authorised agent, using the details in Section 20.

16. Cookies and Similar Technologies

We use cookies and similar technologies, including Google Analytics 4, for analytics and to maintain and improve the performance of the Platform. Where required, we obtain consent for non-essential cookies, and you can manage your preferences through your browser settings or any cookie controls we make available.

17. Children's Privacy

The Platform is intended for use by marketing agencies and freelancers acting in a professional capacity. It is not directed to, or intended for use by, individuals under the age of 18, and we do not knowingly collect personal data from children.

18. Customer Responsibilities

As controllers of the prospect and advertising data they collect and connect through the Platform, Customers are responsible for establishing a lawful basis for that processing, providing any required privacy notices to their prospects, obtaining any necessary consents, and otherwise complying with applicable data protection laws. This includes any audit report a Customer exports from the Platform: exported copies are held outside our systems and are the Customer's responsibility as controller.

19. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the effective date above and, where the changes are material, we will take reasonable steps to notify Customers. If we plan to access or use a type of Google user data not previously disclosed, we will update this policy and obtain any further consent required before doing so.

20. How to Contact Us and Complaints

Data controller: Audit It Limited (Company No. 17258971), 19A Singleton Court, Wonnastow Road, Monmouth, NP25 5JA, United Kingdom.

Email: contact@auditit.io.

If you are in the UK or EEA and have a concern about how we handle your personal data, you have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO):

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — https://ico.org.uk — helpline 0303 123 1113.

Agency trials, eligibility and abuse prevention

When an agency owner starts a trial, we process information needed to administer the offer and prevent repeated or abusive trials. This includes pseudonymous keyed hashes derived from the owner's email, Stripe card fingerprint, billing identity, IP address and trial device identifier, together with the trial's status, payment-provider references, eligibility outcomes and audited website claim. Hashing does not make this information anonymous.

When an owner first uses a trial audit, we normalize its registrable website domain and store the trial website claim only as a keyed hash, not as the plain domain. The trial debit and related domain-refusal event also use that hash. This minimisation concerns trial anti-abuse records, not the website URLs needed for requested audit reports or agency CRM records. Hashes remain personal data where linkable; they are not anonymous. Stripe processes the card details and supplies a card fingerprint and funding classification; Audit It Limited does not store the full card number. Prepaid cards are not eligible. Credit/debit cards must also satisfy the identity and verification checks. IP signals alone do not refuse a trial.

Proposed lawful bases: performance of the trial/service contract for trial administration, and legitimate interests in preventing repeat-trial abuse, fraud and misuse for proportionate eligibility checks. These are proposals for review, not a completed legitimate-interests assessment or a finding that consent is unnecessary for every technology.

We may refuse or hold a trial automatically where eligibility checks identify a previously used identity or website, an ineligible funding type, a repeated device, or where necessary payment/identity evidence cannot be verified. Human review is available: email contact@auditit.io to request an explanation, correction or review of a refusal. We will respond within 5 working days. An IP match alone does not refuse a trial. Human review does not guarantee eligibility or override payment-provider security checks or applicable legal requirements.

Retention and sharing

The trial-device cookie expires after 35 days. Trial attempts and trial IP/device hashes are retained for up to 35 days under the cleanup policy; review-event records for up to 90 days; anti-abuse email/card/billing-identity claims, hashed website claims and trial debit records for up to 12 months. Anti-abuse email/business hashes remaining in trial records are erased under that 12-month policy. Normal account, invoice, tax and lifecycle records have separate retention obligations described in the existing policy; this window does not shorten necessary financial or legal records. The same card or domain may no longer be excluded by these claims after 12 months, subject to other eligibility checks. Cleanup depends on successful processing; operational monitoring and the justification for each maximum period require reviewer/owner confirmation.

Stripe receives payment and billing information as described in its role and privacy documentation. Existing email and hosting providers receive data needed to operate the trial and transactional messages. Existing international-transfer, rights and contact provisions continue to apply, subject to review for accuracy.

Cloudflare Turnstile (trial-start step only)

We use Cloudflare Turnstile on the explicit trial-start step to help tell genuine trial requests apart from automated abuse, such as bots creating fake or bulk trials. When trials are enabled, the check loads when you enter that step, before you submit it. It is not used on normal account registration, paid checkout or customer audit embeds. Normal account registration uses our maths security question. Most people will not need to do anything, but you may occasionally be asked to complete a simple check.

When that step loads, Cloudflare processes technical information about your device, browser and connection. This includes, for example, your IP address, TLS fingerprint (characteristics of your connection), User-Agent (browser information) and the identity of the website and widget being used. Cloudflare gives us a pass or fail result, which we use to decide whether to accept the trial request. We do not persist the verification token. Trial security-review records can include that the check passed and the event time; review records older than 90 days are deleted when trial housekeeping runs. The checkout route does not persist failed verification results.

Cloudflare acts in two roles:

As our processor, it processes this information on our behalf and on our instructions to protect trial requests. We rely on our legitimate interests in protecting our service from automated abuse, fake accounts and fraud. You have the right to object (see Your rights).

As an independent controller, it uses the same information to improve its bot detection. Cloudflare is responsible for that processing. See its Turnstile Privacy Addendum and Privacy Policy.

Cloudflare, Inc. is based in the United States, so this information may be processed there. When we transfer personal data to Cloudflare as our processor, it is protected by the UK Extension to the EU-US Data Privacy Framework or, as a fallback, the UK International Data Transfer Addendum to the Standard Contractual Clauses in Cloudflare's Data Processing Addendum. For Cloudflare's own retention and processing locations, see its Privacy Policy.

If you cannot complete the check, contact us at contact@auditit.io and we will help you set up your trial. Contacting us does not bypass eligibility, billing or security requirements.

Version 1.1; effective 2026-11-03.

Change log: UK/USA business-only supply; no VAT charged; same USD price with a maximum-charge promise; updated privacy and trial wording.