Legal
Privacy notice.
This notice describes what AuditSahi collects, why, how long it is kept, who sees it and the rights you have. It is written to be read, and it describes what the product does today.
Who we are
AuditSahi is operated by O Square Technologies, a sole proprietorship, of R 121, Phase 8B, Industrial Focal Point, Mohali, SAS Nagar, Punjab 160071. For anything in this notice, write to support@auditsahi.com. Under the Digital Personal Data Protection Act, 2023 we are the data fiduciary for the personal data described here.
What we collect and why
| What | Why | Basis |
|---|---|---|
| Your name, work email and phone number | To create your account, let you sign in and reach you about the service. | Your consent when you sign up, and performing the service you asked for. |
| Your password | To let you sign in. It is stored only as a salted scrypt hash. We cannot read it. | Performing the service. |
| A session cookie named cy_session | To keep you signed in. It is a random token, marked HttpOnly and SameSite, and it expires 30 days after sign-in, after 7 days without use, or when you sign out. Only its fingerprint (a one-way hash) is stored on our server. | Strictly necessary for the service. |
| A cookie named cy_client, only on a client link | When someone opens a link an adviser sent them and enters the code we email, this keeps that browser trusted for that link for one day. It is set only on those link pages. These are the only two cookies we set. | Strictly necessary for the link to work. |
| People named by our customers | An adviser can send a client contact a link to answer questions and upload documents, and an organisation can ask its staff to accept a policy. We keep each person's name and email, what they sent or accepted and when, and for a client link the internet address each visit came from, so the organisation can show an auditor who did what. The organisation that named them decides why; we process it for them. | Performing the service for the organisation that named them. |
| What you tell us about your organisation | Its type, licences, size, state and the people you name as owners of duties, so the rules engine can work out what applies and who is responsible. | Performing the service. |
| Documents you upload | To read them against your obligations. We extract the text and keep the text with its verdicts. The uploaded file itself is deleted from our server as soon as the text has been extracted. | Performing the service. |
| An enquiry about a paid plan | Your name, organisation, email, phone, the plan and anything you write, so we can reply or call you back. Kept for two years, or deleted sooner if you ask. | Your request, by sending the form. |
| Your newsletter address, if you subscribe | To send you a short email when a rulebook changes. Nothing else is sent to it. | Your consent, given by ticking the box. You can withdraw it with the unsubscribe link in any email. |
| Service records | A log of actions in the product (for example that a document was uploaded or a policy approved) and of errors, so we can run the service and answer an auditor's question about what happened when. | Performing the service and our legitimate interest in running it. |
We do not use analytics or advertising trackers on the site or in the product. We do not buy data about you or combine it with data from elsewhere.
Documents and the people named in them
Documents you upload may contain personal data about other people, such as the names of directors, officers or staff in a policy or in Board minutes. You are the data fiduciary for that data and we process it as your data processor, on your instructions, for the purpose of reading the document against your obligations. Please upload only what the audit needs.
How documents are read
AuditSahi reads documents with two independent AI models: GPT OSS 120B, made by OpenAI, and Mistral Large 3, made by Mistral AI. Both run on Amazon Bedrock in Amazon Web Services' Mumbai region, and your organisation's text is processed there and nowhere else. The product enforces this: a request to send your organisation's text to a model outside India is refused.
The companies that make the models never see your text. On Amazon Bedrock the models run in accounts Amazon controls, and the model makers have no access to the requests or the answers. Our Amazon account is set to keep nothing: no request or answer is written to storage by Amazon or shared with the model maker. The fictional organisations in the demo are read in the same way.
The results of each reading are kept with your organisation only. Every verdict shows the line in your document it rests on, where the two models disagree a person decides, and a person in your organisation can overrule any verdict. If we change the models or where they run, this notice will say so before the change applies to your organisation.
Where your data lives
Our server is in Mumbai, India. Account details, organisation profiles, extracted document text, verdicts, approvals and service records are stored there. Every night at 02:30 IST the database is copied, compressed and encrypted, and the last 30 copies are kept on the same server in Mumbai. The encryption key is kept in a separate file, and we are moving it off this server so that a copy on its own cannot be read. Something deleted in the product can remain in these copies until they roll off, at most 30 days later. We do not yet keep a copy anywhere else; when we do, it will be in India and this notice will say where.
When you visit the site or the product, your browser fetches the typefaces from Google Fonts, which means Google receives your IP address and the page address as part of that request. We do not send Google anything else.
Who we share it with
- Amazon Web Services, which runs the two AI models in Mumbai as described above and keeps none of the text. The model makers, OpenAI and Mistral AI, receive nothing.
- Our hosting provider, which operates the server in Mumbai, under contract.
- Google, only to the extent your browser fetches typefaces as described above.
- The mail service that delivers the newsletter and notices to account holders, which receives your email address and the message: Hostinger, our email provider. Hostinger does not publish where its email service stores mail, so we do not claim that mail is processed only in India. We use it for the code that confirms your email address at sign-up, notices about your account and, if you subscribed, the newsletter.
- O Square Technologies staff with administrator access, who can see accounts and organisations in order to run the service and answer questions about it.
- Nobody else sees your organisations. The three fictional sample organisations are shown to anyone who opens the demo; the organisations you create are visible to you and to administrators.
- A regulator, court or authority where the law requires it.
We do not sell personal data and we do not share it for advertising.
How long we keep it
- Account details: for as long as the account exists. When you delete the account they are removed at once, as described below.
- Session cookies: 30 days after sign-in, 7 days without use, or until you sign out.
- Organisation data, extracted document text and verdicts: until you delete the document or the organisation in the product, or ask us to delete the account.
- Newsletter addresses: until you unsubscribe.
- Service and error records: one year, then deleted.
Your rights
The DPDP Act gives you these rights, and we honour them whether or not the relevant section is yet in force.
- Access. You may ask for a summary of the personal data we hold about you and who it has been shared with.
- Correction and erasure. You may ask us to correct, complete, update or erase your personal data. You can delete a document, an organisation or your whole account yourself in the product. Deleting the account, from the Account page, removes it at once together with every organisation you created and everything in them, the emails we sent about them, any feedback you wrote, and the service records that name you. Encrypted backup copies roll off within 30 days. We keep a record of the clients an adviser had during the current plan year, because it is what the invoice is made from. You can also ask us by email to support@auditsahi.com.
- Withdrawing consent. You may withdraw consent for the newsletter at any time with the link in any email, and for the account by deleting it.
- Grievance. You may raise a grievance with our grievance officer, Kunal Sarin, at kunal.sarin@osquare.tech. We respond within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
- Nomination. You may nominate a person to exercise these rights on your behalf if you die or become unable to act.
Children
AuditSahi is a service for businesses and their advisers. It is not directed at children and we do not knowingly collect personal data from anyone under eighteen.
Changes to this notice
When this notice changes, the date at the top changes and the previous version is available on request. Material changes, such as a change in where documents are read, will be told to account holders by email.