Privacy Policy

Your privacy matters to us. This Policy explains what personal data AuditFlow collects, why we collect it, how we protect it, and your rights under applicable Indian data protection law. By using AuditFlow, you consent to the practices described below.

1. Who We Are

AuditFlow ("we", "us", "our") is a product of MNB Research (operating as Abrobot Technologies), an Indian technology company. We are the data controller for personal data processed through AuditFlow.

2. Data We Collect

We collect the following categories of personal data:

3. How We Use Your Data

• Provide the service — Create and manage your account, run audits, generate reports, and power AI features.
• Process payments — Collect subscription fees via Cashfree Payments; send invoices and payment confirmations.
• Product communications — Send transactional emails (receipts, alerts, audit reminders, password resets).
• Improve the platform — Analyse aggregated usage patterns to fix bugs and build new features.
• Legal and compliance — Comply with applicable laws, respond to lawful requests from authorities, and resolve disputes.
• Security — Detect and prevent fraud, abuse, and unauthorised access.
• Marketing (opt-in only) — Send product updates or promotional emails only if you have explicitly opted in. You may unsubscribe at any time.

4. Legal Basis for Processing

We process your data on the following legal grounds:

• Contract — Processing necessary to fulfil your subscription agreement with us.
• Consent — Where you have given us explicit consent (e.g., marketing emails).
• Legitimate interest — Improving the platform, preventing fraud, and ensuring security.
• Legal obligation — Complying with Indian law, court orders, or regulatory requirements.

5. Payment Processing (Cashfree)

All payment transactions are processed by Cashfree Payments (Cashfree Payments India Private Limited), a PCI-DSS compliant payment gateway regulated by the Reserve Bank of India. When you make a payment:

• Your payment details (card number, CVV, UPI PIN, netbanking credentials) are entered directly on Cashfree's encrypted interface — AuditFlow never sees or stores these.
• We receive only a tokenised transaction reference, amount, and status.
• Cashfree's privacy policy governs how they handle your payment data: cashfree.com/privacy-policy

Refunds are processed through Cashfree back to your original payment method. See our Refund Policy for details.

6. Who We Share Data With

We do not sell your personal data. We share data only with trusted service providers as necessary to operate AuditFlow:

We may also disclose data to law enforcement or regulators when required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of AuditFlow, our users, or the public.

7. Data Retention

• Active account: We retain your data for as long as your account remains active. Within your account you set your own retention periods for audit records, activity logs and notifications, and a nightly job enforces them.
• Account deletion: Closing or abandoning an account does not start a deletion timer. Erasure happens when you ask for it: on a verified written request we delete or anonymise personal data within 30 days, except where we are required to retain it longer for legal, tax, or audit purposes.
• Payment records: Transaction records are retained for 7 years as required under Indian accounting and GST regulations.
• Backup data: Data in encrypted backups may persist for up to 30 additional days after deletion.

8. Security

We implement industry-standard security measures including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest (via Supabase)
• Row-level security (RLS) ensuring tenants can only access their own data
• Multi-factor authentication support
• Regular security audits and vulnerability assessments
• Access controls and audit logs for all administrative actions

No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to contact@mnbresearch.com.

9. Cookies & Tracking

AuditFlow uses the following cookies:

• Essential cookies: Session management and authentication (required for the platform to function).
• Preference cookies: Remembering your UI settings (e.g., dark mode, language).
• Analytics cookies: Aggregated, anonymised usage data to improve the platform. No personal data is sent to third-party analytics providers.

We do not use advertising cookies or sell your browsing data.

10. Your Rights

You have the following rights regarding your personal data:

To exercise any of these rights, email us at contact@mnbresearch.com. We will respond within 30 days.

11. Children's Privacy

AuditFlow is a B2B professional platform not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us immediately at contact@mnbresearch.com.

12. International Data Transfers

Your data is stored in India (Supabase ap-south-1 region). There is one database region and it is not selectable per organisation — if you have a residency requirement that ap-south-1 does not meet, raise it with us before you subscribe. Some service providers (e.g., Zen AI, Anthropic, Google) may process data in the United States or other countries. Where such transfers occur, we ensure appropriate safeguards are in place through data processing agreements that meet applicable legal requirements.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice within the platform at least 7 days before they take effect. Continued use of AuditFlow after the effective date constitutes acceptance of the updated Policy. The current version is always available at https://auditflow.mnbresearch.com/privacy.

14. Contact & Grievance Officer

For any privacy-related questions, requests, or complaints, contact our Grievance Officer: