Privacy Policy

Your privacy matters to us. This Policy explains what personal data AuditFlow collects, why we collect it, how we protect it, and your rights under applicable Indian data protection law. By using AuditFlow, you consent to the practices described below.

1. Who We Are

AuditFlow ("we", "us", "our") is a product of MNB Research (operating as Abrobot Technologies), an Indian technology company. We are the data controller for personal data processed through AuditFlow.

2. Data We Collect

We collect the following categories of personal data:

3. How We Use Your Data

• Provide the service — Create and manage your account, run audits, generate reports, and power AI features.
• Process payments — Collect subscription fees via Cashfree Payments; send invoices and payment confirmations.
• Product communications — Send transactional emails (receipts, alerts, audit reminders, password resets).
• Improve the platform — Analyse aggregated usage patterns to fix bugs and build new features.
• Legal and compliance — Comply with applicable laws, respond to lawful requests from authorities, and resolve disputes.
• Security — Detect and prevent fraud, abuse, and unauthorised access.
• Marketing (opt-in only) — Send product updates or promotional emails only if you have explicitly opted in. You may unsubscribe at any time.
• Checkout reminders (opt-in only) — If you start paying for a plan and the payment does not complete, we may send at most two reminders about that checkout — by email, or by WhatsApp to the number you gave — but only if you ticked the matching box when you signed up. Every reminder email carries a link that stops them, and you can withdraw either choice from your profile at any time.
• Product analytics — Record a small set of named events about how the product is used (for example: signed in, finished onboarding, exported a workspace) against your account, so we can see where people get stuck. Section 9 explains what we record about visitors who have no account.

4. Legal Basis for Processing

We process your data on the following legal grounds:

• Contract — Processing necessary to fulfil your subscription agreement with us.
• Consent — Where you have given us explicit consent (e.g., marketing emails).
• Legitimate interest — Improving the platform, preventing fraud, and ensuring security. This is the basis for the product events we record about signed-in use of AuditFlow (section 3): they are first-party, limited to a fixed list of event names with no free text, and never shared or sold.
• Consent, specifically — The analytics cookie on our public website (section 9) and checkout reminders by email or WhatsApp (section 3). Each is off until you choose it, and each can be withdrawn.
• Legal obligation — Complying with Indian law, court orders, or regulatory requirements.

5. Payment Processing (Cashfree)

All payment transactions are processed by Cashfree Payments (Cashfree Payments India Private Limited), a PCI-DSS compliant payment gateway regulated by the Reserve Bank of India. When you make a payment:

• Your payment details (card number, CVV, UPI PIN, netbanking credentials) are entered directly on Cashfree's encrypted interface — AuditFlow never sees or stores these.
• We receive only a tokenised transaction reference, amount, and status.
• Cashfree's privacy policy governs how they handle your payment data: cashfree.com/privacy-policy

Refunds are processed through Cashfree back to your original payment method. See our Refund Policy for details.

6. Who We Share Data With

We do not sell your personal data. We share data only with trusted service providers as necessary to operate AuditFlow:

We may also disclose data to law enforcement or regulators when required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of AuditFlow, our users, or the public.

7. Data Retention

• Active account: We retain your data for as long as your account remains active. Within your account you set your own retention periods for audit records, activity logs and notifications, and a nightly job enforces them.
• Account deletion: Closing or abandoning an account does not start a deletion timer. Erasure happens when you ask for it. An org admin can file a deletion request for the whole workspace in the product, at Settings → Your data; you can also ask in writing at contact@mnbresearch.com, which is the route for an individual who is not an admin. Once a request is verified we delete or anonymise personal data within 30 days, except where we are required to retain it longer for legal, tax, or audit purposes.
• Product events: Kept for no longer than 400 days and then deleted by a nightly job. Deleting your account deletes the events recorded against it, and the anonymous website visits your own signup linked to it.
• Marketing choices: The record of what you agreed to receive, and when you withdrew it, is kept for as long as your account exists — it is what we would need to show that a message was one you asked for.
• Payment records: Transaction records are retained for 7 years as required under Indian accounting and GST regulations.
• Backup data: Data in encrypted backups may persist for up to 30 additional days after deletion.

8. Security

We implement industry-standard security measures including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest (via Supabase)
• Row-level security (RLS) ensuring tenants can only access their own data
• Multi-factor authentication support
• Regular security audits and vulnerability assessments
• Access controls and audit logs for all administrative actions

No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to contact@mnbresearch.com.

Breach notification

If we become aware of a personal data breach affecting your data, we will:

• Contain it and begin an investigation immediately on discovery.
• Notify the Data Protection Board of India where the law requires it, under section 8(6) of the Digital Personal Data Protection Act, 2023 and Rule 7 of the Digital Personal Data Protection Rules, 2025. The Rules were notified on 13 November 2025 and their breach-intimation rule applies from 13 May 2027; from then we will intimate the Board without delay and provide the detailed report within the period that rule sets.
• Notify you directly, by email to your account address and by a notice inside the product, without undue delay — we aim to do this within 72 hours of confirming that your data is affected.
• Tell you what happened, which categories of your data were involved, what we have done about it, and what we recommend you do. We will not wait until an investigation is complete to tell you that one is happening.
• Keep a record of the breach and of the notification, available to you and to the Board on request.

Our Grievance Officer (section 14) is the contact for anything arising from a breach notice.

9. Cookies & Tracking

AuditFlow uses the following cookies:

• Essential cookies: Session management and authentication (required for the platform to function).
• Preference cookies: Remembering your UI settings (e.g., dark mode, language), and remembering your answer to the analytics question below (af_consent, which holds only "granted" or "denied").
• One analytics cookie, only if you allow it: our public website asks before recording anything. If you choose "Allow analytics" we set af_anon, a first-party cookie holding a random identifier, and record which of our pages you opened (the home page, pricing, the signup form) against it. If you then create an account, that signup is linked to the identifier so we can tell which visits led to a signup. If you choose "No thanks", or do not answer, nothing about your visit is recorded.
• No third-party analytics and no advertising cookies. We do not load a third-party analytics script, we do not fingerprint your browser, and the identifier is never shared.

You can change your answer at any time with "Cookie choices" at the bottom of any page on this site. Withdrawing deletes the af_anon cookie, so later visits cannot be joined to earlier ones.

We do not use advertising cookies or sell your browsing data.

10. Your Rights

You have the following rights regarding your personal data:

To exercise any of these rights, email us at contact@mnbresearch.com. We will respond within 30 days.

11. Children's Privacy

AuditFlow is a B2B professional platform not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us immediately at contact@mnbresearch.com.

12. International Data Transfers

Your data is stored in India (Supabase ap-south-1 region). There is one database region and it is not selectable per organisation — if you have a residency requirement that ap-south-1 does not meet, raise it with us before you subscribe. Some service providers (e.g., Groq, xAI, Zen AI, Anthropic, Google) may process data in the United States or other countries. Where such transfers occur, we ensure appropriate safeguards are in place through data processing agreements that meet applicable legal requirements.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice within the platform at least 7 days before they take effect. Continued use of AuditFlow after the effective date constitutes acceptance of the updated Policy. The current version is always available at https://auditflow.mnbresearch.com/privacy.

14. Contact & Grievance Officer

For any privacy-related questions, requests, or complaints, contact our Grievance Officer: