Data Protection & Sovereignty

Privacy Policy & Customer Data Sovereignty

Last Updated: October 2026 • Applies to: Founders, Operators & End Customers

Core Privacy Principle: Because your SuperAudit AI platform is deployed directly onto your private cloud server, SuperAudit does not have access to your customer database, audit reports, or client transaction records. You retain 100% data sovereignty, full customer confidentiality, and complete technical isolation.

1. Information We Collect from Prospective Operators

When you inquire about purchasing a ready-to-launch software package on SuperAudit, we collect only necessary commercial scoping information:

Contact Information: Full name, professional work email address, and WhatsApp contact number.
Investment Scoping: Target pricing tier (e.g. Early Access $1,599 / ₹1,53,000) and desired launch timeline.
Custom Requirements: Any specific API preferences, domain suggestions, or bespoke agency features described during consultation.

We do not sell, rent, or trade your inquiry details to third-party data brokers or advertisers under any circumstances.

2. End-User Data Sovereignty (Your Customer Database)

Unlike shared multi-tenant SaaS providers who aggregate customer records into a centralized cloud database, SuperAudit operates on a decentralized private deployment model:

Private Database: Your customer database (Supabase/PostgreSQL/Docker) resides entirely inside your cloud infrastructure account.
Zero Telemetry Access: SuperAudit has no backdoors, telemetry sniffers, or ongoing surveillance hooks into your live application.
Client Audit Reports: PDFs generated by your clients are stored in your private cloud storage bucket and never routed through SuperAudit servers.

3. Server Credentials Handling During Deployment (Up to 30 Days)

During the customization and deployment process (which can take up to 30 days due to technical schedules), you grant temporary engineering access to your cloud server account (e.g. DigitalOcean, AWS, or VPS) and private API keys (AI providers, Payment Gateways). We follow strict security protocols:

All credentials are exchanged over encrypted communication channels under mutual non-disclosure obligations.
Upon formal handover and technical sign-off, you are guided to rotate your SSH keys, API tokens, and database passwords, fully severing our technical access.

4. Compliance with Privacy Regulations

Our software architecture is built to facilitate your compliance with major international data privacy standards:

India Digital Personal Data Protection (DPDP) Act 2023: Full data localization capability since your server can be provisioned in Mumbai/Bengaluru data centers.
GDPR (Europe): Built-in data export and account deletion endpoints for end-users.
PCI-DSS Compliance: All credit card numbers are handled via direct tokenization by Payment Gateways; payment data never touches your web server unencrypted.

5. Data Retention & Deletion Requests

Prospective founders may request immediate deletion of their consultation records from our scoping CRM at any time by contacting our deployment team. Your records will be permanently purged within 48 business hours.