Privacy Policy

When you complete an AI maturity audit, we only collect data strictly necessary to produce your personalised report:

• Professional identity: first name, last name, job title, department (if applicable).
• Professional email: used to send your report and prevent duplicate audits.
• Organisation: company name, business type, team size.
• Questionnaire answers: scores on the 10 AI maturity axes, self-assessment, qualitative feedback.

We do not collect any banking data, internal documents, or sensitive information (health, political opinions, religion, sexual orientation).

Your data is used for two exclusive purposes, depending on the audit context:

A. Individual audit (you initiate the audit)

• Generation of your personalised audit report.
• Computation of your AI maturity score and sector benchmarking.
• Actionable recommendations and ROI estimates.
• Delivery of the report to your professional email address.

B. Organisational audit (you are attached to an organisation)

If you access the audit via a link provided by your organisation (URL with ?org=... parameter), your individual report remains personal but your data will also be:

• Aggregated in your organisation's dashboard to enable collective analysis.
• Visible to authorised administrators of that organisation (executives, HR, transformation team).
• Used to compute collective indicators: average score, potential ROI, priority improvement areas.

Your individual answers may be identifiable in the organisation's dashboard. No sharing occurs with third parties outside the organisation.

Processing of your data is based on:

• Your explicit consent (checkbox before submission) — GDPR articles 6.1.a and 7.
• The legitimate interest of your organisation when you participate in a collective audit commissioned by your employer — GDPR article 6.1.f.

You can withdraw your consent at any time by contacting us (see section 8).

• Individual audits: 24 months from the audit date, then automatic deletion.
• Organisational audits: duration of the contract with the client organisation, plus 12 months for archival.
• Hashed email (anti-fraud): 12 months to limit duplicate audits.

You may request earlier deletion at any time.

Your data is hosted on Vercel servers (EU regions) and Google Cloud Firestore (europe-west1 region).

We apply the following technical and organisational measures:

• TLS 1.3 encryption in transit.
• AES-256 encryption at rest.
• Restricted access via strong authentication for our team.
• SHA-256 hashing of emails for anti-fraud deduplication.
• Audit logs retained for 30 days.

We never sell your data.

Your data is only shared with:

• Yourself (your audit report sent by email).
• Your organisation if you participate in an organisational audit (see section 2).
• Our technical subcontractors strictly necessary for the service: Vercel (hosting), Google Firestore (database), Resend (email delivery). All are bound by GDPR-compliant confidentiality agreements.

No data is transferred outside the EU without appropriate safeguards (standard contractual clauses).

Under GDPR, you have the following rights:

• Right of access: obtain a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure: request deletion of your data.
• Right to portability: retrieve your data in a structured format.
• Right to object: oppose processing.
• Right to restriction: restrict certain processing activities.
• Right to lodge a complaint: file a complaint with the CNIL (www.cnil.fr).

To exercise your rights or for any question regarding the processing of your data:

• Email: privacy@auto-audit-ia.com
• Postal address: DPO — Auto-Audit IA, 12 rue de la Paix, 75002 Paris, France.

We commit to responding within 30 days maximum.

This policy may be updated to reflect changes in the service or regulations. The last update date appears at the top of this page. Substantial changes will be notified to you by email when you hold an active account.