{"data":{"id":"privacy","title":"Privacy Policy","version":"0.9.0-draft","hash":"24f767f4e429d55a8f676446e484b85297ed434e0763ef3067890f208460da6d","status":"Draft — pending qualified counsel review","markdown":"---\ntitle: Privacy Policy\ndocument_id: privacy\nversion: 0.9.0-draft\neffective_date: \"[[LEGAL_REVIEW_REQUIRED: effective date set at launch]]\"\nstatus: \"Draft — pending qualified counsel review\"\noperator: Audon Software LLC\nproduct: Audon\n---\n\n# Audon — Privacy Policy\n\n> **Drafting note (remove before publication):** This draft is based on the data map in `docs/PRIVACY_DATA_MAP.md`. It must be re-checked against that map before every release. It is not legal advice.\n\nThis Privacy Policy explains how **Audon Software LLC** [[LEGAL_REVIEW_REQUIRED: confirm legal name as shown on the Delaware certificate of formation]], a Delaware limited liability company, United States (\"**Audon**\", \"**we**\", \"**us**\") handles personal data in connection with the Audon service, website, API and MCP server (the \"**Services**\"). \"Audon\" is the product name used by Audon Software LLC; it is not a separate company.\n\nThe Services are a business-to-business tool for auditing and monitoring AI provider spend. They are not intended for consumers or for anyone under 18.\n\n---\n\n## 1. Who is responsible for your data\n\n**1.1 Audon as controller.** We are the controller (in UAE terms, the \"controller\"; in US state-law terms, the \"business\") for personal data we process for our own purposes: creating and securing accounts, managing organizations and roles, billing, legal acceptance records, support, security and fraud prevention, and service communications.\n\n**1.2 Audon as processor.** When we process Customer Data on behalf of a customer organization — mainly usage and cost reports retrieved from the customer's AI providers and Telemetry the customer chooses to submit — we act as a **processor** (or \"service provider\") for that customer, under our Data Processing Addendum (document id `dpa`). That customer is the controller. If your personal data appears in that data (for example, because an API key is named after you), please contact the customer organization first; we will assist them in responding.\n\n**1.3 Contact.**\n\n- Privacy contact: [[LEGAL_REVIEW_REQUIRED: privacy contact email]]\n- Postal address: [[LEGAL_REVIEW_REQUIRED: registered agent address in Delaware; placeholder in use]]\n\nWe have not appointed a data protection officer, and we have not appointed a representative in the United Kingdom or the European Union. [[LEGAL_REVIEW_REQUIRED: whether a UK/EU Article 27 representative, DPO or ICO registration is required]]\n\n---\n\n## 2. What personal data we process, and where it comes from\n\nWe collect only what the Services need. The table below describes every category we currently process.\n\n| Category | Examples | Source | Our role |\n|---|---|---|---|\n| Identity and contact | Name, business email address, and, if you signed up from one of our campaign pages, which page and campaign (utm_* parameters only) | You, or a colleague who invites you | Controller |\n| Authentication | Password hash (scrypt; we never store your password in plain text), session records (hashed session token, user agent, expiry of 14 days) | You and your browser | Controller |\n| Phone number for a setup call (optional) | The phone number you choose to enter during onboarding and when you gave it | You, in onboarding | Controller |\n| Organization and role | Organization name and details, membership, role (owner, admin, analyst, billing_admin, read_only), invitations | You and your organization's administrators | Controller |\n| Audon API keys and Agent connections | Key metadata (name, scopes, creation and last-use time; the key itself is stored only as a hash), OAuth/MCP Agent connection records (client, scopes, authorizing user) | You | Controller |\n| Activity and audit log | Actor (user or Agent and authorizing user), action, channel (web, API, MCP), request identifier, timestamp, tamper-evident hash chain | Generated by the Services | Controller |\n| Legal acceptance and consent records | Document id, version and hash; accepting user or Agent; timestamp; context; authority statement; consent choices (such as marketing email preferences) | You | Controller |\n| Notification preferences | Which alerts and emails you want (including the optional weekly review email, off by default), and to which addresses | You | Controller |\n| Billing | Plan, subscription status, period end, Stripe customer and subscription identifiers, billing contact | You and Stripe | Controller |\n| Support | Content of emails you send us and our replies | You | Controller |\n| Savings estimate and contact requests | Business email, optional name and company name, the answers you gave the public savings calculator (providers, monthly spend range, workload type, practices, optional user count) and the estimate shown, or what you entered in the contact form (company size, optional monthly AI spend range and your message), campaign parameters (utm_* only) and whether you asked for product updates | You, on /estimate or /contact | Controller |\n| Provider usage and cost data | Daily aggregated cost and token usage by project or workspace, model, line item and provider API key identifier. These may include names a customer has given to projects or keys, which can sometimes identify a person. | The customer's OpenAI or Anthropic account, via the admin key the customer supplies | Processor |\n| Encrypted provider credentials | OpenAI Organization Admin API keys, Anthropic Admin API keys (envelope-encrypted; never displayed back) | The customer | Processor |\n| Telemetry (optional) | Run ids, workflow ids, status, verification type, estimated cost, token counts, retry and tool-call counts, up to 20 operational metadata keys | The customer's systems, via the API | Processor |\n\n**What we do not collect.**\n\n- We do **not** read prompts, model responses, files or end-user data through the provider connectors. We read only aggregated cost and usage reports.\n- The Telemetry API **rejects** metadata keys that suggest prompts, content, personal data or secrets. Raw prompt capture is not offered.\n- We do not receive or store payment card numbers; these are entered only on Stripe-hosted pages.\n- We do not use analytics, advertising, tracking pixels or session-replay tools.\n- We do not knowingly collect special categories of personal data (sensitive personal data).\n\n---\n\n## 3. Why we use personal data, and our legal bases\n\nWhere the UK GDPR or EU GDPR applies, we rely on the legal bases below. Where the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the \"**UAE PDPL**\") or the Saudi Personal Data Protection Law (the \"**Saudi PDPL**\") applies, we rely on the corresponding grounds available under those laws, which include performance of a contract, compliance with legal obligations and, where applicable, consent. [[LEGAL_REVIEW_REQUIRED: confirm lawful-basis mapping under UAE PDPL and Saudi PDPL]]\n\n| Purpose | Data used | Legal basis (UK/EU GDPR) |\n|---|---|---|\n| Create and operate your account; authenticate you; keep you signed in | Identity, authentication, organization and role | Performance of a contract with you or your organization; legitimate interests in providing a secure B2B service to your organization |\n| Provide the Services to your organization (connectors, audits, monitoring, alerts, reports, exports) | Organization data, API key and Agent records, notification preferences; Customer Data as processor | Performance of a contract; for Customer Data, the customer's instructions under the DPA |\n| Attribute and secure actions by users and Agents; detect abuse; enforce rate limits | Activity log, session records, API key and Agent records | Legitimate interests in security, fraud prevention and accountability |\n| Take payment and manage subscriptions | Billing data | Performance of a contract; legal obligation (accounting and tax records) |\n| Record acceptance of legal terms and consent choices | Legal acceptance and consent records | Legal obligation and legitimate interests in proving agreement and authority |\n| Send service and transactional emails (sign-in links, invitations, alerts, billing notices, changes to terms, and the weekly review email if you turn it on) | Identity and contact, notification preferences | Performance of a contract; legitimate interests |\n| Respond to support requests and complaints | Support data, identity and contact | Legitimate interests; performance of a contract |\n| Send the savings estimate you asked for and one follow-up, or reply to your contact request | Savings estimate and contact requests | Steps taken at your request before entering into a contract; legitimate interests in following up on an enquiry you started |\n| Call you about setting up and using the Services, only if you gave a phone number | Phone number for a setup call | Consent, given by entering the number; you can withdraw it at any time by removing it in Settings or asking us |\n| Send occasional product updates, only if you ticked the box | Savings estimate and contact requests (email) | Consent, which you can withdraw at any time |\n| Comply with law, respond to lawful requests, and establish or defend legal claims | Any relevant category, limited to what is needed | Legal obligation; legitimate interests |\n\n**Marketing.** We do not currently send marketing emails. If we start, we will ask for your consent separately where required, never pre-tick consent, and include an unsubscribe link in every message.\n\n**Automated decision-making.** We do not make decisions that produce legal or similarly significant effects on individuals based solely on automated processing. Anomaly detection in the Services analyses spend data for the customer's organization; it does not evaluate individuals.\n\n**AI models.** We do not send any customer data or personal data to any large language model or other AI model, and we do not use it to train models. See the AI Data Use Policy (document id `ai_data`).\n\n---\n\n## 4. Who we share personal data with\n\nWe do not sell personal data, and we do not share it for cross-context behavioural advertising.\n\nWe share personal data only with:\n\n- **Service providers (subprocessors)** that host and operate the Services for us, under contracts that restrict their use of the data. The current list, with purposes and locations, is in our Subprocessors list (document id `subprocessors`). In summary: Vercel Inc. (application hosting, United States); Neon (managed PostgreSQL database) [[LEGAL_REVIEW_REQUIRED: Neon contracting entity and database hosting region]]; Resend (transactional email, when enabled); and Stripe (payment processing). GitHub is used only to host our source code and does not receive customer data.\n- **Stripe** also acts as an independent controller for some payment data (for example, fraud screening and its own legal obligations), under its own privacy notice.\n- **Your organization.** Owners and admins of your organization can see members' names, emails, roles and the activity log for that organization.\n- **Authorities and advisers**, where required by law, or to protect our rights, users or the public, and our professional advisers under confidentiality duties.\n- **A successor business**, if Audon is involved in a merger, acquisition or sale of assets, subject to this Policy.\n\n---\n\n## 5. International transfers\n\nAudon is based in the United Arab Emirates. Our main hosting providers are located in the United States, so personal data is transferred to and stored in the United States and may be accessed from the UAE.\n\nWhere we transfer personal data out of the UK or the European Economic Area, we rely on recognized safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or the recipient's certification under the EU-US Data Privacy Framework and its UK Extension, where applicable. Where the UAE PDPL or Saudi PDPL restricts cross-border transfers, we will rely on a transfer ground permitted by those laws. [[LEGAL_REVIEW_REQUIRED: transfer mechanisms per route (UK/EU to US/UAE; UAE PDPL; KSA cross-border rules)]]\n\nWe do not currently offer data residency in the UAE, Saudi Arabia, the UK or the EU.\n\nYou can ask us for more information about the safeguards we use by contacting us (Section 1.3).\n\n---\n\n## 6. How long we keep data\n\nWe keep personal data only as long as needed for the purposes above. Detailed periods are maintained in `docs/DATA_RETENTION_SCHEDULE.md`. In summary:\n\n| Data | Retention |\n|---|---|\n| Account identity and authentication data | For as long as the account exists; deleted when you are removed from all organizations and your account is deleted, or when the organization is permanently deleted |\n| Session records | 14 days from creation, or earlier on sign-out |\n| Organization, role and invitation data | Life of the organization; permanently deleted 14 days after an owner requests organization deletion |\n| Provider usage and cost data (processor) | According to the customer's retention setting (default 400 days), and deleted with the organization |\n| Encrypted provider credentials | Until the connector is disconnected or the organization is deleted; destroyed immediately on disconnect |\n| Telemetry (processor) | According to the customer's retention setting, and deleted with the organization |\n| Audon API key and Agent connection records | Until revoked or the organization is deleted; revocation is effective immediately |\n| Activity and audit log | Life of the organization; may be retained after deletion where needed for legal obligations or to establish or defend legal claims [[LEGAL_REVIEW_REQUIRED: post-deletion retention period for activity log, legal acceptance and billing records]] |\n| Legal acceptance and consent records | As for the activity log |\n| Billing records | As required by applicable accounting and tax law |\n| Support emails | Up to 24 months after the request is closed, unless needed for a dispute |\n| Phone number for a setup call | Until you remove it in Settings, delete your account, or ask us to delete it |\n| Savings estimate and contact requests | 12 months from the request, then deleted automatically (sooner on request) |\n| Backups | Deleted data may persist in our database provider's backups until those backups expire on their normal cycle |\n\n---\n\n## 7. Your rights\n\nDepending on where you are and which law applies, you may have the right to:\n\n- **access** your personal data and receive a copy;\n- **correct** inaccurate data;\n- **delete** your data;\n- **restrict** or **object to** certain processing, including processing based on legitimate interests;\n- **data portability** (receive your data in a structured, machine-readable format);\n- **withdraw consent** where we rely on consent (this does not affect earlier processing);\n- **not be subject to** solely automated decisions with significant effects; and\n- **complain** to a data protection authority.\n\n**7.1 UK and EU.** These rights are provided by the UK GDPR and the EU GDPR, where they apply to our processing. You may complain to the UK Information Commissioner's Office (ico.org.uk) or to the supervisory authority in the EU Member State where you live or work.\n\n**7.2 United Arab Emirates.** Under the UAE PDPL, you may request information about and access to your data, correction, erasure, restriction of processing, objection to processing and transfer of your data, subject to the exceptions in that law. You may complain to the UAE Data Office.\n\n**7.3 United States.** We do not sell or share personal data for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would require a right to limit. Where a US state privacy law applies to us, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, residents of that state may have rights to know, access, correct and delete personal information and to opt out of sale, sharing or targeted advertising. We will not discriminate against you for exercising these rights. You may use an authorized agent to make a request; we may ask the agent for proof of authorization and verify your identity. Our applicability under each state law depends on thresholds that counsel is assessing. [[LEGAL_REVIEW_REQUIRED: US state privacy law applicability (California and other states) given B2B scope and thresholds]] For California purposes, the categories of personal information we collect are: identifiers; commercial information (subscription and billing records); internet or other electronic network activity information (session and activity logs); and professional or employment-related information (organization and role). We collect them from the sources and for the purposes described in Sections 2 and 3, disclose them only to the recipients described in Section 4, and keep them for the periods in Section 6.\n\n**7.4 Saudi Arabia (pilot customers only).** Where the Saudi PDPL applies, you may have rights to be informed, to access, to obtain a copy, to correct, and to request destruction of your personal data, and you may complain to the Saudi Data & AI Authority (SDAIA).\n\n**7.5 How to exercise your rights.**\n\n- **In the Services:** you can update your name and notification preferences in account settings, and delete your own user account (Settings → My account; an organization's only owner must first delete the organization or appoint another owner). Organization owners can export organization data (JSON), set the retention period for spend data, remove members, revoke API keys and Agent connections, and request deletion of the organization (14-day grace period, then permanent deletion).\n- **Via the API/MCP:** the same export, deletion-request, consent and legal-document functions are available to authorized users and Agents within their scopes.\n- **By email:** write to [[LEGAL_REVIEW_REQUIRED: privacy contact email]]. We will verify your identity proportionately (normally by confirming control of the email address on the account) and respond within one month (or the shorter or longer period that applicable law allows). We do not charge a fee unless the law permits it for requests that are manifestly unfounded or excessive.\n\nIf your request concerns Customer Data that we process for an organization, we will forward it to, or assist, that organization as the controller.\n\n---\n\n## 8. Security\n\nWe protect personal data using measures that include TLS encryption in transit, encryption at rest provided by our database provider, envelope encryption (AES-256-GCM) for provider credentials, hashed passwords, session tokens and API keys, role-based access control, tenant isolation testing, rate limiting, signed webhooks and protections against server-side request forgery. We do not currently hold SOC 2 or ISO/IEC 27001 certification and have not yet completed an independent penetration test. More detail is in the Security Overview (document id `security`).\n\nIf a personal data breach occurs, we will notify affected customers and, where required, regulators and individuals within the time limits that apply.\n\n---\n\n## 9. Cookies\n\nWe use only strictly necessary cookies, plus a theme cookie that is set only when you actively choose a display theme. We do not use analytics or advertising cookies, so there are no optional cookies or cookie preferences to manage. See the Cookie Policy (document id `cookies`).\n\n---\n\n## 10. Children\n\nThe Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.\n\n---\n\n## 11. Changes to this Policy\n\nWe will update this Policy when our practices change, for example if we add a subprocessor or a new feature that uses personal data differently. Each version has a version number and effective date, and earlier versions are archived in our legal documents index. We will notify organization owners by email and in the Services of material changes before they take effect.\n"},"meta":{"request_id":"req_01m61e43mh3q9njadbkvcn","operation":"legal.get"}}