1. Who We Are (Controller)
Candid Audit is the controller of the personal data described in this Policy. For any privacy request, contact audit@candidaudit.in.
2. Information We Collect
Information you provide: name, email address, website URL, billing details, and anything you submit through forms, audit requests, support tickets, or the client portal.
Client access data: where you engage us, credentials and access details needed to perform the Services (for example admin, hosting, or DNS access), which we treat as confidential.
Technical data: IP address, browser and device information, pages visited, timestamps, and security/event logs generated automatically when you use the site.
Audit data: technical information about your website gathered during scanning, produced only on your instruction and authorization.
3. How We Use Information
We use information to: provide, maintain, and secure the Services; perform audits and generate reports; operate the client portal and ticket system; process payments; communicate about your account and service matters; detect, prevent, and investigate fraud, abuse, and security incidents; keep records for legal, tax, and accounting purposes; and comply with law. Our legal bases include performance of our contract with you, our legitimate interests in operating and securing the Services, your consent where required, and compliance with legal obligations.
4. Website Access and Credentials
To perform maintenance we may require administrative access to your site. Credentials are handled confidentially, access is limited to authorized personnel, and we recommend you create a dedicated account for us that you can revoke at any time. You are responsible for the accuracy and lawfulness of any credentials or data you share with us.
5. Cookies and Similar Technologies
We use only strictly necessary cookies for session management and security (for example login sessions and CSRF protection). We do not use third party advertising or cross site tracking cookies. You can control cookies in your browser, but disabling essential cookies may prevent parts of the site (such as the portal or admin) from working.
6. How We Share Information
We do not sell your personal data. We share it only with: service providers and processors who help us operate (for example hosting, payment processing, and email delivery), bound by confidentiality and limited to what is necessary; authorities or third parties where required by law, legal process, or to protect our rights, safety, or property; and a successor entity in the event of a merger, acquisition, or asset sale. Any such recipients are required to protect the data consistently with this Policy.
7. Audit Reports and Confidentiality
Security audit reports contain sensitive findings and are delivered through private, unguessable links under our Report Access Policy. You are responsible for keeping report links confidential and for anyone with whom you share a link.
8. Data Security
We apply reasonable technical and organizational measures, including encrypted transport (HTTPS), secure session handling, access controls, prepared database statements, and event logging. However, no method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. You use the Services at your own risk and are responsible for maintaining your own backups and for securing your own devices and accounts. Any liability relating to security is subject to the limitations in our Terms of Service.
9. Data Retention
We retain personal data for as long as needed to provide the Services and thereafter for a reasonable period to meet legal, tax, accounting, security, and dispute resolution needs. Security and access logs may be retained for auditing and fraud prevention purposes. When no longer needed, data is deleted or anonymized.
10. Your Rights
Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and may object to or restrict certain processing. We will respond within the time required by law and may need to verify your identity. Some data must be retained where we have a legal obligation or legitimate need (for example billing records or security logs), and requests that would compromise the security or integrity of the Services may be declined to the extent permitted by law. To exercise a right, email audit@candidaudit.in.
11. International Transfers
Your data may be processed in countries other than your own. Where it is transferred internationally, we take steps to ensure it is protected consistently with this Policy and applicable law.
12. Children's Privacy
The Services are intended for businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided data, contact us and we will delete it.
13. Third Party Sites
Our site and reports may link to third party websites and services we do not control. We are not responsible for their content or privacy practices. Review their policies separately.
14. Changes to This Policy
We may update this Policy at any time by posting a revised version with a new "Last updated" date. Material changes take effect when posted, and your continued use of the Services constitutes acceptance.
15. Contact
Privacy questions or requests: audit@candidaudit.in.