Your privacy is foundational to how we build and operate PayAudit.
Last updated: April 6, 2026
PayAudit ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered invoice auditing platform.
By using PayAudit, you consent to the data practices described in this policy. If you do not agree with the terms of this policy, please do not use our service.
Account Information:
Document Data:
Usage Data:
We use your information to:
AI Processing: To provide AI-powered extraction and analysis, document content is transmitted to OpenAI's API. This is a critical component of our service—we cannot provide AI auditing without this processing.
When processing documents:
OpenAI's data handling is governed by their Privacy Policy. We encourage you to review it.
We do NOT sell your personal data or business documents to anyone.
We may share data only in these circumstances:
We retain your data only as long as necessary to provide our service and fulfill the purposes outlined in this policy. PayAudit includes a configurable Data Retention Policy system — administrators can configure custom retention periods per document type. Default periods are shown below.
| Data Type | Default Retention Period | Deletion Method |
|---|---|---|
| Account credentials | While account active + 30 days after deletion request | Upon account deletion (GDPR Art. 17) |
| Contracts | 24 months from upload (configurable) | Automatic hard-delete after expiry (30-day warning email sent) |
| Invoices | 12 months from upload (configurable) | Automatic hard-delete after expiry (30-day warning email sent) |
| Audit results | 12 months from creation (configurable) | Automatic hard-delete after expiry (30-day warning email sent) |
| Access logs | 12 months | Automatic deletion after retention period |
| Deletion audit trail | Permanently retained (compliance requirement) | Anonymized on account deletion (record remains, personal data removed) |
| Billing records | 7 years (legal requirement) | Automatic deletion after retention period |
Documents in active disputes are protected from auto-deletion until 90 days after resolution. Administrators can extend retention for individual documents via the Retention Dashboard.
GDPR Art. 6 — Lawful Basis: We process personal data under the following lawful bases as required by GDPR Article 6.
| Processing Activity | Lawful Basis |
|---|---|
| Account registration and authentication | Contract (Art. 6(1)(b)) — necessary to provide the service |
| AI extraction of uploaded documents | Consent (Art. 6(1)(a)) — obtained at registration; withdrawable |
| Audit results and discrepancy records | Contract (Art. 6(1)(b)) — core service delivery |
| Email notifications about audits | Legitimate interest (Art. 6(1)(f)) — keeping users informed about their account activity |
| Marketing communications | Consent (Art. 6(1)(a)) — opt-in only; withdrawable at any time |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) — protecting users and the platform |
| Immutable audit trail (deletions) | Legal obligation (Art. 6(1)(c)) — compliance and accountability records |
GDPR Rights (EU/UK Users): If you are located in the EU or UK, you have rights under GDPR including: access, rectification, erasure, restriction, portability, and the right to object. Many of these rights are exercisable directly in your PayAudit account.
Regardless of your location, you have the right to:
To exercise rights not covered by in-app tools, contact privacy@payaudit.com. We respond within 30 days (72 hours for urgent data breach matters).
We implement industry-standard security measures:
See our Security page for detailed technical measures.
Strictly Necessary Cookies Only: PayAudit uses only functional, strictly necessary cookies for authentication and session management. We do not use tracking, advertising, or analytics cookies.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| payaudit_token (HttpOnly cookie) | Authentication — stores your JWT session token. HttpOnly flag prevents JavaScript access (XSS-hardened) | Strictly Necessary | 24 hours (auto-expires) |
| payaudit_user (localStorage) | User profile cache — avoids re-fetching on every page load | Strictly Necessary | Session |
| payaudit_cookie_consent (localStorage) | Remembers your cookie consent response | Preference | Indefinite (until cleared) |
No third-party analytics, advertising networks, pixels, or tracking scripts are loaded. You can clear these at any time through your browser's developer tools or by signing out.
PayAudit uses the following third-party services:
Each provider has their own privacy policy. We encourage you to review them. A Data Processing Agreement (DPA) is available upon request — see our Security page or email privacy@payaudit.com.
PayAudit is designed for business use and is not intended for children under 16. We do not knowingly collect personal information from children. If we become aware of such collection, we will delete it immediately.
PayAudit is hosted in the United States. If you access our service from outside the US, your data will be transferred to and processed in the US.
For EU/UK users: Data transfers outside the European Economic Area are protected by Standard Contractual Clauses or equivalent mechanisms. You may request details of these safeguards by contacting privacy@payaudit.com.
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Your continued use after changes take effect constitutes acceptance of the updated policy.
In the event of a data breach that affects your personal data, we will:
For questions about this Privacy Policy, to exercise your data rights, or to request a Data Processing Agreement (DPA), please contact:
PayAudit Privacy Team
Email: privacy@payaudit.com
Address: Wilmington, Delaware, USA
Response time: Within 30 days (72 hours for urgent data breach matters)
For EU/UK residents: You may also lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).