Privacy Policy
Effective date: 14 September 2026
This Privacy Policy explains how GRCHero Audit (“GRCHero Audit”, “we”, “us”) handles personal data and audit workspace content when you visit the website, create an account, purchase a plan, or use the application.
Information we collect
- Account data: name, email address, username, authentication and account-security information.
- Workspace data: audit plans, risks, controls, tests, findings, actions, assignments, comments, reports and files that you choose to upload.
- Commercial data: plan, order, invoice and payment status. Payment-card details are handled by the payment provider rather than stored directly by GRCHero Audit.
- Technical and security data: IP address, browser and device information, login events, cookies, and diagnostic or security logs.
- Communications: enquiries, support requests and other messages you send to us.
How we use information
We use information to provide and secure the service; authenticate users; operate audit, collaboration, reporting and follow-up features; process purchases; respond to support requests; prevent abuse; maintain and improve reliability; and meet legal obligations.
AI-assisted features
When you deliberately use an AI-assisted feature, relevant prompts, selected workspace context, and documents may be sent to an AI service provider to produce the requested output. AI output is a draft or suggestion and should be reviewed by an auditor before use. Do not upload information that you are not authorised to process.
Service providers and disclosures
We may use vetted providers for hosting, storage, email delivery, payment processing, security, analytics and AI processing. They receive information only as needed to provide their service to us. We may also disclose information where required by law, to protect users or the service, or as part of a corporate transaction. We do not sell personal data.
Cookies
GRCHero Audit uses essential cookies for sign-in, session security, preferences, shopping and checkout. Additional cookies may be used only where enabled and legally permitted. You can control non-essential cookies through your browser or any consent controls presented on the site.
Retention and deletion
We retain account and workspace information while an account is active and for a reasonable period afterwards where needed for support, security, dispute resolution, backups, or legal and accounting obligations. Retention may vary by data type. You may request account or personal-data deletion; some records may need to be retained where the law requires it.
Security
We use administrative and technical safeguards intended to protect information, including access controls, protected application routes and monitoring. No online service can guarantee absolute security. Keep your credentials confidential and notify us promptly if you suspect unauthorised access.
Your choices and rights
Depending on your location, you may have rights to access, correct, export, restrict, object to or delete personal data, and to complain to a data-protection authority. We may need to verify your identity before acting on a request.
International processing
Our providers may process information in countries other than your own. Where required, appropriate safeguards are used for international transfers.
Children
GRCHero Audit is a professional service and is not directed to children.
Changes to this policy
We may update this policy as the service or legal requirements change. The effective date above identifies the current version.
Contact
For privacy questions or requests, email aresag@gmail.com.