1. Introduction
This Privacy Policy explains how Vardot for Programming and Vardot, LLC (together, “Vardot”, “we”, “us”, or “our”), the company behind Auditray, collect, use, share, retain, and protect personal information and the rights you have over it.
It applies to the Auditray public website at www.auditray.com and communications with us about Auditray. The Auditray application at app.auditray.com may involve additional processing governed by the notices, customer agreements, and data processing terms applicable to that service. This website policy does not replace those terms or describe every category of customer data processed within the application.
Third-party websites and services have their own privacy practices. Merely visiting this website does not constitute consent to processing for which the law requires your consent.
2. Who we are
Vardot is the controller of personal information processed for the website and our own business communications. Its operating locations include Santa Clara, California, USA; Amman, Jordan; and Cairo, Egypt. Where Vardot processes customer data on a customer’s behalf, the respective roles and instructions are addressed in the applicable customer agreement.
For privacy questions or rights requests, email privacy@vardot.com.
3. Personal information we collect
- Contact and business information: your name, email address, organization, role, and other details you choose to provide when contacting us about Auditray.
- Communications: enquiries, support requests, correspondence, and preferences you share with us.
- Usage and log information: IP address, browser type, referring page, pages requested, timestamps, and interactions with the website.
- Device and approximate location information: device type, operating system, and location inferred from an IP address.
- Cookies and similar technologies: identifiers and usage information collected by enabled website tags, as described below.
The public website’s “Explore Auditray” links take you to the application; they do not submit a demo form. Account credentials and customer website data entered in the application are outside this public website’s collection flow. Please do not send sensitive personal information unless specifically requested through an appropriate channel.
4. How we collect information
We receive information directly when you contact us, automatically through website requests and enabled tags, and from providers that help operate and measure the website. If you follow a link to another service, that service’s collection practices and notices also apply.
5. How we use information and legal bases
For individuals covered by the GDPR or UK GDPR, the legal basis depends on the purpose and circumstances:
- Operate and improve the website: legitimate interests in providing a useful, reliable website; consent where required for non-essential tracking.
- Respond to enquiries and provide support: steps at your request before a contract, performance of a contract, or legitimate interests in responding to communications.
- Send requested updates or marketing: consent, or legitimate interests where legally permitted. You can ask us to stop marketing communications.
- Security and fraud prevention: legitimate interests in protecting systems and users, and legal obligations where applicable.
- Legal obligations and lawful requests: compliance with applicable law.
- Business transfers: legitimate interests in managing a merger, acquisition, or asset transfer, subject to applicable safeguards.
6. Cookies and similar technologies
Cookies store information on your device. Website technologies can be necessary for operation, remember preferences, or measure use. The production website loads Google Tag Manager, which manages other website tags; the tags enabled in that container determine the additional cookies and information collected.
Non-essential cookies and similar tracking require consent in some jurisdictions. You can manage or block cookies through your browser, delete stored cookies, and use provider opt-out tools. Blocking cookies may affect some services. This notice does not itself provide a cookie preference control or obtain your consent.
7. Website providers and analytics
- Replit: hosts the public website and processes requests and operational information needed to serve it. See Replit’s Privacy Policy.
- Google Tag Manager: delivers and manages production website tags. Google Analytics 4, when enabled through that container, measures visits, navigation, and engagement. See Google’s Privacy Policy and the Google Analytics opt-out add-on.
- Microsoft Clarity: when enabled through the tag manager, uses interaction data, heatmaps, and session recordings to help understand website use. See Microsoft’s Privacy Statement.
Product integration logos on this website describe Auditray’s positioning; displaying a logo does not mean that provider receives your visitor data. Advertising or remarketing practices are not established merely by displaying those logos.
8. How we share information
We share information with providers supporting website hosting, analytics, communications, and support as needed for those purposes. We may disclose information when required by law or to protect the rights, safety, and security of Vardot, users, or others. Information may also be transferred in connection with a merger, acquisition, financing, or sale of assets, with notice where required.
We do not sell personal information for money. Certain disclosures for analytics or advertising can constitute “sale” or “sharing” under California law, depending on how a service is configured. Contact us to ask about applicable disclosures or exercise your rights.
9. Data retention
We retain personal information only as long as needed for the purposes described here and applicable legal obligations, then delete or anonymize it. The period depends on the information and purpose: correspondence for the relevant relationship and any required recordkeeping period, marketing preferences until you withdraw them or they are no longer needed, and logs for operational and security needs. Customer application data is subject to the applicable service agreement.
10. International transfers
Vardot operates internationally. Information may be processed outside your country, including in the United States, Jordan, and Egypt, where laws may differ. Where transfer restrictions apply, appropriate safeguards are required, such as Standard Contractual Clauses where applicable. Contact us for information about safeguards relevant to your data.
11. Your privacy rights
EEA and United Kingdom
Subject to applicable conditions, you may request access, correction, erasure, restriction, or portability of your personal information, object to processing, and withdraw consent without affecting the lawfulness of earlier processing. You may lodge a complaint with your supervisory authority.
California
Subject to the CCPA/CPRA’s applicability and exceptions, you may request information about collection, use, and disclosure; access, correct, or delete personal information; opt out of sale or sharing; and limit qualifying uses of sensitive information. You may use an authorized agent. We will not discriminate against you for exercising applicable rights.
Jordan
Under the Personal Data Protection Law, where applicable, rights include being informed about processing, accessing data, requesting correction or deletion, objecting to processing or withdrawing consent, and complaining to the competent authority.
How to make a request
Email privacy@vardot.com and identify your relationship with Auditray and your request. We may need to verify your identity or authority and will respond within applicable legal timeframes. Some rights are subject to exceptions. If your information is held within an organization’s Auditray account, the organization may be the appropriate controller to contact.
12. Security
We use commercially reasonable technical and organizational measures to protect personal information. No method of transmission or storage is completely secure, and absolute security cannot be guaranteed. Please use Vardot’s security reporting guidance to report a security concern.
13. Children’s privacy
Auditray is intended for organizations and professionals, not children. We do not knowingly collect personal information from children under 16, or below the applicable minimum age of consent. If you believe a child has provided personal information, contact us so we can investigate and take appropriate steps to delete it.
14. Changes to this policy
We may update this policy and its “Last updated” date. We will provide additional notice where required by law. Please review this page periodically.
15. Contact us
For privacy questions, email privacy@vardot.com. For other enquiries, use Vardot’s contact page. Read our Terms of Use for website usage terms.