Privacy Policy

Controller: Xolo Go OÜ. Contact person: Meelis Vallsalu. Registry country: Estonia. Registry code: 14717109. EU VAT number: EE102156920. Address: Paju tn 1a, 50603 Tartu, Tartu County, Estonia. Email: auditexpertai@gmail.com.

The general contact form may contain a name, company name, email address, optional phone number and website URL, plus information about service needs, timing and budget range.

Accepted details are delivered to AuditExpert-AI by email through Resend. This general form is not stored in the Supabase database. Do not enter identity numbers, health information, payment data, passwords or other unnecessary sensitive information.

The pricing-unlock form processes the visitor-provided name, company, email address, optional phone number, selected agent, locale, privacy-notice acknowledgement and submission timestamp. Technical data includes a random idempotency key, lead source, privacy-notice version, lead and session identifiers, the session token's SHA-256 hash, expiry, revocation and consumption timestamps, and the internal notification status and reference.

The raw session token is issued only in an essential catalogue-wide HttpOnly cookie. Only its SHA-256 hash is stored in the database. One verified unlock reveals protected operating details for all agents for 24 hours, while pricing is always loaded from the selected agent's own active package. The form collects no card or billing data, and unlocking creates neither an order nor marketing consent.

Data is processed to display the selected agent's price, respond to the requested inquiry, associate the request with the correct agent, restore the 24-hour pricing session, limit abuse, secure the service and deliver an internal sales notification.

Pricing unlock and inquiry handling rely on steps requested before entering a contract. Security, abuse prevention, technical logs and reliable notification delivery rely on the controller's legitimate interests. Legal obligations are followed where applicable. Acknowledging the privacy notice is not marketing consent.

Vercel provides the website hosting and runtime and may process technical request data needed to deliver, protect and troubleshoot the service, such as IP address, timestamp, requested address, browser-related technical details and error data.

The site uses Vercel Web Analytics. According to Vercel, it processes anonymous or aggregated page-view, referrer, country, device, browser and operating-system data, plus limited custom events. This implementation uses no analytics cookies and sends no form contact details in custom events. Pricing unlock is not used for marketing tracking.

Please provide only information needed to assess the inquiry. Protected server-side agent content and pricing are excluded from public HTML, page props and search schemas and returned only after a valid catalogue session. Public database access is disabled. No online or email channel is entirely risk-free.

Supabase stores limited pricing-unlock lead, session and notification data in a project whose region is Central EU (Frankfurt), eu-central-1. Resend delivers general contact-form messages and the limited internal pricing-unlock notification. Vercel provides hosting, runtime and cookie-free Web Analytics.

Providers may process information under their terms, processing agreements and applicable transfer safeguards, including outside the EU or EEA. A provider region selection does not mean all processing by subprocessors or support services is limited to that region.

The pricing-unlock cookie lasts no longer than 24 hours. The database session expires after 24 hours; expired, revoked or consumed session rows may remain associated with the lead for security, abuse investigation and audit-trail integrity. Personal data for an unconverted pricing lead is retained for up to 12 months and then anonymised or removed.

Internal notification metadata is not retained longer than its related lead. Data that becomes part of a customer relationship or contract negotiation may be retained under separate contractual, legitimate-need or legal-obligation periods. Purge and anonymisation functions exist, but no automatic schedule is active; meeting these periods requires an operational run.

Where EU data protection rules apply, you may have the right to access, correct or erase personal data, restrict or object to processing and, in some circumstances, receive portable data. Where processing relies on consent, you can withdraw it for future processing.

• Send a request to auditexpertai@gmail.com.
• Reasonable identity verification may be required before a request is fulfilled.
• You may raise a concern with the competent data protection authority.

Processing is intended to follow data-minimisation, restricted-access, secure-transmission and provider-assessment principles. No online or email channel is entirely risk-free, so unnecessary sensitive information should not be sent.

This policy will be updated when website features, providers or legal obligations change. Material revisions are identified by the updated date.