Skip to content
⚖️ ATTORNEY REVIEW PENDING — This document is a working draft. It has not yet been reviewed or approved by counsel and should not be relied upon. The banner will be removed once review is complete.

Privacy Policy

Effective date: September 1, 2026 · Last updated: September 9, 2026

Audmit ("we," "us," or "our") respects your privacy and is committed to protecting your personal information. This privacy policy explains how we collect, use, disclose, and safeguard your information when you visit www.audmit.com and use our self-assessment tool, in compliance with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

1. Categories of Personal Information Collected

Identifiers

Name, email address, company name, and state of residence. Collected when you submit a contact form, self-assessment, of-counsel application, referral partner interest form, or briefing signup.

Retention: 90 days for self-assessment data (auto-deleted via TTL). Contact form and application data retained for 2 years or until deletion is requested.

Commercial information

Self-assessment responses including company size, industry, operating states, revenue band, AI systems in use, and assessment results. This information is collected to generate your compliance snapshot and, if you request it, to scope an engagement proposal.

Retention: 90 days (auto-deleted via DynamoDB TTL). Session data stored in browser sessionStorage is cleared when you close the tab.

Internet or electronic network activity

Standard server logs including IP address, browser type, referring URL, and pages visited. We use Google Analytics 4 (GA4), loaded via Google Tag Manager, to understand aggregate site usage and improve our services. GA4 may collect IP addresses, browser/device information, and pages visited. Google processes this data under its privacy policy. We do not use GA4 data to identify individual visitors.

Retention: Server logs retained for 30 days. Google Analytics data retained for 14 months, then automatically deleted.

Professional or employment-related information

State bar number, jurisdiction, and practice areas — collected only from attorneys applying to the of-counsel network.

Retention: Retained for the duration of the attorney's participation in the network, or until deletion is requested.

2. Sources of Personal Information

We collect personal information directly from you when you:

  • Complete the self-assessment at /assess
  • Submit a contact form, proposal request, or inquiry
  • Apply to the of-counsel network or referral partner program
  • Sign up for the Audmit briefing
  • Send us email directly

We also collect internet activity information automatically through standard server logs when you visit the site. We do not purchase personal information from data brokers or third parties.

3. Business Purposes for Collection

  • Providing services: Generating your compliance assessment, scoping engagement proposals, processing applications
  • Communications: Responding to inquiries, sending briefing updates you've opted into, transactional confirmations
  • Security: Detecting and preventing fraud, abuse, and unauthorized access
  • Improvement: Analyzing aggregate usage patterns to improve the site and self-assessment tool (no individual tracking)
  • Legal compliance: Meeting our own regulatory and legal obligations

4. Disclosure to Service Providers

We share personal information only with service providers who process it on our behalf under contractual limits that prohibit them from selling, sharing, or using the data for their own purposes:

  • Hosting: Amazon Web Services (AWS) — infrastructure hosting and database services
  • Email delivery: Transactional and briefing email delivery service
  • Analytics: Google Analytics 4 (GA4) via Google Tag Manager — aggregate site usage, page views, and self-assessment funnel metrics. Suppressed when Global Privacy Control is active

Each service provider is bound by a data processing agreement that restricts use to the specific service they provide.

5. No Sale or Sharing of Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

6. Your Rights Under California Law

As a California resident, you have the following rights under the CCPA/CPRA:

Right to know: You may request that we disclose what personal information we have collected about you, the sources, the business purposes, and any third parties with whom we shared it.
Right to delete: You may request that we delete the personal information we have collected from you, subject to certain legal exceptions.
Right to correct: You may request that we correct inaccurate personal information we maintain about you.
Right to opt out: You have the right to opt out of the sale or sharing of your personal information. We do not sell or share personal information, but you may still exercise this right.
Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

7. How to Exercise Your Rights

You may submit a request to know, delete, or correct your personal information by:

  • Emailing privacy@audmit.com with the subject "Privacy Request"
  • Using the request form below

Verification process

We will verify your identity by matching the email address in your request against the email address associated with your self-assessment or form submission. If we cannot verify your identity with reasonable certainty, we may ask for additional information. We will respond to verifiable requests within 45 calendar days. If we need additional time (up to 45 more days), we will notify you.

Authorized agents

You may designate an authorized agent to submit a request on your behalf. We will require the agent to provide written authorization from you and will verify your identity directly unless the agent provides a power of attorney.

8. Privacy Request Form

Submit a request to know, delete, or correct your personal information. We will respond within 45 calendar days.

Notice at collection

We collect your email address and request details to process your privacy request. This information is used solely for identity verification and request fulfillment. Read our privacy policy and notice at collection.

9. Global Privacy Control

We honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as a valid opt-out request under the CCPA/CPRA. When a GPC signal is detected, we suppress Google Analytics and all non-essential tracking for your session. We do not sell or share personal information regardless of GPC status.

10. Children's Data

We do not knowingly collect personal information from children under 16 years of age. The self-assessment tool and compliance services are intended for business professionals. If we learn that we have collected personal information from a child under 16, we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Change log

September 1, 2026 — Initial publication (draft, pending attorney review).