Privacy Policy
DRAFT — pending review. This document is a working draft provided for transparency during pre-launch. It has not yet been reviewed by legal counsel, is not legally binding, and may change before release.
This policy describes how Mahmoud Consultancy B.V. (operating the AuditPic product) processes personal data. It is written to reflect our intended practices under the EU General Data Protection Regulation (GDPR).
1. Data controller
The controller responsible for your personal data is Mahmoud Consultancy B.V., the operating entity behind the AuditPic brand. Registration details are listed on our Imprint page.
Contact for privacy enquiries: support@auditpic.com.
2. What we process
AuditPic is a photo-integrity service. Depending on how you use it, we may process:
- Account data — your email address (encrypted at rest) and authentication credentials.
- Photo metadata — cryptographic hashes (SHA-256), HMAC signatures, capture timestamps, and, where you enable it, location data.
- Photo content — images you capture or upload, stored in the EU.
- Usage data — technical logs needed to operate and secure the service.
3. Why we process it (legal bases)
We process personal data to provide the service you request (performance of a contract), to keep the platform secure and functioning (legitimate interests), and to meet legal obligations. Where we rely on consent — for example optional location capture — you may withdraw it at any time.
4. Retention
We keep personal data only as long as needed for the purposes above or as required by law. Photos are retained according to the retention period applicable to your account, after which they are deleted.
5. Sharing and sub-processors
We do not sell personal data. We use a limited set of service providers (for example EU hosting and storage) under data-processing agreements, acting only on our instructions. A current list of sub-processors can be requested at the contact above.
6. International transfers
The AuditPic platform is hosted in the European Union. We aim to keep personal data within the EU/EEA.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request erasure of your data (you can delete your account from the app);
- restrict or object to certain processing;
- request a portable copy of your data;
- lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Data protection impact (DPIA)
Because AuditPic processes evidentiary imagery and may process location data, we maintain an internal data-protection impact assessment (DPIA) covering these risks and the safeguards we apply, including encryption in transit and at rest and cryptographic integrity verification.
9. Security
Photo integrity is protected with SHA-256 hashing and versioned HMAC-SHA256 signatures; sensitive fields such as email addresses are encrypted at rest with AES-256-GCM. We apply technical and organisational measures appropriate to the risk.
10. Changes to this policy
We may update this policy as the product and our practices evolve. Material changes will be reflected here.