Privacy Policy

Last updated: 20 October 2026

Audit Scoot B.V. (“we”, “us”), reachable through the contact form at auditscoot.com/contact, is committed to protecting personal data. This policy is drafted under Regulation (EU) 2016/679 (GDPR); for customers and visitors in the United Kingdom, references to the GDPR include the UK GDPR.

1. The local-first application — read this first

Audit Scoot is a Windows application. General ledgers, trial balances and related audit datasets (“Client Audit Data”) are read, stored and analysed on the user’s own machine. We do not receive, host or store Client Audit Data, and we cannot access it.

The application sends us nothing. It contains no telemetry or analytics, and it makes no network connection unless a user asks for an AI analysis or a feature below is configured:

Feature	What happens	Who receives it
Optional AI analysis	Only when a user asks for one, and never if your firm’s policy setting turns it off. The application sends Google’s Gemini model the question as typed, the column names and types, a profile of each column (distinct values, share of blanks, and the minimum and maximum of numeric columns), the fiscal year, year-end date and materiality thresholds, the names of the classification captions and of the analyses already run, and, for client documents loaded beside the ledger, their names, row counts and column names. A follow-up question also carries the earlier questions of the conversation and the analysis the model returned for them. It never sends ledger or document rows, account or counterparty names, narratives, amounts from any row, results or file names	Google, as our processor, under Audit Scoot’s account (the Gemini API). The request goes from the application to Google directly; it does not pass through our servers. A question typed by a user may itself contain personal data (for example an employee’s name); for that data your firm is the controller and we act as its processor
Update check	Only if a release feed is configured: the application fetches a signed manifest at most once a week	The operator of the feed; no personal data beyond a standard web request
Diagnostic archive	Written only when a user exports one; it holds versions, timings and logs that by design contain no client values	Nobody, unless the user chooses to send it to us for support

2. Personal data we process as controller

Category	Examples	Source
Customer data	Name, business email, role and firm of the people we work with; support messages and any diagnostic archive you send us	You, your firm
Billing data	Firm billing details, VAT number, invoices, payment status	Your firm
Prospect and correspondence data	Name, business email, firm and the message you send through a form on this website; our correspondence with you	You, your firm’s website, professional networks, business registers
Website data	Technical request data handled by our hosting provider; the bot check on our forms; aggregate, cookieless visit statistics (see Cookie Policy)	Your visit

No special categories; no automated decision-making producing legal effects.

Purpose	Legal basis
Answering a demo request or a message you send us	Steps taken at your request before a contract (b), or legitimate interest (f) in answering business enquiries
Providing the service, licences and support	Contract (b)
Invoicing, accounting, fiscal retention	Legal obligation (c)
B2B direct marketing to relevant professional contacts	Legitimate interest (f), with opt-out in every message
Website security and abuse prevention	Legitimate interest (f)
Establishment or defence of legal claims	Legitimate interest (f)

You can object to legitimate-interest processing at any time (§7); every marketing email has a one-click unsubscribe.

4. Recipients

Cloudflare, Inc. hosts this website, runs the function that receives website form submissions, and runs Turnstile, the bot check on those forms.
Resend, Inc. delivers each form submission as an email to our team inbox; it receives the name, email, firm and message you enter, in the United States.
Microsoft (Microsoft 365) hosts that inbox and our correspondence.
Google (Gemini API) receives the AI requests described in §1, only when a user asks for an AI analysis.
Plausible Insights OÜ (Estonia) provides cookieless website statistics. It counts visits without cookies and without storing IP addresses.
Professional advisers under confidentiality. Payments are by bank transfer (IBAN); no payment provider receives your data.

We do not sell personal data. The current list, with locations and safeguards: auditscoot.com/subprocessors.

5. International transfers

Where a recipient processes personal data outside the EEA or the UK — Resend and Google in the United States, and Cloudflare and Microsoft where their networks do — we rely on an adequacy decision, including the EU–US Data Privacy Framework where the recipient is certified under it, or on Standard Contractual Clauses (EU SCCs; UK IDTA or Addendum where applicable). Details on request.

6. Retention

Data	Retention
Customer data	Subscription + 2 years
Billing data	7 years (Dutch fiscal duty)
Prospect and correspondence data, including form messages	18 months after last meaningful contact, or immediately upon objection
Website statistics	Aggregate only; no personal data retained
Client Audit Data	Never held by us; resides only on your machines under your control

7. Your rights

Access, rectification, erasure, restriction, portability, and objection (including to direct marketing, always honoured): the contact form at auditscoot.com/contact, answered within one month. Complaints: Autoriteit Persoonsgegevens (NL), the ICO (UK), or your local supervisory authority. Data subjects whose personal data appears in Client Audit Data should contact the relevant audit firm; the data is on that firm’s systems, not ours.

8. Security

Local-first processing is our primary safeguard: the sensitive dataset never leaves your environment, and the application sends us nothing. For the personal data we do hold — correspondence, customer and billing records — we apply appropriate technical and organisational measures and choose providers that encrypt data in transit.

9. Notice to United States residents (CCPA/CPRA and other state laws)

This section supplements the above for individuals in US states with comprehensive privacy laws (California, Virginia, Colorado, Connecticut, Utah, and successor or equivalent laws). Audit Scoot serves business customers only; the personal data we process is business-contact, customer and billing data.

We do not sell or share personal data, and have not done so in the preceding 12 months. “Sell” and “share” are used as defined under the CCPA/CPRA; we do not disclose personal data for cross-context behavioural advertising or for monetary or other valuable consideration.
No sensitive data for restricted purposes. We process no special-category or “sensitive” personal information for the purposes those laws restrict, and make no automated decisions producing legal or similarly significant effects.
Categories, purposes, sources, and retention are those set out in §2–§6 above; sources are you, your firm, and public professional registers.
Your rights. Residents of these states may request to know, access, correct, delete, and obtain a portable copy of their personal data, and will not be discriminated against for exercising them. Because we never hold Client Audit Data, any request concerning data inside a firm’s audit files must be directed to that firm, which controls it.
How to exercise. Use the contact form at auditscoot.com/contact; we respond within the period the applicable law requires, and honour requests made through an authorised agent where the law permits.

10. Changes and contact

Material changes are notified to customers. Questions and requests: the contact form at auditscoot.com/contact.