Privacy Policy

Undercover Audit is a trading name of Noahsure Group Limited, 1 Canada Square, Canary Wharf, London, E14 5AA, England. For the personal data described in this policy we act as the data controller, except where we process data inside a client's connected systems as part of an audit engagement — there we act as a processor on that client's instructions, governed by our Data Processing Addendum.

Data protection contact: privacy@aisure.uk. We are registered with the UK Information Commissioner's Office and you may complain to the ICO at any time.

• Account signup: full name, work email address, company name, company website, job title, phone number, approximate team size, the tier you are interested in, and your password (stored only as a salted hash by our authentication provider).
• Contact and enquiry forms: company, contact name, email, phone, industry, number of locations, package of interest and the free-text message you write.
• Billing: billing name, billing address, country, VAT/company number where supplied, plan purchased, amounts and payment status. Card details are entered directly into our payment processor's hosted checkout and are never seen or stored by us.
• Portal usage: sign-in timestamps, the audits and reports you open, and technical logs (IP address, browser and device type) kept for security and abuse prevention.
• Engagement correspondence: emails, meeting notes and documents you send us during an audit.

We do not knowingly collect data from children and the service is intended for business use only.

The audit product reads data from systems a client connects to us. Depending on the engagement this can include telephony and call recording platforms, CRM, helpdesk and ticketing tools, applicant tracking systems, rota and workforce tools, and finance or spend systems. That data can contain personal data about the client's customers and employees — for example call recordings and transcripts, contact records, ticket histories, candidate applications and performance metrics.

• Connections are requested read-only and least-privilege wherever the source system supports it.
• The client remains the controller of that data. We process it only to produce the audit findings, scorecard and action plan they commissioned, and to train their teams on their own material.
• Findings shown to leadership are aggregated and, wherever it does not destroy the finding, pseudonymised. We do not supply covert performance dossiers on named individuals as a standalone product.
• We do not sell this data, use it to train third-party AI models, or reuse it for any other client.

On-site "undercover" work is always carried out with the written authorisation of the engaging leadership, within the rules of engagement in our Terms of Service, and never involves recording where recording would be unlawful.

• Providing the platform, portal and audits — performance of a contract with you or your employer.
• Responding to enquiries and quoting — legitimate interests in answering business enquiries we were asked to answer.
• Verifying that a signup is a genuine business (work-email and domain checks, bot and rate-limit controls) — legitimate interests in preventing fraud and abuse of a paid B2B service.
• Billing, accounting and tax records — legal obligation.
• Security, logging and incident investigation — legitimate interests in keeping the service and client data safe.
• Marketing emails to business contacts — legitimate interests for existing and enquiring business contacts, consent where consent is required. Every message has a one-click unsubscribe.
• Processing client system data — the client's own lawful basis; we act on their documented instructions as processor.

We use a small number of sub-processors, each under a written data-processing agreement:

• Hosting and application platform — serving the site and portal (UK/EU and US regions).
• Database, authentication and file storage provider — account records, audit content and portal data (EU region).
• Payment processor — checkout, subscriptions, invoices and refunds. They act as an independent controller for payment and anti-fraud purposes.
• Email delivery provider — transactional and notification email.
• AI model providers — used to analyse engagement data under zero-retention or no-training terms. Client system data is never used to train general-purpose models.
• Professional advisers, accountants and insurers, and any authority where we are legally required to disclose.

We never sell personal data. A current sub-processor list is available on request to privacy@aisure.uk.

We prefer UK and EU processing regions. Where a sub-processor processes data outside the UK or EEA, the transfer is covered by the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with a transfer risk assessment and encryption in transit and at rest.

• Enquiry records: 24 months from the last contact, then deleted.
• Account and portal data: for the life of the account, then 90 days after closure before deletion.
• Audit reports and findings: 24 months after the engagement ends unless the client asks us to delete them sooner or retain them longer.
• Raw data pulled from client systems: deleted or returned within 30 days of the engagement ending; derived, aggregated findings are retained with the report.
• Billing and tax records: 7 years, as required by UK law.
• Security logs: 12 months.

• Encryption in transit (TLS 1.2+) and at rest.
• Row-level access controls in the portal so a client can only ever read their own audits.
• Least-privilege, read-only credentials for connected client systems.
• Named-individual access, multi-factor authentication and access reviews internally.
• Vetted, contractually bound operators for on-site work, under NDA.
• Breach response process with notification to affected controllers without undue delay.

Under UK GDPR you can ask us to give you access to your personal data, correct it, delete it, restrict or object to our processing of it, port it to another provider, and withdraw consent where consent is the basis. You can also object to direct marketing at any time.

Email privacy@aisure.uk and we will respond within one month. We may ask you to confirm your identity first. If your data sits inside a client's connected systems, we will pass your request to that client as controller and support them in answering it.

If you are unhappy with our response you may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Non-essential cookies and storage are switched off until you turn them on. When you first visit, a consent banner offers Accept all, Reject non-essential and Manage choices. Nothing in the Analytics or Advertising categories is pre-selected, and no Google tag is loaded before the matching consent is given. Google Consent Mode v2 signals start denied (analytics_storage, ad_storage, ad_user_data, ad_personalization) and are only updated after you consent.

Your choice is stored in your browser under the key ua-consent-v1 for 180 days, after which we ask again. You can change or withdraw consent at any time using the Privacy choices link in the site footer; withdrawing it stops further collection and clears any retained advertising click identifier.

The categories are:

• Necessary (always on) — session and authentication storage set by us and by our backend provider (Supabase) to keep you signed in and protect the account; checkout and fraud-prevention cookies set by Stripe inside the payment form; your consent record itself; and local storage used to remember that you dismissed the install or notification prompt (30 days). Retention ranges from the browser session to 180 days. These cannot be switched off because the service does not work without them.
• Analytics (off by default) — Google Analytics 4, provided by Google Ireland Limited, for aggregate page and event counts. Cookies _ga and _ga_*, retained up to 2 years. We do not send names, email addresses or phone numbers, and email addresses and sensitive query parameters are stripped from the page paths we record.
• Advertising (off by default) — Google Ads conversion measurement and click identifiers (gclid, gbraid, wbraid; cookies _gcl_*), retained up to 90 days, used to attribute an enquiry or purchase to an advertisement. Click identifiers are only retained while this category is on.

Analytics and advertising are only used where the relevant measurement IDs are configured for this site; where they are not, no such cookie is set at all.

We will update this page when our processing changes and revise the date at the top. Material changes affecting account holders are notified by email at least 14 days before they take effect.