01 Who we are
Capitall India Private Limited (“Capitall”, “we”, “us” or “our”) is the company behind AuditNexia and Audytr AI — an evidence-first governance, risk, audit and compliance platform used by internal audit and controls teams.
This Privacy Policy applies to the website at www.auditnexia.io and associated pages, the AuditNexia and Audytr AI applications, and the sales, support, marketing and event activities we carry out (together, the “Services”). By using the Services or sharing information with us, you confirm that you have read and understood this policy. If you do not agree with it, please do not use the Services.
Capitall India Private Limited is a company incorporated in India under the Companies Act, 2013 (CIN U93090DL2019PTC354741), with its registered office at 3/14, 4th Floor, Asaf Ali Road, Near Delite Cinema, Central Delhi, Delhi – 110002, India.
02 When we are a controller and when we are a processor
Because AuditNexia is enterprise software, personal data flows through us in two different ways, and our responsibilities differ accordingly.
When you visit our website, register for an account, request a demo, contact support or subscribe to our updates, we decide why and how your personal data is handled. This policy governs that data.
When a customer organisation uses AuditNexia to process its own records — which may include personal data about its employees, auditees or third parties — we process that content only on the customer’s documented instructions. The customer is the controller of that data.
03 Information we collect
Information you give us
- Identity and contact details — name, work email, phone number, job title and the organisation you represent, when you register, request a demo, attend an event or contact us.
- Account information — login credentials and profile settings for users of the platform.
- Communications — the content of enquiries, support tickets, feedback and survey responses.
- Billing information — where you are a paying customer, invoicing and payment details (card details are handled by our payment providers, not stored by us).
Information we collect automatically
- Usage and log data — actions taken in the Services, pages viewed, timestamps and diagnostic information used to keep the platform secure and reliable.
- Device and connection data — IP address, browser type, operating system, device identifiers and approximate location derived from your IP.
- Cookies and similar technologies — as described in section 4 and in our Cookie Policy.
Information from other sources
- Referrals and partners — details shared by colleagues who invite you, or by our channel and integration partners.
- Publicly available business information — limited professional details we may use to qualify and personalise our outreach.
Customer content
The records, documents, workpapers and other data that customers upload into AuditNexia (“Customer Content”) may contain personal data. We handle Customer Content as a processor, as described in section 2, and only to provide and support the Services.
05 How we use information
We use the personal data we control for the following purposes:
- To provide, operate, maintain and secure the Services, and to authenticate users.
- To respond to demo requests, enquiries and support tickets.
- To process orders, manage subscriptions and handle billing.
- To improve, troubleshoot and develop new features and products.
- To send service messages and, where permitted, relevant marketing — you can opt out of marketing at any time.
- To detect, prevent and respond to fraud, abuse, security incidents and other harmful activity.
- To comply with applicable laws and lawful requests, and to establish or defend legal claims.
06 Our legal grounds for processing
We process personal data relating to individuals in India in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it, and with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Depending on the situation, we rely on one or more of the following grounds:
- Your consent — for example, when you sign up for marketing or submit an enquiry. You may withdraw consent at any time, without affecting processing already carried out.
- Performance of a contract — to deliver the Services you or your organisation have signed up for.
- Certain legitimate uses permitted by law — such as responding to a request you have made, or safeguarding against misuse and security threats.
- Legal obligation — to meet accounting, tax, regulatory and other statutory requirements.
08 Sub-processors and hosting
The Services are hosted on established cloud infrastructure using data centres operated by reputable providers. We engage a limited set of sub-processors to deliver the Services, each bound by contractual data protection and confidentiality obligations. Where required by a customer agreement, we make our current list of sub-processors available and give notice of material changes so customers can raise any concerns.
09 International data transfers
We are based in India and primarily process data here. Some of our service providers may process data in other countries, which means your personal data may be transferred outside India. Where that happens, we take steps to ensure the data continues to be protected in line with this policy and applicable law, and we transfer data only to jurisdictions permitted under the Digital Personal Data Protection Act, 2023 and any restrictions notified by the Government of India.
10 Data security
We maintain reasonable security practices and procedures designed to protect personal data against unauthorised access, disclosure, alteration and loss. These include encryption of data in transit and at rest, role-based access controls, network safeguards, logging and monitoring, and regular review of our controls. Access to Customer Content is restricted to authorised personnel who need it to operate and support the Services.
11 Data retention
We keep personal data only for as long as we need it for the purposes described in this policy, including to provide the Services, meet our legal, tax and accounting obligations, resolve disputes and enforce our agreements. Customer Content is retained in line with the relevant customer agreement, and returned or deleted on termination as set out there. When we no longer need personal data, we delete it or anonymise it; where that is not immediately possible (for example, data held in secure backups), we isolate it from further use until deletion is possible.
12 Your rights
Subject to applicable law, and in particular the Digital Personal Data Protection Act, 2023, you have the following rights in relation to personal data for which we are the Data Fiduciary:
- Access — to obtain a summary of the personal data we process about you and how we process it.
- Correction and completion — to have inaccurate or incomplete data corrected, completed or updated.
- Erasure — to have your personal data deleted where it is no longer required and we are not obliged to retain it.
- Withdraw consent — where we rely on your consent, you may withdraw it at any time.
- Grievance redressal — to raise a grievance with our Grievance Officer (see section 16).
- Nomination — to nominate another individual to exercise your rights in the event of your death or incapacity.
To exercise any of these rights, contact us using the details in section 16. We may need to verify your identity before acting on a request. If your data is controlled by a customer organisation, please contact that organisation directly; we will assist them as their processor.
13 Children’s data
The Services are intended for organisations and their professional users, and are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without the consent of a parent or lawful guardian as required by law, we will take steps to delete it. If you believe a child has provided us with personal data, please contact us at office@capitall.io.
14 Third-party links
Our website and communications may contain links to third-party websites and services that we do not operate or control. This policy does not apply to those third parties. We encourage you to read the privacy policies of any third-party site you visit; we are not responsible for their content or practices.
15 Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we do, we will revise the “Last updated” date at the top of this page and, where the changes are significant, provide a more prominent notice. Your continued use of the Services after an update means you accept the revised policy.
16 Grievance Officer & how to contact us
If you have any questions, concerns or complaints about this policy or how we handle your personal data, please reach out. In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer who can be contacted as follows:
Grievance Officer — Capitall India Private Limited
We aim to acknowledge grievances promptly and resolve them within the timelines required by applicable law. For general enquiries, you can also write to us at office@capitall.io.