Privacy Policy

1. Scope and our role

SevAudit is a product of Client Care Nest, LLC (“Client Care Nest,” “we,” “us,” or “our”). This Privacy Policy applies to sevaudit.com and the SevAudit internal audit workspace (the “Service”). Client Care Nest provides the Service as a hosted workspace for planning audit work, organizing evidence, collaborating, documenting findings, and preparing reports.

For account, security, and service-administration information, Client Care Nest determines how that information is processed. For audit content entered or uploaded by an organization’s users, the organization generally controls the purpose of the processing and Client Care Nest processes the content to provide the Service. Your organization may have its own privacy obligations and policies.

2. Information we collect

Account and profile information

We process your name, email address, authentication provider, workspace membership, role, permissions, and related account settings. If you sign in with Microsoft, Microsoft provides the account information needed to authenticate you. Email-password credentials are handled by Firebase Authentication; SevAudit does not receive your plaintext password.

Workspace and audit content

We process information users choose to create in the Service, including projects, assignments, audit steps, findings, recommendations, comments, direct and team messages, reports, evidence records, external document links, and uploaded files. This content may contain personal, confidential, or sensitive business information selected by the customer.

Technical and activity information

We process session identifiers, sign-in and security events, record timestamps, workspace activity, feature state needed to operate the interface, and basic device or network information processed by our hosting and authentication providers, such as IP address and user agent.

Communications

We process contact details and delivery status needed to send account-verification, password-reset, and workspace-invitation emails and to respond to support or privacy requests.

3. How we use information

• Provide, maintain, and secure the Service.
• Authenticate users and enforce workspace, role, and project permissions.
• Store, display, export, and share workspace content as users direct.
• Send transactional messages, including verification, recovery, and invitation emails.
• Diagnose failures, prevent abuse, enforce limits, and protect users and the Service.
• Comply with law and establish, exercise, or defend legal claims.

SevAudit does not sell personal information and does not share it for cross-context behavioral advertising. The Service does not currently use advertising cookies or third-party behavioral advertising trackers.

4. Cookies and local storage

SevAudit uses technologies that are necessary to operate the Service. These include an HTTP-only session cookie, a workspace-selection cookie, Firebase authentication storage, and browser local storage used for interface preferences, session activity, and read-message state. The sign-in session has an absolute duration of up to 12 hours. We do not currently respond to browser “Do Not Track” signals because we do not track users across unrelated websites for advertising.

5. When we disclose information

We disclose information only as needed to provide and protect the Service, at a customer’s direction, or when required by law. Categories of recipients include:

• Authorized workspace users. Owners, managers, auditors, members, or guests may see content according to their assigned permissions.
• Google Firebase and Google Cloud. Authentication, hosting, database, and file-storage infrastructure.
• Twilio SendGrid. Transactional email delivery.
• Microsoft. Authentication when a user chooses Microsoft sign-in.
• External document providers. If a user saves or follows a link to a third-party drive or document service, that provider’s terms and privacy practices apply.
• Legal and organizational events. Regulators, courts, advisers, or a successor in a merger, financing, reorganization, or sale, where legally permitted and subject to appropriate protections.

6. Retention and deletion

We retain account and workspace information while needed to provide the Service and for legitimate security, legal, and operational purposes. Workspace owners can download a portable workspace archive, archive a workspace as read-only, schedule deletion with a 30-day recovery period, and permanently delete eligible workspace content through Profile settings. Identity deletion is available when the identity does not belong to another retained workspace. Provider backups, narrowly scoped security records, deletion tombstones, and deletion queues may retain limited copies for a reasonable or legally required period. Deleting a SevAudit link does not delete content stored with an external document provider.

For assistance with account-level access, correction, export, or deletion, contact us at privacy@sevaudit.com. We may need to verify your identity and, for organization-controlled content, coordinate with your workspace owner.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information, including HTTPS, provider encryption at rest, authenticated access, role and project permissions, and time-limited sessions. No online service can guarantee absolute security. Customers remain responsible for configuring permissions appropriately, protecting their credentials, and deciding what information is suitable to place in the Service.

8. Your privacy choices and rights

You may edit your display name and password in Settings, manage workspace access if authorized, and, as a workspace owner, download a portable copy of the current workspace. You may also request access to, correction of, or deletion of personal information by emailing us. Depending on where you live, you may have additional rights. California residents may have rights to know, correct, or delete personal information, to limit certain uses of sensitive personal information, and to opt out of sale or sharing. SevAudit does not sell personal information or share it for cross-context behavioral advertising, and we will not discriminate against you for exercising applicable privacy rights.

Authorized agents may submit a request where permitted by law. We may request proof of authority and identity. Some information may be retained where an exception applies, including for security, legal compliance, or completing the service requested.

9. International processing

SevAudit and its providers may process information in the United States and other locations where they operate. Those locations may have different data-protection laws than your jurisdiction.

10. Children

The Service is intended for professional and organizational use and is not directed to children under 18. We do not knowingly collect personal information from children through the Service.

11. Changes and contact

We may update this policy as the Service or law changes. We will revise the effective date and provide additional notice when appropriate. Questions or privacy requests for Client Care Nest, LLC regarding SevAudit may be sent to privacy@sevaudit.com.