Audit Pro Mobile · Audit Pro portal · audit-pro.co.uk
Privacy Policy
Last updated: 26 September 2026
Who we are and what this covers
This policy is published by Audit-Pro Ltd (“Audit-Pro”, “we”, “us”), a company registered in England and Wales under company number 16429098, registered office 20 Hepworth Gardens, Wakefield, WF1 3FH, England. You can contact us about anything in this policy at support@audit-pro.co.uk.
It covers:
- Audit Pro Mobile, our app for iPhone and Android, which people use at work to fill in forms, inspections and reports (“the app”);
- the Audit Pro portal at portal.audit-pro.co.uk, where organisations manage their forms, records and users (“the portal”); and
- this website, audit-pro.co.uk.
Our TightnessPro app has its own policy, at audit-pro.co.uk/legal/tightnesspro-privacy.html.
The short version
- You use Audit Pro because an organisation, usually your employer, uses it and has given you access. That organisation decides what its forms collect and what happens to the records. We store and process those records for it.
- You sign in to the app with your work email address and a one-time code. There is no password in the app.
- The app does not ask for your location, contacts or microphone. It uses the camera or your photo library only when you choose to add a photo to a form.
- There is no advertising, analytics or tracking in the app, the portal or this website. We do not sell personal data.
- Our servers are in the United Kingdom. Photos and other files are stored with Cloudflare in the European Union.
Who is responsible for your data
Audit Pro is a business service. Organisations (“customers”) subscribe to it and invite their staff and contractors to use it. Under UK data protection law (the UK GDPR and the Data Protection Act 2018):
- Your organisation is the controller of the work records created in Audit Pro. These include the forms you complete, and the answers, photos and signatures in them, as well as reports, jobs, timesheets and any other records it keeps in the portal. It decides why and how those records are used. Audit-Pro is its processor: we handle them only on its instructions and under our contract with it.
-
Audit-Pro is the controller of a smaller set of information that we need
to run the service safely:
- sign-in and security records;
- app diagnostic logs;
- records of the emails we send;
- our business customers' contact and billing details; and
- messages sent to us through this website.
If you have a question about a work record, for example why a form asks for something or how long your employer keeps it, please ask your organisation first. If you contact us, we will pass the request on to them and help them answer it.
What the app collects
Your sign-in details
To sign in, you enter your work email address and choose the organisation you belong to. We email you a one-time code, which lasts 10 minutes. The app then keeps a sign-in token so that you do not have to sign in again each time. That token is held in your phone's secure storage: the Keychain on iPhone, encrypted storage on Android. The app also shows the name your organisation has set for you.
What you enter into forms
This is whatever the form asks for: answers, notes, readings, photos taken with the camera or picked from your photo library, and signatures drawn on screen. The app asks for camera or photo library access only when you add a photo.
Photos can carry hidden details (“metadata”) recorded by your camera, which on some phones includes the place a photo was taken. The app compresses photos before sending them, and that normally removes this metadata. It is not guaranteed: if compression would not make a photo smaller, the original file is sent unchanged. If you do not want location data in photos, turn off location tagging in your camera settings. The app itself never asks for or reads your location.
A device identifier
When the app is first installed, it creates a random identifier for that installation. It is not your phone's hardware identifier or an advertising identifier. It lets us tell which installation a fault report came from.
Notifications
If you allow notifications, the app registers a notification token with us, along with whether the phone is an iPhone or Android. The token comes from Google's Firebase Cloud Messaging service. We keep the token so that we can tell you about things such as new jobs or a request to edit a form. It is removed when you sign out. Notifications are kept short and do not contain your form answers. A notification about a new job can include the job's title and date.
Diagnostic and crash information
When something goes wrong in the app, it records a short technical log. The log contains:
- the warning or error message and, for a crash, the technical “stack trace”;
- the time;
- the app version;
- whether the phone is an iPhone or Android, and its operating system version; and
- the device identifier described above.
While you are signed in, these logs are sent to us automatically and linked to your account and organisation, so that we can find and fix problems. Routine activity is not logged, only warnings and errors. An error message can sometimes include technical details of what the app was doing at the time.
Face ID and fingerprint
Some features let you confirm who you are with Face ID or a fingerprint. That check is carried out entirely by your phone's operating system. The app only learns whether it succeeded, and we never receive any biometric data.
What the app does not do
The app does not use location services, your contacts, the microphone or advertising identifiers. It contains no analytics, advertising or crash-reporting services from other companies. Firebase is used only to deliver notifications, and its analytics features are switched off.
What the portal collects
- Your account: name, email address, role and the organisation or organisations you belong to. Portal passwords are stored only in a one-way hashed form, never in readable text.
- Records your organisation keeps: submitted forms, photos, signatures, reports, jobs and messages. If your organisation uses timesheets, they can also include hours worked, home address, pay rates and pay amounts. Home address and pay details are additionally encrypted in our database.
- In your browser: when you sign in, the portal keeps a sign-in token in your browser's local storage for up to 24 hours. It also sets a security cookie that protects forms against cross-site attacks, and a cookie that remembers your light or dark display preference. The portal uses no advertising or analytics cookies.
Emails we send
We send emails that the service needs, such as:
- sign-in codes;
- invitations to the app and the portal;
- password resets;
- notices that you have been given access; and
- invoices to our business customers.
We keep a record of each email sent: who it went to, the subject and the message. Sign-in codes and secure links are blanked out of that record. We do not send marketing emails through the service.
This website
- This website sets no cookies and uses no analytics.
- The contact form on this website is received by our own portal and delivered to us by email through Microsoft 365. It contains the name, email address, company name if supplied, and message you enter. We use that information to respond to your enquiry. A copy of the message is kept in our record of emails sent, for the period shown in the retention table below. To protect the form from abuse, our portal also notes the IP address each message was sent from, and limits how many messages one address can send in a short time.
Server logs
Like any web service, our servers record technical errors. Those records can include the IP address and browser details of the request involved. We use them to keep the service secure and working.
Why we use personal data, and our lawful basis
- Work records we process for your organisation: used only to provide the service to your organisation, on its instructions. Your organisation decides the lawful basis. Usually that is the performance of your contract with it, its legitimate interests, or a legal obligation such as health and safety record-keeping.
- Sign-in, security and diagnostic records: our legitimate interests in keeping the service secure, preventing misuse and fixing faults.
- Business customer contact and billing details: performing our contract with the customer, and our legal obligations to keep accounting records.
- Website enquiries: our legitimate interest in answering you, or taking steps at your request before entering into a contract.
Who we share data with
We do not sell personal data or share it for marketing. We use these service providers to run Audit Pro. Each processes data only to provide its service to us:
| Provider | What for | Where |
|---|---|---|
| IONOS SE | The server that runs the portal, the app's back end and our databases | London, United Kingdom |
| Cloudflare, Inc. (R2) | Storage of photos, signatures, documents and other files attached to records | European Union |
| Microsoft (Microsoft 365) | Sending the service's emails, including delivering this website's contact form messages to us | See “International transfers” |
| Google (Firebase Cloud Messaging) | Delivering notifications to the app. Google receives the notification token and the notification's text | See “International transfers” |
| Apple | Delivering notifications to iPhones | See “International transfers” |
We will also share information if the law requires it, or to protect the rights or safety of people using the service.
International transfers
Our main database and application server are in the UK, and attached files are held in the EU, which the UK recognises as providing adequate protection. Microsoft, Google and Apple may process data in other countries, including the United States. Where that happens, we rely on the safeguards UK law provides for such transfers, such as UK adequacy regulations or the UK International Data Transfer Addendum to the providers' standard contractual clauses.
How long we keep data
| What | How long |
|---|---|
| Work records (forms, photos, signatures, reports, timesheets) | As long as your organisation keeps them, under its own retention rules and our contract with it |
| One-time sign-in codes | Stored only in hashed form; the record is deleted after 30 days |
| Sign-in attempt records | 1 year, or sooner if your account is erased |
| Record of emails sent | 180 days, or sooner if your account is erased |
| In-portal messages | 90 days after being read; 1 year if never read |
| Notification token | Until you sign out, your account is erased, or the token stops working |
| App diagnostic logs | 90 days, or sooner if your account is erased |
| Database backups | 30 days, then automatically deleted |
| Billing records for business customers | As long as UK law requires us to keep accounting records |
On your phone
- A form you have sent is removed from your phone 30 days after it was sent, together with its photos.
- The phone's copy of a photo is removed once the portal confirms it has received the photo.
- Forms you have not yet sent are never removed automatically. They stay until you send or discard them.
- Signing out removes your sign-in details from the phone. Forms stored on the phone stay there until the rules above remove them. Uninstalling the app removes everything the app has stored on the phone.
How we protect data
- All traffic between the app, your browser and our servers is encrypted in transit (HTTPS).
- One-time codes expire after 10 minutes and are stored only in hashed form. After five wrong codes, the account is locked for 30 minutes.
- Sensitive fields, such as home addresses and pay details, are encrypted in our database.
- Database backups are made daily and encrypted before they leave the server. A second encrypted copy is kept in a separate location under our control.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how your data is used;
- object to our use of your data where we rely on legitimate interests; and
- ask for data you gave us in a portable, machine-readable form, where that applies.
For work records, your organisation is the controller, so the request is best made to it. You can also email us at support@audit-pro.co.uk. We will act on anything we control, and we will pass the rest to your organisation and help it respond. We reply within one month. We may need to confirm your identity first, usually by replying to the email address on your account.
To close your Audit Pro account, see how to delete your account.
If you are unhappy with how your data has been handled, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.
Children
Audit Pro is a workplace tool for adults and is not intended for anyone under 16. We do not knowingly collect data from children.
Changes to this policy
If we change how we handle personal data, we will update this page and the date at the top. If a change is significant, we will also tell our business customers.
Contact
Audit-Pro Ltd, 20 Hepworth Gardens, Wakefield, WF1 3FH, England.
Email: support@audit-pro.co.uk