AutoSmart Audit Privacy Policy
Last updated: 01.09.2026
1. About this policy
This policy explains how Meraki Hub Technologies (UAE) and AutoSmart Solutions Private Limited (India) (“AutoSmart”, “we”, “us”, “our”) collects, uses, shares, stores and protects personal data in AutoSmart Audit (the “Platform”), our audit management platform provided to organisations through web and mobile applications.
It applies to everyone who uses the Platform on behalf of a client organisation, including auditors, reviewers, approvers, dealer and facility staff, and administrators. It does not cover our marketing website or other AutoSmart products, which have their own notices.
Please read this policy together with your organisation’s own privacy notice. If anything in this policy is unclear, contact us using the details in Section 15.
2. Definitions
| Term | Meaning |
|---|---|
| Platform | AutoSmart Audit, including its web application, mobile applications and related services |
| Client | The organisation that has an agreement with AutoSmart to use the Platform, such as a vehicle manufacturer, distributor or dealer group |
| User | A person given access to the Platform by a Client, such as an auditor, reviewer, approver or administrator |
| Personal data | Any information that identifies, or can be used to identify, a living individual |
| Data controller | The organisation that decides why and how personal data is processed. For the Platform, this is the Client. |
| Data processor | The organisation that processes personal data on the controller’s behalf and on its instructions. For the Platform, this is AutoSmart. |
| Sub-processor | A third-party service provider that AutoSmart engages to help provide the Platform |
3. Our role
AutoSmart provides the Platform to Clients under a written agreement. For the personal data processed in the Platform:
- the Client is the data controller. It decides which users are added, which dealer centres or facilities are evaluated, which features are enabled, and how long data is kept.
- AutoSmart is the data processor. We process personal data only to provide the Platform, on the Client’s documented instructions and under our agreement with it.
This means your organisation is your first point of contact for questions or requests about your data. Where we receive a request directly, we pass it to your organisation and help it respond (Section 12).
AutoSmart acts as an independent controller only for limited data it needs to run its own business, such as billing contacts at the Client and records needed to meet AutoSmart’s own legal obligations.
4. Information we collect
4.1 Account information
- Name (required), so other users can identify who carried out or approved an audit
- Work email (optional, and not required where your organisation uses single sign-on), used for sign-in, one-time passwords and notifications
- Audit system role, such as auditor, reviewer, approver or administrator, which controls what you can see and do
- Dealer centres or facilities assigned to you for evaluation
- Login details, or single sign-on identifiers where your organisation signs you in through its own identity provider
4.2 Audit content
Audit records, checklist responses, scores, findings, non-conformities, corrective action plans, comments, approvals, sign-offs and uploaded documents created while carrying out or reviewing an evaluation.
4.3 Audit photos
Photos taken as part of an evaluation, linked to the user who uploaded them for audit-trail purposes. Any faces or vehicle number plates captured in photos are automatically blurred before the photo is stored. Location stamps are added to photos only where your organisation enables this feature.
4.4 Voice input
Where your organisation has enabled the voice feature, spoken audit notes are converted into text. Audio recordings are not stored; only the resulting text is saved to the audit.
4.5 Activity and technical data
Login times, actions performed in the Platform (such as creating, editing, submitting or approving an audit), IP address, device type, operating system, app version and error logs. This data keeps the Platform secure and maintains an accurate audit trail.
4.6 What we do not collect
- We do not collect special categories of personal data, such as health, biometric, religious or financial data, through the Platform.
- The Platform is not used to collect data about our Clients’ own end customers.
- We do not use advertising identifiers or track your activity across other apps or websites.
5. Where your information comes from
| Source | Examples |
|---|---|
| Your organisation | Your administrator creates your account, assigns your audit system role and assigns dealer centres or facilities to you |
| You | Audit responses, comments, photos, documents and voice notes you add while using the Platform |
| Your organisation’s identity provider | Your name and sign-in identifiers, where your organisation uses single sign-on |
| Automatically | Activity, device and technical data generated when you use the Platform |
6. How we use information
We use personal data only to provide the Platform to our Clients. The table shows each purpose and its legal basis. Where we act as processor, the Client determines the legal basis for its own processing; the bases below describe the processing we carry out to deliver the service.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage user accounts, roles and assignments | Account information | Performance of our agreement with the Client |
| Carry out, review and approve evaluations | Account information, audit content, audit photos, voice input | Performance of our agreement with the Client |
| Sign users in securely, including single sign-on and one-time passwords | Account information, technical data | Performance of our agreement; legitimate interest in keeping the Platform secure |
| Send notifications about assigned audits, findings, approvals and actions | Name, work email | Performance of our agreement with the Client |
| Keep an accurate audit trail of who did what and when | Account information, activity data | Performance of our agreement; the Client’s legitimate interest in reliable audit records |
| Provide support and fix problems | Account information, technical data, relevant audit content | Performance of our agreement with the Client |
| Monitor, protect and improve the Platform’s security and performance | Activity and technical data | Legitimate interest in providing a secure and reliable service |
| Meet legal, regulatory and contractual obligations | Any relevant data | Legal obligation |
We do not sell personal data. We do not use Client data for advertising, for profiling users, or for any purpose of our own outside providing the Platform.
6.1 AI-assisted features
Some Platform features use artificial intelligence. Voice-to-text and approval assistance are optional add-ons: they apply only where the Client has purchased and enabled them, and no data is processed by them otherwise. Blurring of faces and number plates is a standard privacy safeguard applied to all audit photos.
| Feature | What it does | Data used |
|---|---|---|
| Face and number plate blurring | Detects and blurs faces and vehicle number plates in audit photos before storage | Audit photos |
| Voice-to-text | Converts spoken audit notes into text | Voice input; audio is not stored |
| Approval assistance | Checks submitted audit responses and evidence, and suggests points for the reviewer to consider | Audit responses, comments and evidence for the audit being reviewed |
AI features support people; they do not replace human judgement. Every AI-assisted output is reviewed by an authorised user before an audit is approved or published. AI processing runs only on the data needed for the feature, under the same security controls as the rest of the Platform. Client data is not used to train AI models.
6.2 Automated decision-making
The Platform does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. Audit scores and outcomes relate to dealer centres and facilities, and are reviewed and approved by people.
7. Mobile app permissions
The mobile app asks for device permissions only when a feature needs them. You can change these permissions at any time in your device settings, although some features may then stop working.
| Permission | Why it is needed |
|---|---|
| Camera | To take audit photos as evidence during an evaluation |
| Photos and files | To attach existing photos or documents to an audit |
| Microphone | To record voice notes, only where the voice feature is enabled |
| Location | To add location stamps to photos, only where your organisation enables this feature |
| Notifications | To alert you about assigned audits, approvals and actions |
8. How we share information
We share personal data only in the following cases:
- With your organisation (the Client) and other users it authorises, according to the roles and access it sets
- With service providers (sub-processors) that help us run the Platform, under written contracts that require confidentiality, data protection and security
- With authorities, where the law requires it, after we have validated the request
- In a business transfer, such as a merger or acquisition, where the Platform continues under the same protections and Clients are informed
Our sub-processors include cloud hosting and email delivery (Amazon Web Services) and Google services used through their APIs only, such as mapping and, where the Client has enabled them, the generative AI service behind voice-to-text and approval assistance. The full, current list, with what each sub-processor does, is published on our Sub-processors page.
We assess each sub-processor’s security and privacy practices before engaging it and review them periodically. We tell our Clients in advance before adding or replacing a sub-processor.
8.1 What your organisation’s administrators can do
Your account is managed by your organisation. Its administrators can:
- create, edit or deactivate your account
- assign or change your audit system role and the dealer centres or facilities assigned to you
- view audits, photos, comments and activity within your organisation’s account
- export data, and hide records from view (hidden records are not permanently deleted; permanent deletion is carried out by AutoSmart on the organisation’s request)
For more information about how your organisation uses this access, please refer to its own privacy notice.
9. Where your data is stored
The Platform is hosted on Amazon Web Services. Each Client’s application data, backups and disaster recovery environment are kept in the AWS region or regions agreed with that Client, based on its data-residency requirements, and recorded in our agreement with it.
If personal data is transferred to, or accessed from, a country outside the agreed region, we put recognised safeguards in place before the transfer, such as:
- an adequacy decision covering the destination country
- the EU Standard Contractual Clauses
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
10. How long we keep data
We keep personal data only for as long as the Client’s agreement requires, or as needed to meet legal obligations.
| Data | How long it is kept |
|---|---|
| Platform data (accounts, audit content, photos) | For the duration of the Client’s agreement, or until the Client asks us to delete it. Deleted from active systems within 30 days after the agreement ends, or sooner on the Client’s instruction. |
| Backups | 7 days on a rolling basis, then deleted automatically |
| Records removed by an administrator | Hidden from the Platform straight away. Permanently deleted on the organisation’s request, and then removed from backups at the end of the 7-day backup cycle |
| Voice recordings | Not stored; only the converted text is kept |
On request, we confirm deletion to the Client in writing. Where the law requires us to keep certain records for longer, we keep only what is required and protect it in the same way.
11. How we protect your data
AutoSmart is certified to ISO/IEC 27001:2022 and has completed a SOC 2 Type II examination. Our safeguards include:
- encryption in transit (TLS 1.2 and 1.3; older versions disabled) and AES-256 encryption at rest
- role-based access control, so users and staff see only what their role needs
- multi-factor authentication, and single sign-on where the Client enables it
- logging and monitoring of activity, with threat detection and alerting
- automatic blurring of faces and vehicle number plates in audit photos
- each Client’s data kept separate from other Clients’ data
- daily encrypted backups and a tested disaster recovery plan
- regular vulnerability assessments and independent penetration testing
- confidentiality agreements and mandatory privacy and security training for all staff
No system is completely secure, but we review and strengthen these safeguards regularly.
11.1 If a data breach happens
We have a documented incident response process. If a personal data breach affects Platform data, we notify the affected Client without undue delay, with the information it needs to assess the breach and meet its own legal obligations. We contain the incident, investigate its cause, and put measures in place to prevent it happening again.
12. Your rights
Depending on where you are, you may have the following rights under data protection laws such as the EU GDPR, UK GDPR and India’s Digital Personal Data Protection Act, 2023:
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data held about you |
| Correction | Ask for inaccurate or incomplete data to be corrected |
| Deletion | Ask for your data to be deleted, where there is no reason to keep it |
| Restriction | Ask for processing of your data to be limited |
| Objection | Object to processing based on legitimate interests |
| Portability | Ask for your data in a commonly used, machine-readable format |
How to make a request. Your organisation controls your Platform data, so please send requests to your organisation’s administrator first. If you contact us directly, we will verify the request, pass it to your organisation without undue delay, and help it respond within the time the law allows.
We will ask you to verify your identity before acting on a request. Some rights are subject to legal limits and exceptions; if a request cannot be met in full, we will explain why. Where any processing relies on consent, you can withdraw that consent at any time.
If you have a concern about how your data is handled, contact us and we will work to resolve it. You also have the right to complain to your local data protection authority.
13. Your responsibilities
To help protect personal data on the Platform, we ask users to:
- keep sign-in details and one-time passwords confidential
- add only the information needed for the evaluation, and avoid entering unnecessary personal data in comments or uploads
- report any suspected unauthorised access to their organisation’s administrator straight away
14. Cookies, app storage and other services
The Platform uses only the essential cookies and app storage needed to sign you in, keep your session secure and remember basic settings. The Platform does not use advertising cookies or third-party tracking cookies, and these essential cookies cannot be switched off without stopping the Platform from working.
Other services. The Platform may link to services operated by others, such as your organisation’s own sign-in page. Those services are governed by their own privacy policies, and we are not responsible for how they handle your information.
15. Children, changes and contact
Children. The Platform is intended for business use and is not intended for anyone under 18. We do not knowingly collect personal data from children.
Changes to this policy. We may update this policy to reflect changes to the Platform, our practices or the law. Material changes will be shown by an updated “Last updated” date at the top, and we will inform Clients in advance of any change that materially affects how their data is processed.
Contact us. For questions about this policy, or to make a request, contact:
Data Protection Point of Contact
Email: privacy@autosmarts.co
Meraki Hub Technologies
610, Amna Building, Dubai Silicon Oasis, Dubai, UAE
AutoSmart Solutions Private Limited
4, 31/835, V Square, Pulikillam West, Kakkanad, Ernakulam 682 030, Kerala, India
Appendix: GDPR and UK GDPR
This appendix applies where the EU General Data Protection Regulation (GDPR) or the UK GDPR and Data Protection Act 2018 apply to the processing of your personal data.
Controller and processor. For personal data in the Platform, the Client (your organisation) is the controller and AutoSmart is its processor. We process that data only on the Client’s documented instructions, under a data processing agreement that meets Article 28 of the GDPR. Questions about why your data is processed should go to your organisation first.
Legal basis. The Client decides the legal basis for its processing. The bases for the processing we carry out to deliver the service are set out in Section 6.
International transfers. Each Client’s data is hosted in the AWS region agreed with it. Where personal data is transferred to, or accessed from, a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement or the UK Addendum, together with appropriate supplementary measures.
Your rights in detail.
- Access: you can ask for a copy of the personal data held about you.
- Rectification: you can ask for inaccurate or incomplete data to be corrected.
- Erasure: you can ask for your data to be deleted, for example where it is no longer needed for the purpose it was collected for.
- Restriction: you can ask for processing to be limited, for example while the accuracy of your data is being checked.
- Objection: you can object to processing based on legitimate interests.
- Portability: you can ask for data you provided, and that is processed by automated means, in a structured, commonly used and machine-readable format.
- Automated decisions: you have the right not to be subject to decisions based solely on automated processing that significantly affect you. The Platform does not make such decisions (Section 6.2).
These rights are subject to legal limits and exceptions. Because your organisation is the controller, we will pass any request we receive to it and help it respond, normally within one month.
Complaints. If you are unhappy with how your data is handled, please contact us first at privacy@autosmarts.co. You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk). In the EU or EEA, you can contact the data protection authority in the country where you live or work, or where the issue occurred (list of EU authorities).