Last updated: 25 August 2026
Auditastical is a product of Grantastical, the trading name of Grant Finlayson, operating as a self-employed sole trader in the United Kingdom. This policy explains what information is collected through auditastical.com and the Auditastical service, why, and what you can do about it.
To run the free instant check: the business name, website, and email address you submit. To subscribe: your email address, and the API key(s) you supply to bring your own AI provider access (see "API keys" below). To pay: Paddle, our payment provider, collects your payment details directly — Auditastical never sees or stores your card details.
A paid subscription requires your own Anthropic API key (a Brave Search key is optional). These are encrypted (AES-256-GCM) before being stored, and are only decrypted, in memory, for the seconds it takes to run an audit you've requested — never logged, never shown in any dashboard or API response after you first submit them, and never sent anywhere other than the AI provider itself to run your audit.
If you cancel your subscription, your stored API keys are deleted immediately as part of cancellation processing — not retained "just in case." If you start a subscription signup but never complete payment, the keys submitted are automatically deleted within 24 hours.
To run the audits you request, deliver reports by email, process your subscription payment (via Paddle), and calculate affiliate commission where a referral is involved. If you opt in to the email list separately, your email is used to send occasional updates — you can unsubscribe at any time.
Application data (business records, audit findings, subscription and billing-event records, encrypted API keys) is stored in Supabase, with database access restricted to backend systems only — no public read access exists to any of this data. Email delivery is handled by Brevo. Payment processing, and the personal/payment data that involves, is handled by Paddle.com Market Limited, who act as Merchant of Record for these transactions — see Paddle's own privacy policy at paddle.com/legal/privacy for how they handle payment data.
The site sets one first-party cookie (`auditastical_ref`) when you arrive via an affiliate's referral link, used only to credit that affiliate if you subscribe — no advertising or analytics trackers are used. Standard hosting logs (via Netlify) may record basic technical information such as IP address and browser type, used only for security and site reliability.
Information is not sold or shared for marketing purposes. It is shared only with service providers strictly necessary to deliver the service: Paddle (payment processing and tax), Supabase (application database), Brevo (email delivery), and — solely to run the audit you request, using the API key you supplied — Anthropic and, if you provided one, Brave Search.
Under UK GDPR, you have the right to access, correct, or request deletion of your personal data. To do so, email grant@grantastical.com and I'll respond promptly. Cancelling your subscription deletes your stored API keys immediately, as described above; other account data is retained for standard accounting/record-keeping purposes unless you request deletion.
Questions about this policy can be sent to grant@grantastical.com.
Back to Auditastical