Privacy Policy

1. What we collect

We collect only what the Service needs to operate:

• Account information. Your name or firm name, email address, and password (stored as a hash by our authentication provider, never in plain text by us).
• Uploaded financial records and evidence files. The bank statements, ledgers, accounting exports, and other documents you upload for a review, along with the findings and reports generated from them.
• Payment metadata. Billing is processed by Stripe. We receive metadata such as the amount, date, and payment status. We never see or store your card numbers.
• Contact form submissions. The name, email, and message you send through the contact form or to our support address.
• Technical logs. Standard server logs (IP address, request path, timestamps, errors) used for security and troubleshooting.

2. How we use information

We use the information above for four purposes:

• Providing the audit service: storing and hashing your evidence, running the analysis you request, and generating your reports.
• Billing: charging for reviews and maintaining payment records.
• Support: answering your questions and investigating problems you report.
• Security: protecting accounts, detecting abuse, and keeping the Service reliable.

We do not use your information for advertising, and we do not sell it to anyone.

3. Evidence handling

Evidence files are the most sensitive thing you give us, and they are treated accordingly. Every file is SHA-256 hashed at upload so its integrity can be verified at any time. Files live in access-controlled storage, reachable only through the engagement they belong to.

We do not sell your data. We do not use your customer records for anything except the engagement you uploaded them for: no training, no analytics products, no secondary uses.

4. Service providers

We rely on a small set of providers to run the Service. Each receives only what its role requires:

• Supabase: application database, file storage, and authentication.
• Stripe: payment processing. Card details go directly to Stripe and never touch our servers.
• Resend: transactional email (confirmations, password resets, notifications).
• Vercel: application hosting.
• Cloudflare: DNS and Turnstile bot protection on public forms.

5. Data retention

We keep your account information, evidence, and reports while your account is active, because a completed review only has value if its evidence trail remains intact. If you want your data deleted, email hello@oaetrustresolution.com and we will delete your account data, except for records we are legally required to keep (such as payment records).

6. Security

Honestly stated: no system is perfectly secure, and we do not claim ours is. What we do: all traffic is encrypted in transit (TLS); evidence is SHA-256 hashed at intake so tampering is detectable; the application runs behind authentication with no anonymous surface beyond the public marketing pages and the deliberately scoped attorney response portal; access to production systems is restricted; and passwords are handled by our authentication provider, not stored by us.

If we learn of a breach affecting your data, we will notify you as required by applicable law.

7. Your rights

You can access the data in your account at any time by signing in. To request a copy of your data, correct something we hold about you, or have your data deleted, email hello@oaetrustresolution.com. We respond to every request and will verify that the request comes from the account owner before acting on it.

8. Children

The Service is a professional tool for attorneys, accountants, and firms. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. When we do, we will update the effective date at the top of this page, and for material changes we will make reasonable efforts to give notice (for example, by email or an in-product notice).

10. Contact

Questions about this policy or how your data is handled? Write to hello@oaetrustresolution.com.