Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

AuditStream AI
Trading name — not yet incorporated as a legal entity
Belgium
Email: hello@auditstream.ai

AuditStream AI is operated by its co-founders Jeroen De Backer and Thomas Van der Auwermeulen, both resident in Belgium. For all data protection matters, you can contact us at the email address above.

2. Data We Collect

We collect personal data in the following circumstances:

2.1 Compliance Checker Form

When you complete our free EU AI Act compliance checker and submit your contact details, we collect:

• First name and last name
• Work email address
• Company name
• Telephone number (optional)
• Topic of interest (optional, selected from a dropdown)
• Your answers to the checker questionnaire (risk classification inputs)

2.2 Contact Form

When you submit an enquiry via our contact page, we collect your name, email address, company, and the content of your message.

2.3 Analytics Data

We use Google Analytics 4 (GA4) to collect anonymised browsing data including pages visited, session duration, device type, browser, and approximate geographic location (country/city level). This data does not directly identify you. See our Cookie Policy for details.

2.4 Data We Do Not Collect

We do not collect, access, or store the contents of any AI datasets, training data, or production data that our clients may reference in discussions. Any such data shared during a paid audit engagement is governed by a separate Data Processing Agreement.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

Where we rely on legitimate interests, you have the right to object to this processing at any time. See Section 7.

4. Purposes of Processing

We use your personal data for the following purposes:

• To deliver your free EU AI Act compliance report following completion of the checker
• To follow up with personalised guidance relevant to your risk classification
• To respond to enquiries submitted via our contact form
• To manage our sales pipeline and client relationships using internal tools (Slack, Google Sheets)
• To analyse website usage and improve our service using Google Analytics
• To comply with our legal obligations under Belgian and EU law

We will not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Recipients and International Transfers

Your personal data may be shared with or processed by the following categories of recipients:

We do not sell, rent, or trade your personal data to any third party. We do not share your data with advertisers.

All transfers to the United States are conducted under the EU–US Data Privacy Framework or Standard Contractual Clauses adopted by the European Commission.

6. Retention Periods

At the end of each retention period, data is securely deleted or anonymised.

7. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR (Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018 on the Protection of Natural Persons with regard to the Processing of Personal Data:

• Right of access Art. 15 — obtain confirmation of whether we process your data and a copy of it
• Right to rectification Art. 16 — correct inaccurate or incomplete data
• Right to erasure Art. 17 — request deletion of your data where no overriding legal basis exists
• Right to restriction Art. 18 — limit how we process your data in certain circumstances
• Right to data portability Art. 20 — receive your data in a structured, machine-readable format
• Right to object Art. 21 — object to processing based on legitimate interests at any time
• Right to withdraw consent Art. 7(3) — withdraw consent for analytics cookies at any time without affecting prior processing

To exercise any of these rights, contact us at hello@auditstream.ai. We will respond within 30 days in accordance with Article 12 GDPR. We may request proof of identity before processing your request.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 GDPR. These measures include:

• HTTPS encryption for all data in transit
• Access controls limiting who within our team can access lead data
• Use of established, GDPR-compliant third-party platforms (Google Workspace, Slack)
• Regular review of access permissions

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority within 72 hours in accordance with Article 33 GDPR, and notify you directly if the risk is high.

9. Minors

Our services are directed exclusively at professionals and business users. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected data from a minor, please contact us immediately at hello@auditstream.ai and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page indicates when the most recent revision was made. For material changes, we will notify active clients by email. We encourage you to review this page periodically.

11. Contact

For any questions about this Privacy Policy or to exercise your data protection rights:

AuditStream AI
Email: hello@auditstream.ai

We aim to respond to all privacy-related enquiries within 5 business days, and in any event within the 30-day period required by GDPR.