Privacy Policy

inEspect is a product of Easy Audit, an Egyptian company whose activity is digital solutions. References to “we”, “us”, or “the operator” mean Easy Audit, which provides and operates this platform.

This Privacy Policy explains what information Easy Audit (“we”, “us”) — an Egyptian company in digital solutions — collects when you use inEspect (“the platform”), why we collect it, who else can see it, and what you can ask us to do about it. It is written to be read — if anything here is unclear, ask us and we will explain it.

inEspect is a cloud quality operations product — forms, records, reports, analysis, and review evidence for sites that need durable quality work. Food safety is a primary strength; the same patterns apply to other quality domains and site types (factory, store, mall, restaurant, warehouse, lab, distribution hub, and similar). It is not a MES, ERP, or WMS.

1. Definitions

• Personal data — information that identifies a person, directly or indirectly.
• Controller — whoever decides why and how personal data is processed.
• Processor — whoever processes personal data on a controller's instructions.
• Customer — the organization that holds a subscription or company workspace.
• Customer data — what your organization puts into the platform: forms, submissions, review files, CAPA-related records, evidence uploads, and similar quality records.
• Sub-processor — a third party we use that processes data on our behalf.

2. Controller and processor — which is which

Both roles apply, in different places:

• We are the controller for account and billing data — the email and name used to sign in, login and security logs, subscription records, and messages you send us directly.
• We are the processor for customer data. Your organization decides what to put into the platform, who may see it, and how long to keep it. We act on its instructions and do not use it for our own purposes.

So if your question is about a form submission, a review file, or your access inside a company workspace, your organization's administrator is the right first contact. If it is about your login, your subscription, or this policy, ask us.

3. Information we collect

3.1 Account information

Name, email address, password (stored as an Argon2 hash — we never see or store it in readable form), role and department assignments, and whether MFA is enabled. We record sign-in activity and failed sign-in attempts to protect accounts.

3.2 Company information

Company name, contact details you enter during company request or setup, member join codes, sites and related quality context, and subscription status.

3.3 Quality operations data

Everything your organization records in the product for quality work: form definitions and filled submissions, structured answers, immutable review files, evidence uploads, CAPA-related follow-up as features ship, and report/analysis inputs derived from those records.

3.4 Uploaded files

Documents, images, and evidence you upload. These are stored on the infrastructure described in section 6 and are visible only according to the permissions your organization sets.

3.5 Device and technical information

IP address, browser type and version, and session identifiers. These are used to keep the service running and secure — rate limiting, abuse prevention and troubleshooting — and are recorded in security logs.

3.6 Communications

Messages you send through Contact Us, support requests to help@inespect.com or sales@inespect.com, and tenant-private company chat messages between members.

3.7 Payment information

When live checkout is enabled, payments are handled by Paddle (merchant of record; Paymob may be added later). Card details are entered on the provider's checkout and go to the provider, not to us. We do not receive or store complete payment card numbers. We keep the subscription and invoice status records the provider returns — plan, amount, status, and related billing metadata.

4. How we use information

• To provide and operate the platform and the features you use.
• To authenticate users and enforce the permissions your organization sets.
• To send operational email: invitations, setup/reset codes, reminders, and notifications you have not switched off.
• To keep audit trails, detect abuse, and investigate security incidents.
• To take payment and manage subscriptions (when billing is live).
• To answer support requests.
• To comply with legal obligations.

We do not sell personal data, and we do not use customer data to train machine-learning models.

5. Legal bases for processing

Egyptian law governs our processing: Personal Data Protection Law No. 151 of 2020 and its Executive Regulations. It applies because Easy Audit is established in Egypt.

We do not rely on consent for things that keep the service running. Asking for consent to log a failed sign-in, or to hash a password, would be asking a question we could not honour a “no” to.

5.1 What we rely on, activity by activity

• Create and run your account; sign you in; MFA — performance of the contract.
• Send a password reset or setup code — performance of the contract, at your request.
• Service email (notifications, reminders, access requests) — performance of the contract; these are the product working, not marketing.
• Security logging, failed sign-ins, rate limits, lockouts — legitimate interest in keeping accounts and customer data safe.
• Storing and processing what your organization puts in the platform — on your organization's instructions; they are the controller.
• Invoices, tax and accounting records — legal obligation.
• Responding to a lawful request from an authority — legal obligation; we disclose only what the request actually requires.
• Backups / provider durability — legitimate interest in restoring the service after a failure.

5.2 Where the GDPR also applies

Where the GDPR applies as well — see section 18 — we rely on contract, legitimate interests (security and service integrity), legal obligation, and consent only where we ask for it explicitly. For customer data we process on your organization's instructions, the legal basis is your organization's to determine as controller.

6. Where the platform runs, and who else touches data

We use a small number of sub-processors. Each is listed with what it does:

• Neon — managed PostgreSQL database hosting for application data.
• Amazon Web Services (AWS) — private object storage (and related compute as configured) for uploaded files and review copies.
• Paddle — payment processing and merchant of record when live checkout is enabled. See Paddle's own privacy notice for payment data. Paymob may be added later.
• Namecheap Private Email (SMTP) — delivery of outgoing email: invitations, setup/reset codes, reminders and notifications from noreply@inespect.com.
• Legal authorities — we disclose data where we are legally required to. This is not a routine sharing arrangement.

We do not share customer data with advertisers, data brokers, or any third party for their own marketing. See also Subprocessors.

7. International data transfers

Database and file storage run on infrastructure that may be outside Egypt (typically European or other regions configured for Neon and AWS). Two transfers are inherent to how the service runs:

• To us, in Egypt. Our staff administer and support the platform from Egypt, so data on those systems is accessible from there.
• To our email provider. Outgoing messages and the recipient's address pass through the configured SMTP provider.

For each of these we rely on the transfer terms in the agreement with the provider concerned. Egypt's Personal Data Protection Center licensing for cross-border processing is being handled with counsel; we state the gap rather than omit it. If you need a copy of the terms covering a specific sub-processor, ask us.

8. Cookies

We use cookies that are necessary for the platform to work:

• Session cookie — keeps you signed in between pages.
• CSRF token — protects forms against being submitted from another site.

We do not use advertising cookies, and we do not embed third-party tracking cookies on the application. Theme preference may be stored locally in the browser for display only. Blocking the session cookie will stop you being able to sign in. See the Cookie Policy.

9. Multi-tenant separation

Each organization's data is separated by tenant. A user belongs to at most one company workspace and can reach only what their membership and role allow. Every request is checked against those permissions. We do not read customer data except where it is necessary to provide support you have asked for, or to investigate a security incident.

10. Data retention

While an account is active we keep what the account needs. Summary commitments:

• Customer data — kept while your organization has an open account. Your organization can delete records inside the product according to the permissions it sets. Company closure and approved deletion follow the review workflow described on Data Deletion and Data Retention.
• Account data — name, email and role — kept while the account exists and removed with approved deletion, subject to legal holds.
• Security and audit logs — kept while needed for review. Company managers can clear events older than a chosen window (for example 90 days) from the Audit log to free plan storage; that cleanup is logged. Legal holds may require keeping records longer.
• Password / setup codes — expire in about 20 minutes; related issuance records are short-lived.
• Billing records — kept as long as tax and accounting law requires.
• What “deleted” means — leaving the live system is not the same second as every backup copy rotating away. Provider backups may hold copies for a short window; we do not silently claim instant global erasure.

You can ask us to delete your data sooner via Privacy tools or help@inespect.com. Where the law requires us to keep something — an invoice, a record under investigation — we keep that and delete the rest.

11. Data security

What we actually do:

• HTTPS/TLS for production traffic (Nginx).
• Passwords stored as Argon2 hashes; optional TOTP MFA for company users; required MFA for platform admin in production.
• Role-based permissions checked on every request, with tenant separation.
• A Content Security Policy that does not permit unsafe inline scripts.
• Rate limiting and lockouts on sign-in and other sensitive endpoints.
• Append-only security logging of sign-ins, lockouts, MFA, and platform actions.

No system is completely secure, and we do not claim otherwise. We do not currently hold an ISO 27001 or SOC 2 certification. Details: Security.

12. If something goes wrong

If a personal data breach occurs, we will investigate, contain it, and notify affected customers without undue delay so that they can meet their own obligations as controllers. Where the law requires us to notify a supervisory authority, we will. See Incident / Breach Notice.

13. Customer responsibilities

Much of what happens to data in the platform is decided by the customer, not by us. If you administer an organization here, it is on you to:

• Give each person only the access their job needs, and remove it when they leave.
• Decide what data is appropriate to put into the platform, and tell your own staff.
• Have your own legal basis for personal data you enter about employees and others.
• Keep credentials confidential, and use MFA where it matters.
• Answer your own people's data requests about the records you control.

14. Your rights

Depending on where you live, you may have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or incomplete.
• Deletion — ask for data to be erased, where no legal or contractual reason requires us to keep it.
• Portability — receive data you gave us in a structured, machine-readable format. Signed-in JSON export covers much of this already.
• Restriction — ask us to limit how we use data while a dispute about it is resolved.
• Objection — object to processing we base on legitimate interests.
• Withdraw consent — where processing is based on consent.
• Complain — to the Egyptian Personal Data Protection Center, or to your local authority if you are outside Egypt.

Use Privacy tools when signed in, or email help@inespect.com. We aim to answer within 30 days of confirming your request.

Where to ask. If the data belongs to a company workspace, contact that organization's administrator first; they control it and we act on their instructions. For anything we control, contact us directly.

15. Children's privacy

The platform is a business tool and is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, tell us and we will delete it.

16. Third-party services and links

The platform may load a payment provider's checkout when you subscribe, and our pages may link to other websites. Those services have their own privacy policies, and this one does not cover them.

17. Automated decision-making

We do not make decisions about you by automated means that produce legal effects or similarly significant effects. Scores or summaries calculated by the platform for quality records are produced for your organization, which decides what to do with them.

18. Changes to this policy

We may update this policy. When we do, the date at the top changes, and material changes to Privacy (and Terms) require re-acceptance before continued app use. Continuing to use the platform after accepting a change means you accept the revised policy.

19. Contact

Questions about privacy, or a request about your data? Email help@inespect.com, use Privacy tools, or our Contact page.

20. Who we are, and where

Easy Audit is an Egyptian company in digital solutions, established in Egypt. The database and file storage that run the platform are hosted as described in section 6.

The GDPR sections of this policy apply to processing carried out when the platform is offered to people in the European Economic Area or the United Kingdom. Where that applies, Article 27 may require a representative inside those territories; we will appoint one and name them here before offering the service to customers established there.

We have not appointed a Data Protection Officer. Privacy questions and requests go to the contact above and are answered by us directly.