Privacy Policy, Cookie Governance & Telemetry Architecture.
Board-grade transparency regarding client-side data boundaries, on-device diagnostic compute, passive audience telemetry, and statutory compliance across the UAE, Saudi Arabia, the United Kingdom, and the European Union.
Data Controller Identity & Governance Charter
The Audit Signal is an executive internal audit, continuous controls monitoring (CCM), and operational telemetry research platform founded and directed by Majid Mumtaz (CIA, ACA, FCCA, GRCP). Inquiries regarding platform data handling, confidentiality boundaries, or statutory rights may be directed to our designated supervisory channel.
The On-Device Sandbox Architecture
Enterprise internal audit and forensic data frequently involve confidential balance sheets, procurement manifests, inventory valuations, and fraud scenario assumptions. To uphold absolute confidentiality, all 30 interactive audit tools on this platform operate exclusively on-device within the sandbox of your browser.
Calculations, mathematical regressions, and attribute sampling algorithms execute entirely in client-side memory using JavaScript and WebAssembly.
Uploaded spreadsheet models, invoice sample records, cost parameters, and fraud risk scores are never transmitted across the network to our servers or third-party cloud engines.
Once static assets are rendered by your browser, every interactive calculator functions with full computational capability even in an isolated, air-gapped network state.
Network isolation can be directly audited and verified in real time using browser inspection tools (F12 Developer Tools → Network panel).
Passive Telemetry & Google Consent Mode v2
The Audit Signal deploys a privacy-hardened implementation of Google Analytics 4 (Measurement ID: G-9GCK25N9C5). To prevent intrusive cross-site surveillance, advertising profiling, or unauthorized identifier tracking, our telemetry infrastructure is hardwired to Google Consent Mode v2.
Default Denied Posture
All non-essential cookies and analytics storage are initialized in a denied state before page scripts run. In this state, Google Analytics operates without writing persistent tracking cookies, suppressing advertising features and pseudonymous cross-session profiles until affirmative consent is logged.
Granular Telemetry Purpose
When enabled by the visitor, telemetry metrics are restricted to measuring aggregated aggregate page navigation sequences, documentation downloads (PDF, overview markdown), and referral channels. No sensitive calculator inputs or proprietary business figures are ingested into telemetry streams.
Revocable Consent State
Consent choices are stored strictly within local browser storage and can be reviewed, updated, or revoked at any moment using our interactive consent drawer. Revoking analytics consent instantly signals Google Tag Manager to deny storage and initiates client-side purging of lingering analytical tokens.
Review or adjust your consent configuration across necessary vs. audience analytics.
Complete Cookie Register
The following table details every browser cookie that may be set across this domain, including its functional classification, persistence window, and technical purpose.
| Cookie Identifier | Provider / Host | Classification | Standard Lifespan | Operational Purpose |
|---|---|---|---|---|
| _ga | Google LLC (GA4) | Analytics (Non-Essential) | 730 days (2 years) | Distinguishes unique anonymous website visitors across sessions. Subject to affirmative user consent. |
| _ga_9GCK25N9C5 | Google LLC (GA4) | Analytics (Non-Essential) | 730 days (2 years) | Maintains session state, routing activity, and campaign interaction data for container G-9GCK25N9C5. |
| __cf_bm | Cloudflare Inc. | Strictly Necessary | 30 minutes | Edge security management, bot traffic mitigation, and DDoS prevention at the Cloudflare edge proxy tier. |
Browser Storage Key Inventory
To preserve computational state and user selections without external network calls, specific tools leverage the browser Web Storage API. All keys listed below remain entirely local to your client workstation.
| Storage Key | Mechanism | Associated Feature | Persistence | Data Content & Transmission |
|---|---|---|---|---|
| __audit_cookie_consent | localStorage | Consent Gate | Persistent until cleared | Records visitor telemetry consent choices (necessary vs. analytics). 100% on-device. |
| __audit_lead_ref | localStorage | Referral Router | Persistent until cleared | Captures public URL campaign parameters (e.g., ref, utm_source). Transmitted only when analytics consent is granted. |
| mm_cafe_inventory_data_v3 | localStorage | Cafe Costing Tool | Persistent until reset | Stores recipe bill-of-materials and ingredient unit costs entered by the user. Zero remote transmission. |
| li_formatter_draft | localStorage | LinkedIn Formatter | Persistent until cleared | Caches draft article copy locally to prevent accidental data loss on browser refresh. Zero remote transmission. |
| __notified_[path] | sessionStorage | Navigation Throttle | Single tab session | Deduplicates telemetry events during internal client-side page transitions. Purged when tab closes. |
Lawful Bases for Data Processing
Data processing operations across The Audit Signal are anchored strictly in established statutory grounds recognized by the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law (Royal Decree No. M/19), and Article 6 of the General Data Protection Regulation (EU/UK GDPR).
Invoked under UAE PDPL Article 6(1), Saudi PDPL Article 5, and GDPR Article 6(1)(a). We process aggregated audience interaction metrics only following affirmative visitor consent. Consent may be modified or revoked at any time.
Invoked under UAE PDPL Article 4(2) and GDPR Article 6(1)(f). We maintain edge-tier rate limiting, DDoS mitigation via Cloudflare, and cryptographic content verification to defend platform integrity against unauthorized exploitation.
Invoked under UAE PDPL Article 4(3) and GDPR Article 6(1)(b). Information submitted via our executive contact form is processed strictly to assess mandate scope, execute pre-contractual due diligence, and respond directly to professional inquiries.
Data Subject Statutory Rights & Recourse
Regardless of your physical residency, The Audit Signal provides universal data subject protections aligned with international fiduciary standards and regional GCC privacy enactments.
You possess the statutory right to request confirmation of whether personal data relating to you is being processed, alongside a copy of any recorded communications.
You may request immediate correction of inaccurate or incomplete information retained within our executive correspondence records.
You may demand permanent purging of contact information and correspondence logs, subject to statutory retention requirements mandated by commercial accounting standards.
You are entitled to object to any processing based on legitimate interests or revoke analytics consent without suffering operational degradation.
Upon request, copies of information provided under contract or consent will be furnished in a structured, machine-readable format (JSON or CSV).
You hold the right to lodge formal complaints with competent data protection authorities, including the UAE UAE Data Office, the Saudi SDAIA, or the UK Information Commissioner's Office (ICO).
Data Ingestion & External Service Boundaries
The Audit Signal enforces a strict policy of non-monetization regarding personal data. We do not sell, rent, license, or trade client inquiries, telemetry data, or visitor records to data brokers, ad exchanges, or commercial aggregators under any circumstances.
Executive inquiries submitted through our contact form are routed securely via Formspree Inc. under encrypted HTTPS transport (TLS 1.3). Submitted fields include name, corporate email address, and inquiry text. Formspree operates under strict Data Processing Agreements incorporating standard contractual clauses.
Procurement of commercial working papers, ERM programmes, and forensic templates is handled entirely by specialized merchant processors (Gumroad, Eloquens, Flevy, eFinancialModels). External storefront transactions are governed sovereignly by the respective provider's terms and privacy policies. No payment card numbers or billing addresses touch The Audit Signal's infrastructure.
Data Retention & Disposal Schedule
Personal data is retained only for as long as necessary to fulfill the operational, advisory, or statutory purpose for which it was gathered.