Privacy Policy
This page says exactly what AuditRadar stores, who processes it, and how to have it removed.
Who we are
AuditRadar is operated by Get Audit Radar LLC, a Wyoming limited liability company. Address: 5825 NE Prescott St, Portland, OR 97218, USA. Contact support@getauditradar.com.
What we collect from customers
- Your email address and firm name.
- Billing is handled by Stripe, or by Lemon Squeezy for purchases made through it. Card details are typed only on the payment provider's checkout page and never reach AuditRadar; we keep the provider's customer and payment references, the amount paid and the plan.
- Prices exclude sales tax. Where Get Audit Radar LLC is registered to collect it, Stripe adds it at checkout and it appears on your receipt; Stripe works it out from your billing address. For purchases through Lemon Squeezy, Lemon Squeezy is the merchant of record and handles sales tax.
- Sign-in links and account emails are sent from support@getauditradar.com through Cloudflare Email Sending. The emails we send you and the emails you send to that address are stored so we can answer them and show what was sent; sign-in and download links are stored with their key removed. The mailbox is kept for 550 days.
- Account activity: each sign-in, the first page opened each day and how many pages were opened that day, each file downloaded or exported, changes to the plan, team, tokens and settings, and billing events from the payment provider, with the IP address, country and browser of the request. We use it to keep accounts secure, to answer support and billing questions, and as evidence if a payment is disputed, when the entries for that payment go to the payment processor. It is kept for 550 days.
- The IP address and browser used at checkout are kept with the order record, with the Terms and Privacy Policy in force at that moment and the product as it was described, so what you agreed to can always be shown.
- Cookies: one session cookie when you sign in, and one referral cookie (
ar_via, 60 days) only if you arrived through an affiliate link. Public pages (never the signed-in app) also measure visits: Google Analytics counts visits, the pages viewed and a few clicks (a state chosen, a checkout started). It sets the cookies_gaand_ga_*, kept up to 2 years, and Google receives the page address, your IP address and your browser details. Google signals and ad personalisation are off; nothing is used for advertising. Public pages keep where your first visit from another site came from (its utm tags, the referring site and the landing page, nothing that names you) in this browser's storage asar_ftfor 90 days, and send it with a free sign-up, an order, a lead or an RFP you submit, where it is stored with that account, order or submission. A visit that arrives from another site or a tagged link is also counted by the site itself, without your IP address. Neither happens in a browser that sends Global Privacy Control or that has analytics turned off. Google Analytics does not run in a browser that sends Global Privacy Control, and you can switch it off in this browser.
Cookies and browser storage
Every cookie and browser-storage key the site sets, generated from its current settings.
| Name | Set by | Kind | What for | Kept |
|---|---|---|---|---|
ar_s | AuditRadar | cookie | Keeps you signed in. Set only when you sign in; HttpOnly, never read by scripts. | 30 days, or until you sign out |
ar-theme | AuditRadar | browser storage | Remembers light or dark mode, only if you switch it. | Until you clear it |
_ga, _ga_* | Google Analytics | cookie | Tells one visit from another on public pages. | Up to 2 years |
ar_ft | AuditRadar | browser storage | Where your first visit from another site came from (utm tags, referring site, landing page), sent with a sign-up, order, lead or RFP you submit. Not kept when analytics is off in this browser or it sends Global Privacy Control. | 90 days |
ar_analytics_optout | AuditRadar | browser storage | Remembers that you turned analytics off in this browser. | Until you clear it |
ar_via | AuditRadar | cookie | Set only when you follow an affiliate’s link: which affiliate sent you and when, so a purchase can be credited to them. HttpOnly; never read by scripts, never shared. | 60 days (this visit only with Global Privacy Control, or from the EEA, UK or Switzerland) |
ar_aff | AuditRadar | cookie | Keeps an affiliate signed in to their affiliate account. Set only on that sign-in; HttpOnly. | 30 days, or until they sign out |
What the product contains
Public Federal Audit Clearinghouse data and publicly posted solicitations. Contact details are limited to what is already public: the contact an issuer prints on its RFP page, and the auditee contact as the organization filed it with the Clearinghouse in the FAC report we cite (contact title, phone, email, and the certifying official’s name and title). That filed contact is on each account row of the paid Territory Report files and of the CSV export a signed-in paying customer downloads, labelled with the report it comes from and not verified or updated by us; on Watch and higher plans it is also on the organization page and in its one-page account brief, with whether it was found on the organization’s own website. Public pages, samples, previews, the weekly digest, free accounts and our outreach emails carry no auditee contact. We do not buy, scrape or sell contact lists.
Outreach
We email audit-firm contacts listed on public FAC records, or found hiring for nonprofit audit work, at most five times. Every link to this site in those emails carries a code for that email: when one is opened we record the email, the page, the time, and the country and network operator of the request (never the IP address), so we know which emails were read. There is no tracking image in them. Every email carries a one-click opt-out, and opt-outs are honoured permanently.
RFP submissions
When you submit an RFP at /audit-rfps/post/ we store the details you enter, your contact email and a hashed IP address for abuse prevention. The submission goes through the same automatic check as every other RFP: once it is checked against the issuer's page, the issuer name, state, category, deadline and the public RFP link may be listed on the site. Your contact email is never published.
Firm pages
Pages under /audit-firms/ show counts derived from public FAC filings. A firm can ask for its page to be removed at support@getauditradar.com.
Affiliates
When you follow an affiliate’s link we record the click (the affiliate, the day, the page, the referring site, your country and a key made from a shortened, hashed form of your IP address, kept 90 days; the click itself is kept 400 days) and set the ar_via cookie, so that a purchase can be credited to that affiliate. Your order then records which affiliate referred it. The affiliate never learns who you are: they see the plan, the month and the amount only. If you are an affiliate, we keep your name, email, PayPal email, the terms you accepted, your commission and payouts, and your tax form (your tax number encrypted, with its last 4 digits readable) for 7 years, as payment and tax records; PayPal receives your PayPal email and the amount to pay you.
Subprocessors
Every service that can receive data from this site, and every host a page may ask your browser to contact, generated from the site’s current settings.
| Processor | What for | What it receives | Hosts your browser may contact | In use |
|---|---|---|---|---|
| Cloudflare | Hosting (Workers), the database (D1; primary in the Asia-Pacific region, Singapore, with read copies near visitors), file storage (R2), sending and receiving email (Email Sending), and, when switched on, Web Analytics (page views counted without cookies). | Every request to this site (IP address, browser, page), your account and order records, the emails we send and receive, and the files you download. | static.cloudflareinsights.com cloudflareinsights.com | Yes |
| Stripe | Card payments, subscriptions, receipts, the customer billing portal and sales-tax calculation (Stripe Tax). | Your email, the card (typed only on Stripe’s page), the billing address and what you bought. | checkout.stripe.com billing.stripe.com | Yes |
| PayPal | Payments made with PayPal, offered only when card payment is unavailable. | Your email, the PayPal account you pay with and what you bought. | www.paypal.com www.sandbox.paypal.com | Yes |
| Lemon Squeezy | Payments for purchases made through it; Lemon Squeezy is then the merchant of record and handles sales tax. | Your email, payment details (typed only on its page), the billing address and what you bought. | *.lemonsqueezy.com | No: switched off |
| SendFox | The email lists of free accounts and product updates; every such email has an unsubscribe link. | Your email address and the state you chose. | None: server to server only | Yes |
| Google Analytics | Counting visits to public pages. Google signals and ad personalisation are off. | The page address, your IP address and browser details, and a few named clicks. | www.googletagmanager.com *.googletagmanager.com *.google-analytics.com *.analytics.google.com *.g.doubleclick.net www.google.com | Yes |
No model or AI provider is used: RFPs are classified by fixed rules and the product makes no model API call.
Your rights
Request an export or deletion at support@getauditradar.com. We respond within 30 days.
Changes
This policy was last updated on 2026-10-22.