Privacy Policy

1. Introduction

Petual, Inc. ("the Company," "we," "us," or "our") operates the website getpetualai.com (the "Service"). The Company is located at 48 Wall Street, Floor 11, New York, NY 10005. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

Petual provides AI-driven audit workpaper automation for internal audit and SOX compliance teams. Our core service processes audit evidence files submitted by auditors, maps each file to the relevant control objective, and generates structured workpapers and exception lists. This policy covers information collected through the Service and through direct communications with you.

We can be reached at [email protected] or by phone at +1 (212) 554-0173.

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, email address, phone number) when you fill out a form, request early access, or contact us;
• Professional information you choose to share (company name, job title, team size, audit framework in use);
• Audit evidence files, control matrices, and workpaper documents you upload to the platform for processing;
• The content of messages you send us through the contact form or by email.

2.2 Audit Evidence Data

When you use the Petual platform, you may submit audit evidence files (such as PDF documents, spreadsheets, and exported logs), control matrix templates, and related workpaper materials. This data is processed solely to generate control-to-evidence mappings, workpaper drafts, and exception lists for your engagement. We do not use the contents of audit evidence files to train machine learning models without explicit written consent from your organization. Audit evidence submitted through the platform is treated as confidential and is not disclosed to third parties except as required by law or as described in Section 4.

2.3 Information Collected Automatically

When you visit getpetualai.com, we automatically collect limited technical information:

• IP address and approximate location (city and region level);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 5).

2.4 We Do Not Knowingly Collect Children's Data

getpetualai.com is directed to business professionals and is not intended for children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Process audit evidence, map evidence to control objectives, and generate workpapers and exception lists for your engagement;
• Respond to access requests, inquiries, and support questions;
• Operate, maintain, and improve the Service, including product development informed by aggregate usage patterns;
• Send service updates, onboarding communications, and (with your consent where required) product news;
• Detect, investigate, and prevent fraud, abuse, or unauthorized access;
• Comply with applicable legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf - including cloud infrastructure, document processing, email delivery, and analytics providers - under contractual confidentiality terms that restrict their use of your data;
• Governmental authorities or law enforcement, when required by law or to protect the rights, safety, or property of the Company or others;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties. Audit evidence and workpaper contents are not shared with any party other than the service providers necessary to operate the processing pipeline, and only under the terms described above.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember session state, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal contact information only as long as needed to provide the Service and comply with legal or accounting obligations. Inactive marketing-list contacts are purged after 24 months. Server access logs are retained for 90 days and then aggregated. Audit evidence files uploaded to the platform are retained for the period specified in your service agreement; if no agreement term applies, files are deleted upon request or after 12 months of account inactivity.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information and audit evidence, including TLS encryption in transit, restricted-access databases, and least-privilege access controls. Audit evidence files are stored in logically isolated environments. No system is perfectly secure; we cannot guarantee absolute security. If you believe a security incident has occurred, contact [email protected] immediately.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. New York Residents

New York does not currently have a comprehensive consumer privacy statute. As a matter of policy, the Company extends the following baseline rights to all U.S. residents regardless of state of residence.

9.1 Baseline Rights

• Right to Know: request the categories of personal information we have collected about you.
• Right to Delete: request deletion of personal information you have provided.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Marketing: unsubscribe from marketing emails or opt out via the link in each marketing message.

9.2 How to Exercise

Email [email protected] with a description of your request and enough detail for us to verify your identity. We respond within 45 days.

9.3 Sector-Specific Rights

If you are protected by federal sector laws (such as the Gramm-Leach-Bliley Act or other financial-sector privacy statutes), those laws may give you additional rights with respect to data covered by them. Internal audit teams remain responsible for their own compliance obligations under applicable financial regulatory frameworks.

9.4 California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not share personal information for cross-context behavioral advertising.

To submit a CCPA or CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints can be sent to: