Privacy policy
Last updated: 1 October 2026
Who we are
AssetAligned is an asset register for UK businesses. Contact us about privacy at support@assetaligned.co.uk.
Two kinds of data
- Your account data. Details about you as a user of AssetAligned, such as your name and email. We decide how this is used, so we are the controller.
- Your organisation's register. The assets, people, locations, documents and records your organisation puts into AssetAligned. Your organisation is the controller of this data. We only process it to run the service for you, under our Terms. If you are an employee listed in a register, contact your employer first.
What we collect
- Account details: name, email address, password (stored only in hashed form by our sign-in provider) and multi-factor authentication settings.
- Organisation details: organisation name, country and the role each member holds.
- Messages: anything you send to our support email.
- Activity records: who did what in the app and when, kept so every organisation has an audit history.
- Technical data: IP address, browser type and request times, used by our hosting providers and our security check to keep the service safe and running.
We don't use analytics, advertising or tracking tools.
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account and the service | Contract |
| Keep the service and your data secure, and prevent misuse | Legitimate interests |
| Email you about the beta and changes to the service | Legitimate interests. You can opt out at any time |
| Answer your support requests | Legitimate interests |
| Meet legal and tax obligations | Legal obligation |
Who we share it with
We never sell your data or share it for advertising. We use these providers to run AssetAligned:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in, account emails (such as sign-up and password resets) and file storage | London, UK. Account emails may be sent from outside the UK |
| Vercel | Hosts the website and app | London, UK |
| Cloudflare | Security check on sign-in and sign-up, to block bots | Cloudflare's global network |
| IONOS | Our support mailbox (support@assetaligned.co.uk) | TODO: [IONOS REGION] |
We may also share data if the law requires it, or with a buyer if the business is sold.
Transfers outside the UK
Your organisation's register and files are stored in London. If any provider processes data outside the UK, we rely on the UK's approved safeguards, such as an adequacy decision or the International Data Transfer Agreement.
How long we keep it
- Account and organisation data: while your account is open, then deleted within 30 days of closing it.
- Backups: kept for up to 30 days, then overwritten.
- Support emails: up to 2 years.
- Records we must keep by law, such as invoices: 6 years.
How we protect it
Data is encrypted in transit. Each organisation's data is kept separate at database level. Multi-factor authentication is on by default for Owners, Admins and Finance users. Files are stored privately and only reach people with permission to see them.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, object to how we use it, or send it to you in a portable format. Email support@assetaligned.co.uk and we'll reply within one month. For data in your organisation's register, we'll pass your request to your organisation.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to sort it out first.
Cookies
We only use cookies that keep you signed in and protect your session. The security check on sign-in and sign-up (Cloudflare Turnstile) sets no cookies, but keeps one small technical item in your browser so it can work. All of these are essential, so we don't ask for consent. We don't use analytics or advertising cookies.
Under 18s
AssetAligned is for businesses and isn't meant for anyone under 18.
Changes
If we change this policy, we'll update the date at the top. We'll email account holders about any significant change.