1. Introduction
AssetJay ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use our IT asset management platform ("the Service").
By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect your email address. If you subscribe to a paid plan, payment information is processed by Stripe and we do not store your credit card details.
2.2 Asset & Organisation Data
You provide data about your organisation, team members, and IT assets including names, purchase information, serial numbers, warranty dates, and uploaded documents such as receipts and photos. This is "Your Data" as defined in our Terms of Service.
2.3 Usage Data
We collect basic analytics data including page views and feature usage to improve the Service. Our browser analytics (Lodd) do not use cookies and do not collect names or email addresses. For signed-in users, we also record a few product events (sign-up, upgrade to a paid plan, and adding an asset) to understand how the product is used. These are linked to your account ID and can include your organisation name, country, estimated number of devices, and the category of an asset you add.
2.4 Emails
If you use our email-based receipt import feature, we process the contents of forwarded emails to extract asset information. These emails are processed automatically and not routinely read by us.
3. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service
- Authenticate your identity and manage your account
- Process payments and manage subscriptions
- Send emails about your account and assets (sign-in links, warranty alerts, monthly digests, borrow reminders and onboarding tips). You can unsubscribe from non-essential emails at any time
- Extract data from uploaded receipts using AI processing
- Generate activity logs and audit trails within your organisation
- Respond to support requests
- Comply with legal obligations
We do not sell your personal information or Your Data to third parties. We do not use Your Data to train AI models.
4. Third-Party Services
We use the following third-party services to operate the platform. Each processes data as necessary to provide their respective functions:
- Supabase: Database hosting, authentication, and file storage
- Stripe: Payment processing and subscription management
- Resend: Email delivery, and receiving emails forwarded to your import address (including attachments)
- Anthropic (Claude): AI-powered receipt data extraction (document contents are sent for processing; Anthropic may retain inputs for a limited period, currently up to 30 days, under its own policy, and does not use them for training)
- Vercel: Application hosting and serverless infrastructure
- Lodd: Privacy-friendly analytics
- Slack: Internal notification to us when someone signs up, containing their name, email address, organisation name, country and estimated device count
Each provider operates under its own privacy policy and terms.
5. Data Storage & Security
Your Data is stored in secure, encrypted databases provided by Supabase. We implement industry-standard security measures including:
- HTTPS encryption for all data in transit
- Row-Level Security (RLS) ensuring organisations can only access their own data
- Security headers including a Content Security Policy, HSTS and clickjacking protection
- Authentication via secure magic links (no passwords stored)
While we take reasonable steps to protect your data, no method of electronic storage or transmission is 100% secure.
6. Data Retention
We retain Your Data for as long as your account is active. If you delete your account, we will delete Your Data within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing our agreements). Copies held by providers such as Stripe and Slack follow their own retention.
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access: request a copy of the data we hold about you
- Correction: request correction of inaccurate data
- Deletion: request deletion of your personal data
- Portability: request your data in a machine-readable format
- Objection: object to processing of your data in certain circumstances
To exercise any of these rights, contact us at support@assetjay.com.
8. Cookies
The Service uses only the cookies needed to keep you signed in, plus a short-lived first-party cookie that marks a completed sign-up. We do not use tracking or advertising cookies. Our browser analytics do not use cookies. The product events described in section 2.3 are recorded on our servers, not through cookies.
9. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.
10. International Data Transfers
Your data may be processed and stored in countries outside your own, including the United States and the European Economic Area. Database and files are stored in the EU (Stockholm). Some providers, including Vercel, Anthropic and Resend, may process data in the US. We ensure that appropriate safeguards are in place for any international data transfers in accordance with applicable data protection laws.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.
12. Contact
If you have questions about this Privacy Policy or how we handle your data, please contact us at support@assetjay.com.