Privacy Policy

This Privacy Policy describes how AssetOS, operated by Akwsit OÜ ("we," "us," or "our"), collects, uses, stores, and protects your personal information when you use our software-as-a-service platform, website, and related services (collectively, the "Service").

We are committed to protecting your privacy and being transparent about our data practices. By using the Service, you agree to the collection and use of information as described in this Privacy Policy.

1. Information We Collect

Information You Provide

We collect information you directly provide to us, including:

• Account Information: Name, email address, password, company name, job title
• Profile Information: Profile photo, preferences, settings
• Billing Information: Credit card details, billing address (processed securely through our payment processor)
• Content and Files: Data, files, and content you upload, create, or store in the Service
• Communications: Messages you send to us via email, support requests, or in-app chat
• Feedback: Survey responses, feature requests, and other feedback
• Shipping Information: Name, company, and postal address when you request physical materials from us (such as sample asset tag packs or label shipments), used solely to fulfil and follow up on your request

Information We Collect Automatically

When you use the Service, we automatically collect:

• Usage Data: Pages viewed, features used, actions taken, time spent, frequency of use
• Device Information: IP address, browser type and version, operating system, device type
• Log Data: Access times, error logs, performance data
• Cookies and Tracking: See our Cookie Policy section below
• Fraud Prevention Data: At account creation, we collect your IP address and browser user agent string. This data is used solely to detect and prevent fraudulent signups and is not used for profiling or marketing purposes.
• Product Usage Events: When using the application, PostHog records events such as feature interactions, page views, and session behaviour, linked to your user account.
• Error and Diagnostic Data: Sentry automatically captures application errors, including technical context such as your browser, operating system, IP address, and user identifier, to help us identify and resolve bugs.

Information from Third Parties

We may receive information from:

• Authentication Providers: If you sign in via Google or other third-party services, we receive basic profile information
• Payment Processors: Payment confirmation and billing information
• Analytics Services: Aggregated usage patterns and demographics

2. AssetOS Mobile App

The AssetOS mobile app for iOS and Android is used by field technicians to manage work orders and assets. In addition to the account information described above, the mobile app handles the following data on your device:

• Camera and Photos:The app uses the camera and photo library only when you choose to attach a photo to a work order. Photos are compressed and stored on your device, and uploaded to your organisation's AssetOS workspace. The app does not access your photo library in the background.
• Push Notifications: With your permission, the app registers a device token (Firebase Cloud Messaging) so your organisation can send you work-order notifications. The token identifies the device for delivery only; it is not used for advertising or tracking.
• Offline Data: To work without an internet connection, the app stores your assigned work orders, assets, and pending changes in a local database on your device. This data is removed from the device when you sign out.
• Credentials:Sign-in tokens are stored in the operating system's secure storage (iOS Keychain / Android Keystore). Your password is never stored on the device.
• Location: The AssetOS mobile app does not collect, request, or track your location.
• Crash Reporting: The mobile app uses Sentry to collect crash and error reports so we can fix defects. Reports may include device model, OS version, and app state at the time of the error. The mobile app contains no advertising or analytics SDKs.

3. How We Use Your Information

To Provide and Improve the Service

• Create and manage your account
• Process transactions and send billing confirmations
• Provide customer support and respond to inquiries
• Monitor and improve Service performance and reliability
• Develop new features and functionality
• Debug and fix technical issues

To Communicate with You

• Send service-related notifications (account changes, security alerts, system updates)
• Respond to your requests and questions
• Send marketing communications, including our newsletter (with your consent; you may opt out)
• When you download a template or use a free tool, email you the file or your results. Our founder may also write to you personally to ask how it's going; reply and he'll stop. You only receive the newsletter if you tick the box on the form, and every newsletter has an unsubscribe link.
• Request feedback and conduct surveys

For Security and Compliance

• Detect, prevent, and investigate fraud and abuse
• Enforce our Terms of Service
• Comply with legal obligations and protect legal rights
• Conduct security audits and risk assessments

The legal basis for processing IP address and user agent data for fraud prevention is our legitimate interests in protecting the integrity of the Service (GDPR Art. 6(1)(f)). This processing is proportionate to the risk and does not override your fundamental rights.

For Analytics and Research

• Analyze usage patterns and trends
• Conduct market research
• Create aggregated, anonymized statistics
• Measure effectiveness of marketing campaigns

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, or Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance:To provide the Service you've subscribed to
• Legitimate Interests: To improve our Service, prevent fraud, ensure security, and follow up personally on a download or enquiry you made
• Consent: For marketing communications and non-essential cookies (you may withdraw consent)
• Legal Obligation: To comply with laws and regulations

5. How We Share Your Information

We do not sell your personal information. We share your information only in these circumstances:

Service Providers

• Hosting: Vercel Inc. — our website and infrastructure are deployed via Vercel, with servers in the EU and US
• Payment Processing: Stripe — handles all credit card processing and billing
• Email: Resend — transactional email delivery and, if you opt in, our newsletter list
• Lead records: Notion — stores the details you submit through our website forms (for example, your email address and the template you downloaded)
• Website Analytics: Google Analytics 4 (GA4) — behavioural analytics on our website using cookies; and Vercel Analytics — cookieless, aggregated website traffic analytics
• Product Analytics: PostHog — tracks user behaviour and feature usage on our website and web application
• Error Monitoring: Sentry — captures application errors and crash reports from the web application and the mobile app
• Push Notifications: Firebase Cloud Messaging (Google) — delivers work-order push notifications to the mobile app
• Support: Customer support and help desk platforms

The AssetOS mobile app does not use Google Analytics, PostHog, or any other analytics or advertising service. The only third-party services embedded in the mobile app are Sentry (crash reporting) and Firebase Cloud Messaging (push notification delivery).

All service providers are contractually bound to protect your data and use it only for specified purposes.

Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

Legal Requirements

We may disclose your information if required to comply with laws, respond to government requests, protect our rights, prevent fraud, or enforce our Terms of Service.

6. Data Retention

• Account Data: Retained while active and for 30 days after account deletion
• Usage Data: Retained for up to 2 years for analytics
• Billing Records: Retained for 7 years to comply with tax and accounting requirements
• Support Communications: Retained for 3 years
• Marketing Data: Retained until you opt out or request deletion
• Fraud Prevention Logs: IP address and user agent retained for 90 days, then permanently deleted

7. Data Security

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Strict authentication requirements for our team
• Monitoring: Continuous security monitoring and intrusion detection
• Backups: Regular encrypted backups stored in secure locations

While we use industry-standard security measures, no system is completely secure. We cannot guarantee absolute security, but we take all reasonable measures to protect your data.

8. Your Rights and Choices

You can update your account information at any time through your account settings. To request deletion of your account and personal information, contact us at hello@assetos.io. We will delete your information within 30 days, except where required by law to retain it.

You can opt out of marketing emails by clicking "unsubscribe" in any marketing email.

9. GDPR Rights (EEA, UK, Switzerland Users)

If you are located in the European Economic Area, UK, or Switzerland, you have additional rights under GDPR:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Complain: Lodge a complaint with your local data protection authority

To exercise these rights, contact us at hello@assetos.io. We will respond within 30 days.

10. CCPA Rights (California Users)

• Right to Know: Request information about personal data we collect, use, and share
• Right to Delete: Request deletion of your personal data
• Right to Opt-Out: Opt out of the "sale" of personal data (note: we do not sell personal data)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

11. Cookie Policy

We use cookies and similar tracking technologies to provide and improve the Service. See our full Cookie Policy for details.

12. International Data Transfers

The Service is operated from Estonia, in the European Union. For users outside the EU, your information will be transferred to, stored, and processed in the EU and other locations where our service providers operate. We ensure appropriate safeguards via Standard Contractual Clauses and GDPR-compliant data processing agreements.

13. Children's Privacy

The Service is not intended for children under 18 years old. If you believe your child has provided us with personal information, please contact us at hello@assetos.io and we will delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting the updated policy on our website, with at least 30 days' notice before material changes take effect.

15. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you within 72 hours of becoming aware of the breach, as required by law.

16. Contact Us

• Email: hello@assetos.io
• Company: AssetOS, operated by Akwsit OÜ
• Location: Tallinn, Estonia

This Privacy Policy is written in English. If we provide a translation, the English version will prevail in case of any discrepancy.