Privacy policy
Last updated 30 October 2026
This policy explains how AssetMantis (“we”, “us”) handles personal data when you visit assetmantis.com or use the AssetMantis service. We aim to collect as little as we need, keep it secure and be clear about what we do with it.
1. Who we are
The service is provided by AssetMantis (operated by Giles Hetherington), based in the United Kingdom. For anything to do with privacy, contact us through our contact form and choose “Account or data request”.
We have two roles under UK data protection law:
- Controller for account data (your name, email, login and billing details) and for enquiries sent to us.
- Processor for the content our customers put into the service (asset records, photos, documents, notes). The customer organisation is the controller for that content and decides what goes in it. We process it only to provide the service, under our terms of service.
2. What we collect
| Data | Examples | Why | Lawful basis |
|---|---|---|---|
| Account data | Email address, password (stored only as a secure hash), display name, time zone | To create and secure your account and let you log in | Contract |
| Organisation & membership | Organisation name, your role, invites you send or receive | To run team access | Contract |
| Customer content | Asset details, sites, photos, documents, maintenance and issue records, notes | To provide the service | Contract (we act as processor) |
| Activity & security logs | Actions taken (e.g. “maintenance completed”), timestamps, IP address, browser type | Audit trails for your organisation, security and abuse prevention | Legitimate interests |
| Enquiries | Name, email, organisation and message sent via our contact form | To reply to you | Legitimate interests |
| Billing (when billing is live) | Billing contact, invoices, payment status. Card details are handled by our payment provider, not stored by us | To charge for paid plans and keep tax records | Contract, legal obligation |
We do not use advertising trackers, sell personal data or use it for profiling. We don't knowingly collect data from children.
3. Who we share it with
We use a small number of trusted providers (sub-processors) to run the service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and file storage | London, United Kingdom (AWS eu-west-2) |
| Vercel Inc. | Website and application hosting | Global edge network; may process request data in the US |
| Resend Inc. | Sending service emails (invites, password resets, contact replies) | United States |
| Payment provider (e.g. Stripe), when billing is live | Payment processing | UK / EU / US |
Where data is transferred outside the UK, we rely on the UK International Data Transfer Addendum or Standard Contractual Clauses, or the UK–US Data Bridge where the provider is certified. We may also disclose data if required by law.
4. How long we keep it
- Account and customer content: for as long as your organisation's account is active. After an account is closed we delete its data within 30 days, except backups, which roll off within a further 30 days.
- Activity logs: up to 24 months, to support audit trails.
- Enquiries: up to 24 months after our last contact.
- Billing records: 6 years, as required by UK tax law.
5. Security
Data is encrypted in transit (HTTPS/TLS) and at rest. Each organisation's data is separated by database row-level security, files are stored privately and served through short-lived signed links, and passwords are never stored in readable form. No system is perfectly secure, but we take reasonable technical and organisational measures and will notify affected customers and the ICO of any notifiable breach as the law requires.
6. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent where we rely on it.
To exercise any of these, use our contact form. We'll respond within one month. If your request concerns content held by an organisation you're a member of, we may refer you to that organisation as the controller.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
7. Cookies
We use only essential cookies needed to keep you logged in. See our cookie policy.
8. Changes
We'll update this policy as the service develops. Significant changes will be notified by email or in the app. The date at the top shows when it was last changed.