EVERY SEAL, ATTESTED - PRIVACY POLICY

• Account details - your name, work email address and an encrypted password, used solely to sign you in and show who recorded or amended work.
• Work records - fire-stopping seal records, floor-plan drawings, site photographs, product and location details entered by your company's team. This is your company's compliance data; it exists to build your golden-thread evidence trail.
• Activity information - which user created or amended a record and when, kept as an audit trail required for compliance-grade evidence.
• Website visit counter - on this marketing website only, each page view sends our own server the page viewed, the page that linked to it, your screen width, any campaign tags in the address and a one-way token made from your IP address, browser and a value that changes every day. The IP address is never stored, nothing is placed on your device, and the token cannot be linked back to you or across days. If you arrive through a link carrying campaign tags, those tags are kept in your browser's session storage for that visit only, so that a sign-up made during the visit can record where it came from.
• Forms on this website - the get-started, waiting-list and design-partner forms, and the short capture forms on the pricing, questions and switching pages, send what you enter (your email address and, where asked, your name and company) to our own application at app.assaya.co.uk, which holds it under this policy.

We use a small number of suppliers to run the service. They process data only on our instructions, and only to deliver Assaya to you:

• DigitalOcean - hosting for the application and your database (United Kingdom).
• Stripe - subscription payments. Card details go straight to Stripe and never touch Assaya.
• Resend - sends the service emails (invitations, password resets, receipts).
• Titan - our own business email.
• Cloudflare - protects the website from attack and abuse, and runs Cloudflare Web Analytics on this marketing website: a cookieless page-view count that stores nothing on your device. It is not present in the app or the console - it never sees your job records.

Some of these suppliers are based outside the United Kingdom, so limited data may be transferred internationally under the safeguards their contracts provide. Your job records, photographs and drawings stay on UK infrastructure. The current list, with what each one holds, is kept on our trust page.

• No advertising, and no tracking across other websites. There is no analytics of any kind inside the app or the console - your job records are never measured. On this marketing website we count page visits in two cookieless ways - our own first-party counter described above and Cloudflare Web Analytics - neither of which stores anything on your device or can follow you to another site, which is why we do not interrupt you with a cookie banner. No data from this website is sent to Google Analytics.
• We never sell or share your data with third parties for marketing.
• No GPS or device location is collected - the app never asks for it. Where a photograph is described as location-stamped, that location is the drawing position you selected yourself (building, level and pin reference), not a satellite fix. Photographs are taken deliberately by the user; the app stores only what you choose to attach to a record.
• The mobile app requests camera access only when you take a photo or scan a QR label, and Face ID / Touch ID (where enabled) is processed entirely on your device - biometric data never leaves your phone.