Privacy Policy

Account Information

When a workspace is created we collect the name and email address of the person creating it, the workspace name and its slug, and the details of any users subsequently invited. Passwords are stored hashed, never in readable form.

Workspace Content

The asset records, categories, locations, departments, service tickets, maintenance schedules, software licence records, purchase requests and orders, reservations, audit records and any photographs or files attached to them. This is your data; the platform holds it on your behalf.

Technical Data

Session and authentication tokens, server access logs including IP address, timestamp and user agent, and error logs used for diagnosis and service improvement.

Billing Information

Subscription plan, seat count, billing period and payment status. Card, UPI and bank details are handled by the payment processor and are not stored by AssetMon.

To provide and operate the service; to authenticate users and enforce role-based access; to send transactional email such as invitations, alerts and billing notices; to diagnose faults and improve reliability; to process subscriptions; and to meet legal obligations. We do not use customer workspace data to train models.

Database-per-tenant isolation

Each workspace runs in its own isolated PostgreSQL database rather than sharing tables behind a tenant identifier column, so one workspace's records are not reachable from another's queries.

Encryption

Data is encrypted in transit using TLS 1.2 or higher, and at rest using AES-256. Backups are encrypted with separate keys.

Access controls

Role-based access control within each workspace, security headers, rate limiting, magic-byte verification of uploaded files, and parameterised database access. API keys are tenant-scoped, hashed at rest, can be read-only or read-write, and support revocation and expiry. Two-factor authentication is available using TOTP.

Audit logging

Every asset event — creation, update, check-out, check-in, licence assignment and ticket activity — is written to an immutable log that can be exported.

AssetMon sets first-party cookies only, and stores an access token in the browser's local storage to keep you signed in. It uses no advertising trackers, no social media pixels and no third-party analytics.

AssetMon relies on a small number of sub-processors to operate: a cloud hosting provider, a managed database provider, a transactional email provider, an error-tracking provider, and a payment processor for subscription billing. Each handles data only as needed to deliver its part of the service.

Workspace data is stored in the European Union by default. Enterprise customers can request region pinning to the EU, India or the United States.

Active workspaces

Workspace data is retained for as long as the workspace is active.

After a trial

A workspace pauses for 14 days at the end of a trial. Data remains exportable during that window.

After cancellation

Workspace data is deleted within 30 days of cancellation. Encrypted backups are retained for 30 days after that point and then removed.

Audit logs

Retained for 365 days.

Access and export

Your data is exportable at any time while the workspace is live or paused, as CSV from the interface or through the REST API.

Correction and deletion

Records can be corrected in the interface, and a workspace can be closed from the dashboard. To request deletion of personal data held outside a workspace, contact us using the details below.

No sale of data

We do not sell personal data, and we do not share workspace content with third parties except the sub-processors described above.

A data processing agreement is signed with every paying customer. Contact us for the current version, or for an information-security review.

This policy may be updated to reflect changes in the service, our sub-processors or the law. The "Last updated" date above changes when it does, and significant changes are notified by email or in-app notice.