Privacy Policy
Last updated: 12 October 2026
This policy explains how Applitude - Patryk Orsztynowicz ("AssetSort", "we", "us") handles personal data when you visit our website, join our waitlist, contact us, or use the AssetSort service.
1. Who we are
The controller is Patryk Orsztynowicz, running the business Applitude - Patryk Orsztynowicz, ul. Cypryjska 1A lok. 4, 75-430 Koszalin, Poland (NIP 6692588572). Contact us about anything in this policy at support@assetsort.com. We have not appointed a Data Protection Officer; that address reaches the person responsible for data protection.
2. Our two roles
We are the controller of the personal data described in §3: the accounts of people who sign in, our waitlist, enquiries, and the logs we keep to run the service securely.
We are only a processor for the records an organisation keeps in AssetSort — its people directory, devices, licences, assignments, documents, alerts and activity log, including data synced from its Microsoft 365 tenant. That organisation (your employer, or the IT provider managing it) is the controller and decides why and how those records are used; our Data Processing Agreement governs what we do with them. If your details reached AssetSort that way, please direct questions and requests to that organisation; we will help it respond.
3. What we collect, why, and for how long
Swipe sideways to see every column.
| Purpose | Personal data | Why we may use it (lawful basis) | How long we keep it |
|---|---|---|---|
| Your account | Name, email address, profile photo, the organisations you belong to and your role in each, your notification settings, two-step verification status, your Microsoft account ID if you sign in with Microsoft, and which version of our Terms of Service you accepted and when. If an administrator invites you, the invitation holds your email address until it is accepted or withdrawn, and for 30 days after it expires, after which it is removed automatically. Your password is held by our authentication provider; we never see it. | To provide the service you or your organisation signed up for — performance of a contract (Art. 6(1)(b)); where your organisation is our customer and you are one of its users, our and your organisation's legitimate interest in giving its users access (Art. 6(1)(f)). | Until your account is deleted. |
| Service emails | Your email address and name, and the content of the email — sign-in and verification messages, alerts, report notifications and invitations. | Performance of a contract (Art. 6(1)(b)). You choose which alert emails you receive in Settings → Alerts. | We do not keep copies; our email provider keeps delivery records for a limited period. |
| Security and abuse prevention | IP address, browser and device details, the pages and API addresses requested, and sign-in events. | Our legitimate interest in keeping the service and your data secure (Art. 6(1)(f)). | Application logs 90 days; storage access logs up to 13 months; sign-in IP addresses held by our authentication provider for a few weeks. |
| Error monitoring | When something goes wrong: your user ID, browser and device details, the page address with any secret codes removed, and technical details of the error, which can include information shown on the page. | Our legitimate interest in finding and fixing faults (Art. 6(1)(f)). | Up to 90 days, as set by our error-monitoring provider. |
| Waitlist | Your email address, your company and where you signed up if given, and when you joined and which version of the sign-up notice you saw. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. | Until you unsubscribe — every email we send you has a link — or ask us to remove you by replying to any of our emails or writing to us. Deleting an AssetSort account held under the same address removes you from the list as well. |
| Enquiries | What you send through the contact form or by email: name, email address, company and message. | Our legitimate interest in answering you (Art. 6(1)(f)), or steps you ask us to take before a contract (Art. 6(1)(b)). | As long as needed to deal with your enquiry and any follow-up. |
| Calendar feeds | A secure fingerprint of your private feed address, its label and when it was last used. | Performance of a contract (Art. 6(1)(b)). | Until you delete your account. A revoked feed stops working immediately. |
| Evidence of deletion | Your user ID, the email address that asked for deletion, and when it was requested and carried out. | Our legitimate interest in being able to show that we honoured your request (Art. 6(1)(f)). | As long as we may need to demonstrate the deletion. |
You do not have to give us any personal data, but we cannot create an account without a name and email address, and the waitlist needs an email address. Where something must be kept longer to meet a legal obligation or to establish or defend a legal claim, we keep it for that purpose only. Deleted data disappears from our backups within 7 days (database), 120 days (files) and 180 days (our authentication provider's systems).
4. Where your data comes from
Mostly from you. Some comes from others: an administrator of your organisation may enter your email address to invite you; if you sign in with Microsoft, Microsoft gives us your name, email address and account ID; and your organisation's records may include you as described in §2.
6. International transfers
We are based in Poland. The service and its logs are hosted in London, United Kingdom — a transfer covered by the European Commission's adequacy decision for the United Kingdom — and error monitoring is in Germany. Two providers process data in the United States: sign-in (Firebase Authentication) and email delivery (Resend). Each is certified under the EU–US Data Privacy Framework and its UK Extension, which the European Commission and the UK Government recognise as providing adequate protection.
7. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to our use of it, and to receive the data you gave us in a portable format. You can object at any time to processing based on our legitimate interests, and withdraw consent at any time without affecting what happened before. Email support@assetsort.com, or choose “Privacy” on our contact form. We reply within one month — or, if a request is complex, tell you within that month that we need up to two more — and may need to confirm your identity first.
Doing it yourself. You can change your name and photo in Settings → Profile, and delete your account there at any time. Deletion is scheduled with a 14-day grace period — your account keeps working and you can cancel from the same screen — after which we permanently remove your profile, photo and sign-in, every organisation you alone own together with its records, and your membership of every other organisation. An organisation you share with other people must first be handed to one of them, because its records are theirs as well as yours. Records in organisations you do not own — such as your name on their activity log and alert history — stay with those organisations, which control them. We keep the deletion evidence described in §3.
Complaints. If you think we have not handled your data properly, please tell us first at support@assetsort.com or through the contact form. We will acknowledge your complaint within 30 days, look into it, keep you informed and tell you the outcome. You can also complain to a supervisory authority: our lead authority is the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl); you may instead go to the authority in the EU country where you live or work, or in the UK to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
8. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The service raises alerts for your organisation — for example, about an account that has not signed in for a while — but any decision about you is taken by your organisation.
10. Children
AssetSort is a service for businesses and is not intended for anyone under 18.
11. Changes to this policy
We will post any change here and update the date at the top. If a change materially affects how we use your data, we will also tell account holders by email or in the service before it takes effect.