Asset Drive AI Ltd · Registered in England and Wales
Privacy
What we collect, where it lives, who else touches it, and how to get it back.
Last updated
Who we are
AssetDrive is operated by Asset Drive AI Ltd, a private limited company registered in England and Wales, company number 16951764. Registered office: 43 Furlong Road, Bourne End, England, SL8 5AG.
For anything in this notice, or to exercise any of the rights below, email hello@assetdrive.ai. The terms of the service itself are on our Terms page.
For the personal data of your own staff and contractors that you upload or invite into a project, you are the controller and we are your processor. For your account and billing data, and for visitors to these pages, we are the controller.
What we collect
- Account data — name, work email, organisation, a profile photo if you add one, either a password hash or the identifier from your Google or Microsoft sign-in, and the IP address and browser each signed-in session started from.
- Project content — the documents you upload or email to a project, the planning documents AssetDrive downloads for your scheme from the council’s public planning register, and what AssetDrive derives from them: extracted facts and dates, the list of documents your scheme should hold, who is responsible for each, and the activity history. This is the substance of the service and it often contains personal data about third parties (a named fire engineer on a certificate, a signatory on a warranty).
- Questions asked of AssetDrive AI — the questions your team asks about a project, kept with the answers as conversations, and questions residents ask in a home’s resident handbook, which are sent to the AI to answer.
- Addresses for printed items — if you order printed resident cards or labels, the names and addresses they are sent to.
- Billing data — once paid billing is switched on for your organisation, the billing name, address and tax ID you give Stripe. Card details are entered on Stripe’s own page; we never see them.
- Operational data — logs, error reports, and IP addresses used to rate-limit and block misuse of public pages and links (resident links, invitations and the contact form). Used to keep the service running and secure, and to find bugs.
- Usage data — on this website, the pages you view, the links and buttons you click, how much of our films you watch and how fast pages load. These are recorded against a random ID that our analytics provider (PostHog) keeps in your browser, not against your name, and PostHog is set not to store your IP address. In the app, the main steps of getting started (signing up, verifying your email, creating an organisation and a project, inviting people or accepting an invitation, generating the document list, filing a first document) are recorded against your account, with your name, email and organisation name and the campaign or website that brought you, if we know it, so we can see where new customers get stuck and which campaigns work. Other clicks in the app are counted without your name. We do not record your screen.
- Enquiries and customer records — when you contact us, ask for early access or book a walkthrough: your name, work email, organisation and role, roughly how many homes you have, and your message; and notes of our emails, calls and meetings with you. Once your organisation has a project on AssetDrive, we also keep a customer record for its account owner, even if they have not contacted us: their email, how many homes, projects and required documents the organisation has, how far into its trial it is, whether it has filed a first document, the campaign or website that first brought it to us, and a simple rule-based flag (from project size, number of projects and team size) that helps us decide whom to talk to first. The flag never changes what you can do in AssetDrive. Each early-access request is emailed to our founder, with a copy to the founder’s mailbox at their other company.
We do not buy personal data, we do not sell it, and we do not use your project content for advertising.
Why we use it
UK GDPR requires a lawful basis for each use of personal data. Ours are:
| What we do | With what | Lawful basis |
|---|---|---|
| Provide the service your organisation signed up for, and bill for it | Account and billing data | Contract, if you signed up for AssetDrive yourself. If your organisation added or invited you: legitimate interests, providing the service it signed up for |
| Keep billing records for as long as tax law requires | Billing data | Legal obligation |
| Store, file and answer questions about your project documents, and send the printed items your organisation orders | Project content, questions asked of AssetDrive AI, and addresses for printed items | We act on your organisation’s instructions as its processor; your organisation decides the basis |
| Keep AssetDrive secure and working, and fix faults | Operational data | Legitimate interests: a secure, reliable service for every customer |
| Understand how the website and app are used, and improve them | Usage data | Legitimate interests: improving the product. The website’s analytics storage is used only for statistics, as UK law now allows without asking first. Privacy choices at the foot of this website turns off the website and in-app counting, and the app follows the same choice. It does not cover the getting-started steps recorded against your account; to object to those, email hello@assetdrive.ai |
| Reply to enquiries, run walkthroughs and look after customers | Enquiries and customer records | Legitimate interests: running a business-to-business relationship. You can object at any time by emailing hello@assetdrive.ai. We will stop, and keep a note that you objected so we do not contact you again |
| Measure whether our LinkedIn adverts work | LinkedIn’s identifiers on this website and, when you start a project from this website or send us an enquiry, a hashed email | Your consent, which you can withdraw at any time with Privacy choices |
We do not send newsletters or automated marketing emails. If you sign up, ask for early access or contact us, our founder may email you personally about AssetDrive; ask us to stop and we will. Before we send any automated marketing email, we will say here who receives it and how to stop it.
Where it lives
AssetDrive is being set up to run on Amazon Web Services in the London region (eu-west-2), with documents and the database encrypted at rest and connections encrypted in transit. We will confirm this here before public launch. Access follows the organisation and project membership you set — people in your organisation can open its projects; people you invite from outside see only the projects they have been added to. Some of the providers below process data outside the UK; see International transfers.
Who else processes it
We use the providers below to run AssetDrive. This is the list as at the date above, and we will update it here before adding another.
| Provider | What for | What it receives |
|---|---|---|
| Amazon Web Services | Hosting, database, document storage and, where switched on, receiving project email | Account data and project content |
| Anthropic | AI that runs the setup conversation, reads contracts and planning documents, and answers questions in AssetDrive AI and the resident handbook | Document text (and, for scanned documents local text recognition can’t read, the page images or the file itself), project details and the questions asked |
| OpenAI | AI that files documents to the right place, and an alternative model for AssetDrive AI answers | Document text, file names and project details |
| TypeSafe | An optional filing step that picks the matching record from a shortlist. Used only when switched on | Extracts of document text and the shortlist |
| Resend | Emails from AssetDrive — invitations, sign-in verification, notifications, and alerts to our team about new enquiries | Names, email addresses and the content of those emails |
| Stripe | Billing and payments, once paid billing is switched on | Billing name and address, tax ID and payment details |
| Stannp | Printing and posting resident welcome cards, if you order them | Recipient names and addresses, and the card artwork |
| Sticker it | Printing resident cupboard labels, if you order them | The delivery name, address and contact details you enter, and the label artwork |
| Sentry | Error reports, when switched on | Technical diagnostics. Reports from the AI service can include extracts of what was sent to the AI models |
| Google Fonts | Delivering the typeface in emails we send you (this website serves its own) | Your IP address and email app details, when your email app loads the typeface |
| PostHog | Website and product analytics (EU hosting) | Pages viewed, clicks, usage events and page-speed measurements; your name and email once you have an account; and, when you send us an enquiry, your name, email, what it was about and the size band you chose (kept apart from your browsing). You can turn website analytics off at any time |
| Attio | Customer relationship records | Names, work emails, organisation, role and the messages you send us, including our emails and meetings with you, because Attio is connected to our email and calendar; account-level usage totals; and the campaign or website that brought you, if we know it |
| The founder’s other company | A copy of each early-access alert, to the founder’s mailbox there | The details in the request: name, work email, role, company, homes band and message |
| Google Workspace | Our company email (including hello@ and security@assetdrive.ai), calendar and walkthrough booking page | Your name and email, anything you write to us, and the details you give when you book a walkthrough |
| Measuring our LinkedIn adverts — only if you allow it | Browsing identifiers on this website and, when you start a project from this website or send us an enquiry, a hashed email for conversion matching |
If you sign in with Google or Microsoft, that provider confirms who you are under its own privacy terms. AssetDrive’s code can also use Voyage AI (search indexing), but it is not switched on. We will add a provider to this list before switching it on.
International transfers
Where personal data leaves the UK, UK law requires a recognised safeguard. The European Economic Area is recognised as adequate by UK law. For the United States, the recognised safeguards are the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) and the UK Addendum to the EU standard contractual clauses. As at the date above:
| Provider | Where it processes | Safeguard |
|---|---|---|
| Amazon Web Services | Stored in London (eu-west-2). Web traffic passes through Amazon’s CloudFront network, normally at the location nearest you, which can be elsewhere in Europe or in North America | Stored in the UK. For the edge network, the UK Addendum in AWS’s data processing addendum; Amazon is also certified to the UK–US data bridge |
| Anthropic | United States, and may process elsewhere | UK Addendum, in Anthropic’s data processing addendum |
| OpenAI | United States | UK Addendum, in OpenAI’s data processing addendum |
| TypeSafe | United States | Being agreed; we will name it here once signed |
| Resend | Sends from Ireland; stores account data and email logs in the United States | UK–US data bridge and the UK Addendum |
| Stripe | United States and other countries | UK–US data bridge and the UK Addendum |
| Sentry | Frankfurt, and may process in the United States | EEA adequacy; UK–US data bridge |
| PostHog | Frankfurt, and its own providers may process in the United States | EEA adequacy; UK–US data bridge and the UK Addendum |
| Attio | A UK company; its own transfers are covered by its data processing addendum | UK International Data Transfer Agreement or UK Addendum, in Attio’s addendum |
| Ireland and the United States | UK Addendum; LinkedIn is also certified to the UK–US data bridge | |
| Stannp | UK and the European Economic Area | EEA adequacy |
| Sticker it | Being confirmed with the supplier | Being agreed; we will name it here once signed |
| The founder’s other company | A UK company; its email is hosted by Google, whose data centres include the United States | UK–US data bridge, and Google’s data processing terms with that company |
| Google Workspace | Google’s data centres, including the United States | UK–US data bridge, and Google’s data processing terms |
| Google Fonts | Google’s worldwide network | Google is certified to the UK–US data bridge |
To ask where a particular provider processes data, or for a copy of a safeguard, email hello@assetdrive.ai.
AI processing
AssetDrive sends document text and project details to the AI providers above so it can file each document against the record it proves, pull out dates and facts, and answer questions. The list of documents your scheme should hold comes from AssetDrive’s rulebook of UK regulations, together with what the AI reads from your contracts and planning documents.
AI files what it’s sure of. Anything uncertain waits for your team. Sign-off is always a person.
The list of documents AssetDrive gives you is not professional advice, and it is not a substitute for the judgement of the people who carry statutory duties on your scheme. You can change it, and the activity history shows who uploaded, approved or changed what.
Filing model training
When someone on your team reviews where AssetDrive filed a document — confirming it or moving it — we keep a copy of that document, a short text extract and the decision in your organisation’s training archive. We use that archive to train a filing model that belongs to your organisation and is used only on your organisation’s projects.
The archive is kept separately from the project, so it stays until you ask us to delete it, even if the project itself is deleted. We never sell your documents. We share them only with the providers listed above, to run AssetDrive.
How long we keep it
We keep project content for as long as your organisation has an account with us, because the record’s value is that it outlasts the project. Earlier versions of each file are kept with it, so the history stays intact. If you stop paying, your schemes freeze to a read-only archive rather than being deleted — see the Terms. Every handed-over home’s manuals and documents stay online for 10 years after handover.
Ask us to delete your organisation’s data and we will do so within 30 days — including earlier file versions and your organisation’s training archive — other than anything we are legally required to keep and the manuals and documents of homes handed over in the last 10 years, which we promise stay online for 10 years after handover: those schemes are archived instead of deleted. Copies in automated backups will be removed as those backups expire.
Enquiries and customer records are kept while we are in touch with you or your organisation is a customer, and deleted when they are no longer needed for that. Usage data is kept only for as long as it helps us understand how AssetDrive is used. Server logs and error reports are kept for a short period, to fix faults and keep the service secure.
Getting your data out
You can download any document, and its earlier versions, from AssetDrive yourself. Recorded handover packs export with their filing structure, an index and a key. For a whole-project export, email hello@assetdrive.ai.
Your rights
Under UK GDPR you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict processing, and ask for it in a portable format. Where we rely on legitimate interests you can object at any time. If you object to our customer records, we will stop, and keep a note that you objected so we do not contact you again. Email hello@assetdrive.ai and we will respond within one month.
Complaints. If you are unhappy with how we have handled your personal data, email hello@assetdrive.ai with “Data complaint” in the subject. We will acknowledge it within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.
If you are the customer and the request concerns your own staff or supply chain, it comes to you first — we will help you answer it.
Cookies and similar technologies
We set the cookies needed to keep you signed in. On this website we also use first-party analytics (PostHog, hosted in the EU) to understand how the site and product are used and to improve them — not to track you across other websites. You can turn analytics off at any time with Privacy choices at the foot of every page of this website. The app follows the same choice, and the first time you open it, it tells you about analytics and offers to turn them off.
If you arrive from one of our tagged links, the campaign tags (such as
utm_source) travel from page to page in the web address; if you
arrive from another website without them, that website’s name (such as
linkedin.com) travels instead. If you sign up, they are recorded with your
organisation, so we can tell which campaign or website brought you. Nothing
is stored on your device for this, and nothing is carried while analytics is
off.
We use LinkedIn's advertising measurement only if you allow it. Until you say yes, LinkedIn's code does not load.
Security incidents
To report a security weakness in AssetDrive, email security@assetdrive.ai. We acknowledge reports within two working days.
If a breach puts personal data at risk, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it where the law requires, and tell the people affected without undue delay where the risk to them is high. Where we hold the data for your organisation, we will tell your organisation without undue delay, with what we know, so it can meet its own duties.
Certifications
We are not yet certified to ISO 27001, SOC 2 or Cyber Essentials. We would rather say so here than let you find out during procurement. Ask us where we are up to and we will tell you honestly.
Changes
If we change this notice we will update the date at the top, and we will tell account owners by email before any change that materially affects how we handle your data.