AssetWRX Privacy Policy

This is the same text shown in AssetWRX. AssetWRX asks for your agreement to this version.

Last updated: 9 October 2026 Effective: 9 October 2026 Version: 1.6.0

This Privacy Policy explains how AssetWRX (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use our mobile applications, web application, and related services (collectively, the “Service”). It is written to comply with the EU General Data Protection Regulation, the UK GDPR and the Data Protection Act 2018, the California Consumer Privacy Act / California Privacy Rights Act, and platform requirements set by Apple and Google.

What changed in 1.6.0: if you consent to analytics, it now includes session recordings of how you move through the app, with everything you type hidden, and the phone app asks you once whether you want to share usage data (section 9). PostHog, our analytics provider, now stores this data in the United States, covered by the transfer safeguards in section 7 (section 6).

What changed in 1.5.0: if your workspace uses planning and you choose to share it, the app sends your device’s location while it is open so your workspace’s owners and admins can see when you will be late and re-plan your day. Only the latest location is kept, for no more than two hours (sections 3.1, 5.3 and 8).

What changed in 1.4.0: WRX Vision can send up to eight photos from a scan, not six, and on a walk-round it fills in routine answers it reads clearly for you to check (section 5.1). We now describe WRX Verified, which compares a job’s before and after photos with what the job needed (section 5.1), and what we receive when your organisation runs AssetWRX inside its own portal with its own sign-in (section 3.3).

What changed in 1.3.0: you can subscribe inside the iOS and Android apps. Apple or Google takes that payment, and RevenueCat (added as a sub-processor) tells us which subscription your workspace has (sections 3.1, 3.3 and 6). You can also report AI output you think is offensive, harmful or wrong; we keep what you report so we can review it (sections 3.2 and 8).

What changed in 1.2.0: a new section 5.1 explains what our AI features, including WRX Vision, send to Google and what we keep. A new section 5.2 explains Vision improvement data: the evidence photos behind reviewed Vision suggestions are used to train Vision. It is on by default and the workspace owner can turn it off at any time. Google Cloud (EU) has been added as a sub-processor for that training only.

1. Who is responsible for your data

AssetWRX is operated by Cogniforma H Ltd, a company registered in England & Wales with company number 16176541, whose registered office is at 17 Quaves Road, Slough, SL3 7NX, UK (“Cogniforma”, “we”, “us”). For privacy matters you can contact us at privacy@assetwrx.com.

Our supervisory authority in the UK is the Information Commissioner’s Office (ICO). Our Data Protection Officer, where one is appointed, is reachable at dpo@assetwrx.com; otherwise privacy enquiries are handled by our privacy team at the same address.

1.1 Our role — controller and processor

When we act as a controller. We are the controller for the personal data we determine the purposes of: your account and identity data, billing data, device and diagnostic data, and marketing preferences. This policy governs that data.
When we act as a processor. For the content you and your organisation put into the Service — your assets, inspections, jobs, photos, videos, documents, and the contact, requester and contractor records you create (“Customer Content”) — you (or your organisation) are the controller and we act as your processor, processing that content only on your documented instructions to provide the Service. Our processing of Customer Content is governed by our Data Processing Agreement, which forms part of your agreement with us. As the controller of Customer Content, you are responsible for having a lawful basis and for meeting transparency obligations towards the individuals whose data it contains (see section 5).
Vision improvement data. Unless a workspace owner turns this setting off, we use the review records and evidence photos described in section 5.2 to improve WRX Vision for all customers. For that purpose we act as a controller.

2. Scope

This policy applies to personal data processed when you:

create an account, sign in, or use any feature of the Service;
contact our support team;
receive transactional or, where you have opted in, marketing communications from us; or
visit our public website at assetwrx.com.

If your organisation has its own data processing agreement with us, that agreement controls in the event of any conflict for data processed on behalf of your organisation.

2.1 Global standard and your local law

We engineer the Service to a single, high data-protection standard equivalent to the EU/UK GDPR, and apply it globally. Where you use the Service in a jurisdiction with its own data-protection law — including the Kingdom of Saudi Arabia (Personal Data Protection Law) and the United Arab Emirates (Federal Decree-Law No. 45 of 2021) — you are responsible for ensuring that your use of the Service, and your processing of Customer Content, complies with the law applicable to you and to your data subjects. We will provide reasonable assistance to help you meet those obligations.

3. Categories of personal data we process

3.1 Data you provide directly

Account data: first and last name, email address, password (hashed), language and time-zone preferences, default workspace currency.
Workspace data: workspace name, branding, billing email, team membership, contractor and contact records you create.
Content data (Customer Content): assets, inspections, jobs, photos, videos, voice notes, dictated text, documents, signatures, QR scan results, location coordinates you elect to capture, and, where your workspace uses planning and you choose to share it, your device’s location while the app is open (see section 5.3), and any other content you create in the Service. See section 5 for our role in processing this.
Billing data: name, billing address, VAT/tax identifier, and payment instrument details. Payment instruments themselves are processed by Stripe (see section 6); we never store full card numbers. If you subscribe inside the iOS or Android app, Apple or Google takes the payment under their own terms and privacy policies; we never receive your payment details.
Support correspondence: the contents of any tickets, chat sessions, or emails you send us.

3.2 Data we collect automatically

Device and technical data: device model, operating system, app version, IP address, preferred language, time-zone offset, screen size, and crash diagnostics.
Push notification tokens: a device token issued by Apple (iOS) or Google Firebase Cloud Messaging (Android), used only to deliver notifications to your device.
Usage data: features you use, screens you visit, errors encountered, and timing metrics (only after you have granted analytics consent — see section 9).
Vision review records: when you accept, change or reject a WRX Vision suggestion, we record that decision (see section 5.1).
AI output reports: if you report an AI response, we keep the text you were shown, the reason you chose, when you reported it, and your account and workspace, so we can review it and improve what the AI is allowed to say.
Cookies and similar technologies: see our Cookie Policy.

3.3 Data from third parties

Authentication providers (Google, Apple, Microsoft) — if you sign in via one of these providers, we receive your name, email, and a stable provider identifier. We do not receive your password.
Stripe — billing status, subscription state, invoice metadata.
RevenueCat — for subscriptions bought in the App Store or Google Play: the product, the subscription state and its renewal, cancellation and refund dates, linked to your workspace identifier. We do not receive your Apple or Google account details.
Your organisation’s identity provider (for example Microsoft Entra ID) — when your organisation runs AssetWRX inside its own portal and signs you in itself, we receive a signed identity token. We keep the stable identifier it carries for you (such as your Entra object ID), its issuer and the email address at the time your account was linked, so the same person always reaches the same AssetWRX account; we record when each embedded session started and ended and which portal opened it, for security. We do not receive your password.

4. Purposes and lawful bases

For the personal data we process as controller, we rely on the following lawful bases:

Purpose	Lawful basis (GDPR Art. 6)
Create and maintain your account; provide the core Service	Contract (Art. 6(1)(b))
Bill you for paid plans; collect taxes	Contract + legal obligation (Art. 6(1)(b), (c))
Send service notifications (incident, security, billing, inspection reminders)	Contract + legitimate interests (Art. 6(1)(b), (f))
Detect, investigate, and prevent fraud, abuse, or unauthorised access; secure the Service	Legitimate interests (Art. 6(1)(f))
Crash reporting and stability monitoring (Sentry — PII-scrubbed)	Legitimate interests (Art. 6(1)(f))
Measure the accuracy of WRX Vision suggestions (review records, no photos)	Legitimate interests (Art. 6(1)(f))
Train WRX Vision with evidence photos, unless the workspace owner has turned off Vision improvement data	Legitimate interests (Art. 6(1)(f)); the owner can object at any time by turning it off
Product analytics (PostHog)	Consent (Art. 6(1)(a))
Marketing email and push notifications	Consent (Art. 6(1)(a))
Comply with legal obligations (tax, accounting, lawful requests)	Legal obligation (Art. 6(1)(c))
Defend or assert legal claims	Legitimate interests (Art. 6(1)(f))

For Customer Content you upload, you are the controller and are responsible for establishing the lawful basis for that processing. If Customer Content includes special category data (Art. 9) — for example health-related photographs in an inspection — you are responsible for ensuring an Article 9 condition is met (such as the explicit consent of the individual concerned) before you upload it. We do not solicit special category data and provide tools to help you avoid capturing it unnecessarily.

5. How we handle Customer Content

Your inspections, assets, jobs, photos, voice notes, documents and other Customer Content remain yours. We act as your processor and use it solely to provide the Service to you and your workspace on your instructions, including:

showing, indexing, and searching your content in the app;
generating reports, summaries, and AI-assisted suggestions that you request;
backing up your data to ensure durability;
enabling sharing within teams or with collaborators you invite.

Because you are the controller of Customer Content, you are responsible for providing any notice required to the individuals it concerns (for example your own contacts, contractors, requesters, or inspection subjects), and for having a lawful basis for including their data. Our processing of Customer Content is governed by our Data Processing Agreement.

5.1 AI features and WRX Vision

AI features (asset reports, inspection summaries, image analysis, dictation clean-up, and WRX Vision) are optional and run only when you use them. When you do, we send the relevant Content to Google (Gemini API) as a sub-processor, under Google’s API data-processing terms. Google does not use it to train its models. Under those terms Google may keep it for a limited period solely to detect abuse of its service.

WRX Vision suggests answers to inspection checks from photos you take:

What is sent. Up to eight reduced-size photos from the scan, the checks being answered, and your language. On phones, some reading (text, barcodes) happens on the device first.
What is not kept. We do not store the scan photos, the prompt or the raw AI response.
Photos you keep. Where a check fails, a defect is confirmed, a reading is taken, or the template asks for evidence, the supporting photo is saved to the inspection as an ordinary evidence photo. It is Customer Content like any other photo.
Review records. Each time someone accepts, changes or rejects a suggestion, we record the decision, the suggested and final answers, the check, the asset type and who made the decision. These records contain no photos. We use them to measure and improve Vision’s accuracy. They are deleted after 24 months, or earlier if the inspection or workspace is deleted.
A person decides. Vision suggests answers. On a walk-round of a whole inspection, routine answers Vision reads clearly are filled in and shown to the inspector, who can undo them; every finding, and anything Vision is unsure of, waits until a person accepts it.

WRX Verified (where your workspace uses it) checks the evidence for completed jobs. When a job is submitted as complete, we send up to eight reduced-size before and after photos of that job, together with what the job was expected to achieve, to Google (Gemini API) to compare them. We keep the result (a status and short notes, no photos) with the job. The photos themselves are the job’s ordinary evidence photos. A reviewer, not the AI, decides whether the work is accepted.

Instructions written in a photo are treated as data, and the AI is told to ignore people, faces and number plates unless a check needs them.

5.2 Vision improvement data (on by default, can be turned off)

The only Customer Content we use to train AI models is described in this section. It is used only while Vision improvement data is on. The setting is on by default for workspaces that use WRX Vision, and the owner of your workspace can turn it off at any time (Account → Workspace → AI & automation audit). While it is on:

the evidence photos your team kept for reviewed Vision suggestions, together with their review records, may be used to train our Vision model;
before use, we remove embedded photo metadata (such as camera details and GPS location);
the photos are copied to Google Cloud in the EU (Netherlands) for training and are deleted from there within 30 days;
the trained model is ours, runs in Google Cloud in the EU, and is used to provide Vision to all customers. It does not keep copies of the photos;
no single workspace makes up more than 30% of any training set.

When the owner turns the setting off, no further photos or records from the workspace are used, including ones recorded before. A model that was already trained cannot be un-trained, so photos already used remain reflected in it. Deleting a photo or an inspection also removes it from all future training. Decisions recorded while the setting was off are never used, even if it is later turned back on.

Because the photos can show people or places, a workspace that is not entitled to share them for this purpose should turn the setting off.

If your workspace uses planning and you choose to share where you are, the app sends your device’s location every few minutes while it is open and you have work planned that day. It is never sent from the background. Only your workspace’s owners and admins can see it, to see when you will be late for your next visit and to re-plan your day. We keep only the latest location, and erase it after two hours, when you stop sharing, when you leave the workspace, or when your workspace turns the feature off. You can stop sharing at any time from My Day. Your choices to share and to stop are recorded in your consent history. Your workspace is the controller of this data (see section 1.1), and we do not send it to any sub-processor other than our hosting provider.

6. Sub-processors and recipients

We share personal data with the following sub-processors, each under a data processing agreement that imposes confidentiality and security obligations consistent with the GDPR. A current list is also published at assetwrx.com/legal/subprocessors.

Sub-processor	Purpose	Region
Supabase (database, auth, storage, edge functions)	Core infrastructure	EU / US (configurable)
Stripe Payments Europe Ltd / Stripe Inc.	Subscription and credit-pack billing	EU + US
RevenueCat, Inc.	App Store and Google Play subscription status for in-app purchases	US
Resend, Inc.	Transactional and (with consent) marketing email delivery	US
PostHog Inc.	Product analytics and session recordings — only when you have consented	US
Functional Software, Inc. (Sentry)	Error and crash monitoring	US
Google LLC (Gemini API)	AI features you invoke, including WRX Vision photo analysis (not retained)	US
Google Cloud (Vertex AI, Cloud Storage)	WRX Vision training, unless the workspace owner turns off Vision improvement data	EU (Netherlands)
Komoot GmbH (Photon geocoding, OpenStreetMap data)	Address autocomplete and geocoding	EU
Apple Push Notification Service	Delivery of iOS push notifications	US
Google Firebase Cloud Messaging	Delivery of Android push notifications	US
Cloudflare R2 (where enabled)	Object storage for large media	EU + US

We may also disclose personal data:

to professional advisers (legal, accounting, audit) under confidentiality obligations;
in connection with a corporate transaction (merger, acquisition, restructuring), in which case you will be notified before personal data becomes subject to a different privacy policy;
when required by law, regulation, court order, or to enforce our Terms of Service or protect the rights, property, or safety of the Service, our users, or others.

We do not sell personal data and we do not share personal data for cross-context behavioural advertising as defined by the CCPA / CPRA.

7. International transfers

Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on:

the European Commission’s Standard Contractual Clauses (2021/914) and, for UK transfers, the UK International Data Transfer Addendum;
Supplementary measures as described in our Transfer Impact Assessment (available on request);
For transfers to providers in countries benefiting from an adequacy decision (e.g. UK→EEA), that adequacy decision.

8. Retention

We retain personal data for as long as necessary to provide the Service and to comply with our legal obligations. Specifically:

Account and content data: until you delete your account. Upon deletion, business records are retained for up to 30 days in a soft-deleted state to enable recovery; thereafter they are hard-deleted or irreversibly anonymised. See the Data Deletion Policy.
Photos sent for AI analysis: not stored by us. Google may keep them for a limited period solely to detect abuse (see section 5.1).
Vision review records: 24 months, or until the inspection or workspace is deleted.
AI output reports: 24 months, or until your account is deleted.
Shared location for planning: only the latest location, erased after two hours or sooner (see section 5.3).
Vision training copies (while Vision improvement data is on): deleted from Google Cloud within 30 days. Trained models do not contain copies of the photos and are kept for as long as we use them.
Billing records: retained for the statutory period required by tax authorities in our operating jurisdictions (typically 6–10 years).
Audit logs (security and consent): retained for up to 7 years for legal-defence purposes.
Marketing consent records: retained for as long as you are subscribed plus 3 years after withdrawal, to evidence the lawful basis of past sends.

9. Cookies, analytics, and tracking

The mobile apps do not use tracking that links to advertising identifiers. We do not request the iOS App Tracking Transparency prompt for advertising purposes.

Within the app and on our website you can independently consent to:

Analytics — product usage data captured by PostHog, used to understand which features are used and where they break. Off by default; you may grant or withdraw consent at any time in Account → Privacy & Data → Communication Preferences (in-app), when the phone app asks you once, when you sign up, or via the cookie banner (web). With analytics consent only, this includes session recordings of the screens you use and where you tap; everything you type and every input field is hidden before a recording leaves your device, and recordings are kept for a limited period.
Marketing — see section 11.

Crash and security telemetry (Sentry) is processed under legitimate interests and is not controllable via a consent toggle. We strip directly identifying information (email, names, authentication headers) from crash payloads before transmission.

10. Your rights

If you are in the EEA, UK, Switzerland, or California, you have the right to:

Access your personal data and obtain a copy in a portable format.
Rectify inaccurate or incomplete data.
Erase (“be forgotten”) your data, subject to lawful retention exceptions.
Restrict or object to certain processing (in particular, processing based on legitimate interests, including profiling). This includes the use of Vision review records and training photos described in section 5.
Withdraw consent at any time, where processing is based on consent — without affecting the lawfulness of processing before withdrawal.
Data portability — receive your data in a structured, machine-readable format.
Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Our AI features generate suggestions for your review and do not make such decisions about you without human involvement.

Where we act as processor of Customer Content, we will refer a request we receive from one of your data subjects to you (the controller) and assist you in responding.

You can exercise most of these rights directly:

Access / portability: Profile → Privacy & Data → Export My Data.
Erase: Profile → Privacy & Data → Delete Account.
Marketing withdrawal: Profile → Privacy & Data → Communication preferences.
Other requests: privacy@assetwrx.com.

We respond within 30 days (extendable by a further 60 days for complex requests, in which case we will notify you).

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with a supervisory authority. In the UK that is the Information Commissioner’s Office (ico.org.uk). In other EEA states, you can find your local authority via the European Data Protection Board (edpb.europa.eu).

11. Marketing

We send marketing communications (product updates, tips, promotions) only when you have given us explicit opt-in consent. Marketing consent is collected separately from acceptance of these Terms and Privacy Policy; we never treat acceptance of either as marketing consent.

Each marketing email contains a one-click unsubscribe link. You can also manage marketing preferences in Profile → Privacy & Data → Communication preferences. Withdrawal is recorded immediately and we will not send marketing email or push for the channel(s) you withdraw.

See the Marketing Consent Policy for further detail.

12. Security

We implement technical and organisational measures appropriate to the risk, including:

TLS 1.2+ in transit for all client-server communication;
AES-256 at rest for all object storage and database backups;
role-based access controls and database-level row-level security;
audit logging of administrative actions;
periodic penetration tests and dependency scanning;
least-privilege access for engineering staff.

No system is perfectly secure. We will notify affected users and supervisory authorities of a personal data breach within the timescales required by Art. 33 / 34 GDPR. Where a breach affects Customer Content, we will notify you (as controller) without undue delay so that you can meet your own notification obligations.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. Where we operate in the United States, we do not knowingly collect personal data from children under 13 (COPPA). If you become aware that a child has provided us with personal data, please contact privacy@assetwrx.com and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When changes are material we will:

update the version and effective date at the top of this document;
post the updated policy in the Service;
if you have an account, present the updated policy when you next open the app and require acknowledgement before continued use.

15. Contact

General privacy enquiries: privacy@assetwrx.com
Data Protection Officer / privacy team: dpo@assetwrx.com
Postal address: Cogniforma H Ltd, 17 Quaves Road, Slough, SL3 7NX, UK