1. Introduction

asitplan is a product of asitplan ltd ("we", "our", "us"). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our software-as-a-service platform (the "Service"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

2. Information We Collect

We may collect information about you and your organization in a variety of ways. The information we may collect on the Service includes:

• Personal Data: Personally identifiable information, such as your name, email address, and job title, that you voluntarily give to us when you register for the Service or when you choose to participate in various activities related to the Service.
• Usage Data: Information that your browser sends whenever you visit our Service or when you access the Service by or through a mobile device. This may include your computer's IP address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.
• Service & Infrastructure Data: Information you provide as part of utilizing the platform, including answers to questionnaires, and specific technical details about your organisation's IT infrastructure, hardware, and network configurations.

3. How We Use Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the Service to:

• Create, manage, and secure your account.
• Provide the core functionality of the platform, including IT management, reporting, and advisory services.
• Generate and deliver relevant status reports and strategic documents.
• Email you regarding your account, order, or critical system updates.
• Monitor and analyze usage and trends to improve your experience with the Service.
• Prevent fraudulent transactions, monitor against theft, and protect against criminal activity.
• Respond to customer service requests and provide technical support.

Public form security and requested reports

Contact, pricing, feature-suggestion and optional health-check report requests use Google reCAPTCHA through Firebase App Check to reduce automated abuse. No account is required. Google processes browser and device signals for these security checks; its Privacy Policy and Terms of Service apply. Server-side counters use keyed hashes of email addresses, account IDs for signed-in feedback, and total submission counts to limit repeated requests. Feature suggestions without a reply address share one submission counter. Site-wide submission counters do not collect visitor IP addresses. When a verified network path is configured, we also use separate counters with keyed hashes of client IP addresses. These counters do not contain questionnaire answers, contact messages, feedback or suggestion text. Google and our hosting providers may process IP addresses and other security signals as described above.

Signed-in feedback uses your current account details so the asitplan support team can respond. Feature suggestions may include an optional reply address; no account is needed to suggest a feature. Feedback and suggestions are sent to our internal support team through Resend. Please do not include passwords, access keys or sensitive infrastructure information.

Requesting a health-check report sends the summary and your email address to the address you supply and an internal copy to the asitplan team. It is not a marketing subscription or consent to sales follow-up. Enter an address you own or have permission to use. Optional scanning results are not included in the questionnaire report.

4. Data Sharing and Disclosure

We do not share your personal information with third parties except as described in this Privacy Policy. We may share information with vendors, consultants, and other third-party service providers who need access to such information to carry out work on our behalf (e.g., secure cloud hosting providers like Google Cloud and Firebase).

Website enquiries: Contact and pricing requests are sent to the asitplan team using our email delivery provider, Resend. We review sales, demo and partnership enquiries and pass relevant contact details, organisation information and requirements to our distributor to respond to your request. The distributor may involve a suitable IT partner or handle larger customers directly. Tell us about any existing partner when you enquire. No demo is booked or account activated by submitting the form.

Support and general enquiries are not forwarded to the distributor automatically. Submitting an enquiry does not subscribe you to marketing. Please do not include passwords, access keys or sensitive infrastructure information in your message. For questions about your enquiry or its intended recipients, contact hello@asitplan.app before submitting.

We strictly do not sell, rent, or trade your personal data or your organization's infrastructure data to any third parties under any circumstances.

5. Third-Party Integrations and Google API Data

Our Service allows administrators to optionally connect third-party device management platforms, such as Google Workspace or Microsoft Intune, to automate the population of their IT asset inventory.

If you choose to authorise Chromebook inventory or Google Workspace assessments:

• Chromebook inventory: Read-only access retrieves managed ChromeOS device information, including device identifiers, serial numbers, models, operating-system versions, assigned organisation units, last sync and update-support expiry. Where supplied by the institution, a device record may also include an assigned-user identifier. Basic Workspace customer information confirms the connected organisation.
• Workspace assessments: Separate read-only access retrieves directory accounts, Google two-step verification status, administrator roles, privileges and assignment scope, organisation-unit hierarchy, and membership of referenced customer-owned groups, including nested groups. These support effective policy applicability and administrator-access review. Available effective Chrome device policy is read for the connected organisation. Optional, separately approved domain-wide delegation adds read-only Workspace policy settings for sharing, mail protection and application access. This delegation uses a dedicated keyless identity and requires a Workspace super administrator. Manual assessment account reports, including account identifiers, email addresses and bounded role details, are visible only to current integration managers.
• How we use it: This information populates the organisation's asset inventory and original asitplan security checks informed by NCSC guidance, Cyber Essentials and the DfE Digital Standards. Results show collected evidence and verification gaps; they do not provide certification. These connections do not request email-message contents, Drive-file contents or write permissions to change Google accounts, devices or policies.
• Limited Use Disclosure: Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google connection data is not sold, used for advertising or used to train general-purpose AI models. Access is restricted to authorised organisation users, their permitted service partners and service processing; support access requires your authorisation.

Disconnecting a Google connection stops future collection in asitplan. A Workspace administrator can also revoke the OAuth grant or optional domain-wide delegation in Google Admin. Disconnecting does not erase the organisation's asset inventory or previously retained audit evidence; an authorised organisation administrator can request deletion through the contact below.

6. Data Retention

We will only retain your personal information for as long as it is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it.

Detailed posture scan evidence expires from assessment views after ninety days, with up to twelve calendar months of compact monthly summaries. Expired detailed observations remain excluded while storage deletion completes. Ongoing asset inventory records remain until removed under the organisation's inventory policy. Separately uploaded audit attachments retain their existing audit-evidence retention policy.

7. Children's Privacy

asitplan is designed for use by adult IT administrators, organisational leaders and authorised staff. We do not invite pupils to create accounts or interact directly with students. When an institution connects its directory or managed-device service, the technical data it authorises us to process may include account identifiers and security metadata for users under 18. For example, a managed Chromebook record may contain an assigned-user identifier. This information supports the institution’s inventory and security assessment workflows. Questions about this data, correction or deletion can be sent to legal@asitplan.app.

8. Data Security

We use industry-standard administrative, technical, and physical security measures to help protect your personal information and audit data. This includes encryption in transit (HTTPS/TLS) and at rest. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure.

9. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal data: the right to access, the right to rectification, the right to erasure, the right to restrict processing, the right to object to processing, and the right to data portability. To exercise any of these rights, please contact us using the details provided below.

10. Contact Us

If you have questions, comments, or requests regarding this Privacy Policy, please contact us at: legal@asitplan.app