Privacy policy

AssetMemo is operated from the United Kingdom. For any privacy question or request, contact us at support@assetmemo.bio.

There is no third-party analytics, advertising, or cross-site tracking script on this site. Our self-hosted, privacy-first measurement collects aggregate daily page views, approximate reading session duration, unique daily visitor counts, and the category of site a visit arrived from (for example “search” or “social”), taken from the standard browser referrer and reduced to that category before it is stored. The full referring address is never kept.

To count daily visitors and session dwell time, our servers generate a daily-rotating one-way cryptographic hash of connection attributes (IP address and user agent). This hash resets at midnight UTC and is never linked to an account.

To learn whether visitors come back, the site stores one random identifier in your browser (localStorage, key am_visitor). It is first-party: only this site can read it, and it is sent only to this site. It contains no information about you. Our servers keep a one-way keyed hash of it next to the date of each visit and the category of site the visit arrived from. We use it for one purpose, which is to count return visits so that we can improve the site. It is never linked to an account or an email address, never shared with anyone, and never used for advertising.

The identifier expires in your browser after 13 months. Our servers clear its hash from visit records after 25 months. If your browser sends the Global Privacy Control signal, the site stores no identifier. You can turn visit measurement off here at any time, at no cost. The choice applies to this browser, and it stops all visit data, the page counts included.

Anonymous browsing requires no account and sets no tracking cookies. Preferences such as your theme and sidebar navigation state remain stored locally in your own browser (localStorage, never sent to our servers). An optional layout-preview choice uses a first-party cookie only if you explicitly activate it.

If you create an account we store your email address, sign-in records (session tokens, and where you enroll one, a passkey credential), your subscription state, and feature onboarding milestones to personalize your diligence feed. Sign-in emails are delivered by our email provider, Resend, acting as a processor. A strictly necessary session cookie keeps you signed in; it exists only for that purpose.

Payments are processed by Stripe on Stripe-hosted pages. Your card details never pass through this application. We store the subscription facts Stripe reports back to us (plan, status, billing period) so your access works; your payment methods and invoices live in Stripe's customer portal.

Questions you submit to the Ask feature are sent to a third-party AI model provider to generate the answer, together with the site data needed to answer it. Question text is processed to produce the response and is not used by us to build a profile of you. Rate limiting holds request counts against your IP address transiently, for abuse prevention only.

We process first-party, pseudonymous usage analytics under our legitimate interest (UK GDPR Article 6(1)(f)) to monitor platform reliability, measure feature engagement, and improve research tools without invading reader privacy. The visitor identifier is stored for statistical purposes only, under the exception in regulation 6 of the Privacy and Electronic Communications Regulations. You can object at any time with the control in the browsing section above.

Under UK GDPR you can ask for access to, correction of, or deletion of your personal data, object to or restrict processing, and take your data elsewhere. Contact us and we will respond within one calendar month. You can also complain to the Information Commissioner's Office (ico.org.uk). Deleting your account removes your personal data from our systems; records Stripe must retain for financial-compliance reasons remain with Stripe.

The service is hosted in the European Union (Amsterdam). Our processors (Stripe, Resend, our hosting and AI providers) may process data in other jurisdictions under their own safeguards. If this policy changes materially we will update this page and its date; continued use after a change means the new version applies.