Privacy Policy

We handle personal data in two different roles, depending on whose data it is.

When we are the controller

For the data we need to run our own business: your account and profile, billing, support and contact enquiries, security logs, product usage and our website. We decide why and how this data is used, and this policy applies to it in full.

When we are a processor

For the business data you and your team put into the Service, such as your clients' and contacts' details, proposals, contracts, invoices, projects, time entries, documents and messages. Your organisation is the controller of that data and decides what goes in and why. We process it only on your organisation's instructions, to provide the Service, under our Terms of Service and our data processing agreement.

Our data processing agreement (DPA) is available on request from business@appsuitehq.com.

If you are a client or contact of one of our customers and your details are in that customer's AppSuiteHQ account, the customer's own privacy notice applies. Please send requests about that data to the customer. If you contact us instead, we will pass your request on to the customer where we can identify them.

We use personal data to:

• Provide the Service: create and secure your account, run your organisation's workspace and tools, and store and display your data
• Run the operating-system features: prepare briefings, signals, drafts, answers and forecasts from your organisation's data, and keep its organisational memory (see “Artificial intelligence features”)
• Take payments, manage subscriptions and AI allowances, and keep billing and tax records
• Send service emails, such as sign-in and security messages, invitations, receipts, notices about your plan or AI allowance, and changes to our terms
• Answer your questions, support requests and contact enquiries
• Keep the Service secure: detect, investigate and prevent fraud, abuse and security incidents, and limit excessive use
• Understand how the Service is used, fix errors and improve features, including the quality of AI output
• Comply with our legal obligations and establish, exercise or defend legal claims

We do not sell personal data, and we do not use it for advertising.

Where we act as controller, the GDPR and the UK GDPR require a legal basis for each use of personal data. We rely on:

Performance of a contract

To provide the Service you signed up for, manage your account and subscription, take payments and provide support (Article 6(1)(b)).

Legitimate interests

To keep the Service secure and prevent abuse, understand usage, improve the Service and its AI features, reply to enquiries from people who are not yet customers, and establish or defend legal claims. We weigh these interests against your rights, and you can object (Article 6(1)(f)).

Legal obligation

To keep accounting and tax records, answer lawful requests from public authorities and meet our other legal duties (Article 6(1)(c)).

Consent

Where we ask for your consent for a specific purpose. You can withdraw it at any time; this does not affect processing that took place before (Article 6(1)(a)).

For business data we process as a processor, your organisation is responsible for having a legal basis to put that data into the Service and to use it.

We do not sell personal data or share it for advertising. We share it only in these cases:

Service providers

Companies that host and run parts of the Service for us, listed below. They may use personal data only to provide their services to us, under contracts that require them to protect it.

Within your organisation

What you add to your organisation's workspace is visible to its other members according to their roles and permissions.

At your direction

When you or your organisation ask us to, for example when a person approves sending a message to a client, or when you link an external account.

Business transfers

If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction, and this policy will continue to apply to it.

Legal requirements

When the law or a valid request from a public authority requires it, or when it is needed to protect our rights, our users or others.

Some of our providers process personal data outside the United Kingdom and the European Economic Area, for example in the United States. When that happens, we rely on safeguards recognised by data protection law: the European Commission's Standard Contractual Clauses, together with the UK Addendum or the UK International Data Transfer Agreement for UK data, or the EU–US Data Privacy Framework (and its UK extension) where the provider is certified under it.

You can ask for more information about these safeguards at business@appsuitehq.com.

We keep personal data while your account or organisation is active, and afterwards only for as long as we need it for the purposes in this policy or the law requires us to keep it.

Archived organisations

An owner can archive an organisation. Its members lose access, but its data is kept.

Scheduled deletion

An owner can schedule an organisation for deletion. Access stops, and its data is permanently deleted after the scheduled deletion date.

After deletion

When an account or organisation is deleted, we delete or anonymise its personal data, except what the law requires us to keep, such as invoices and payment records, which we keep for the period set by accounting and tax law.

Backups

Copies held in our providers' backups are removed as those backups roll off on the providers' own schedule.

Logs, error reports and AI traces

Kept for a limited period for security, debugging and quality monitoring, then deleted in line with our providers' retention settings.

Enquiries

Contact and support messages are kept for as long as we need them to deal with your enquiry and any follow-up.

Anonymised data

We may keep information that has been anonymised so that it no longer identifies anyone.

Within the Service, your organisation decides how long to keep its business data and can delete records at any time. Some records are kept for set periods. Conversations with the AI assistant are kept for 12 months after the last message; an owner of the organisation can change this to anything from 1 to 60 months. A conversation that led to an action recorded in the action ledger is kept for as long as that record. Organisational memory is kept until it is replaced or deleted, and replaced entries are removed two years after they were replaced. AI disclosures and the action ledger (the record of what people, the AI assistant and automated workflows did, and why) are kept for seven years. The log of changes to business records is kept for as long as the organisation exists, and the detailed copies of the changed records in it are removed after two years.

We protect personal data with technical and organisational measures, including:

• Encryption in transit (TLS) and at rest, provided by our infrastructure providers
• Row-level security and access controls that keep each organisation's data separate
• Role-based permissions within each organisation
• An audit log of who prepared and who approved each action
• Restricted access to production systems

No system is completely secure. If we become aware of a personal data breach affecting your data, we will inform the affected customers and, where the law requires it, the supervisory authority and the people concerned.

Please keep your password safe, and give members of your organisation only the permissions they need.

Under the GDPR, the UK GDPR and similar laws, you have the right to:

Access

Ask for a copy of the personal data we hold about you.

Rectification

Ask us to correct inaccurate or incomplete data. You can also update most account details yourself in your settings.

Erasure

Ask us to delete your personal data, except what the law requires us to keep.

Portability

Receive the personal data you gave us in a structured, commonly used format. You can also export data from the tools yourself in common formats such as CSV and PDF.

Restriction

Ask us to limit how we use your data, for example while we check a correction.

Objection

Object to processing based on our legitimate interests, and to direct marketing at any time.

Withdraw consent

Withdraw your consent at any time where we rely on it, without affecting processing that took place before.

Complaint

Complain to a data protection supervisory authority (see “Complaints”).

To exercise any of these rights, email business@appsuitehq.com. We have not appointed a Data Protection Officer, so please send all data protection requests to that address.

We reply within one month. For complex or numerous requests this can be extended by up to two further months, and we will tell you if it is. We may ask you to confirm your identity before we act on a request.

If your data is held in the AppSuiteHQ account of a business you deal with, please contact that business directly: it controls that data, and we will help it respond.

We use only cookies and browser storage that are strictly necessary for the website and the Service to work, or that remember a choice you have made. We do not use analytics or advertising cookies. Product usage is recorded on our servers (see “Information collected automatically”), not through cookies.

Sign-in session

Cookies whose names start with “sb-”, set by our authentication provider, Supabase. They keep you signed in and protect your session, and are removed when you sign out or when they expire.

NEXT_LOCALE

Remembers the language version of the site you last used, so you see it again next time. It expires after one year.

appsuitehq_consent

Remembers that you have seen our cookie notice, so it is not shown again. It expires after 150 days.

Browser storage

Your browser's local storage keeps interface preferences, such as your light or dark theme and layout choices. It stays in your browser until you clear it.

Because these cookies are needed for the site to work or to remember your choices, we do not ask for consent to use them. You can block or delete cookies in your browser settings, but if you block the sign-in cookies you will not be able to sign in.

When you pay or manage your billing, you use pages hosted by Stripe, which sets its own cookies under Stripe's privacy policy.

The Service is for businesses. You must be at least 18 years old, and able to act for your business, to create an account or use the Service. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact us at business@appsuitehq.com and we will delete it.

We may update this policy when the Service or the law changes. We will publish the new version on this page and change the “Last updated” date at the top. If a change is significant, we will also tell you by email or in the Service before it takes effect.

This version, dated 27 September 2026, replaces the version of 15 January 2025. It adds our AI features and the providers behind them, explains when we act as controller and when as processor, lists all our service providers, corrects the cookie information (essential cookies only), and updates the retention, security, age and contact details.

This policy is written in English. If a translation conflicts with the English version, the English version prevails.

For questions about this policy or to exercise your rights, contact us:

Email

business@appsuitehq.com

Post

AppSuiteHQ Ltd, Rue de Lyon, 75012 Paris, France

Data Protection Officer

Not appointed. Please send data protection requests to business@appsuitehq.com.

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where the issue arose. In France, this is the Commission nationale de l'informatique et des libertés (CNIL, https://www.cnil.fr). In the United Kingdom, it is the Information Commissioner's Office (ICO, https://ico.org.uk).