Privacy notice

Who we are: CODECRETE, the company that owns and operates Assetly. Our data protection officer can be reached at privacy@assetly-app.com.

Why we hold data: only to run Assetly, so that workspace owners can keep the records of their assets, transactions and documents in one place. We do not sell data, use it for advertising or marketing, or use it to train artificial intelligence.

Where it is kept: on Amazon Web Services servers in Frankfurt, Germany, with the license of Egypt’s Personal Data Protection Center and your consent.

Your rights: you can see, download, correct and delete your data, withdraw your consent, and complain to the Center. Most of it is one click away in your privacy settings; we answer other requests within 6 working days.

This notice explains how CODECRETE (“we”, “us”) handles personal data when you visit our website or use the Assetly service, under Egypt’s Personal Data Protection Law No. 151 of 2020 and its executive regulations. It should be read together with our terms of service and our data processing agreement.

Assetly keeps the records a workspace owner enters about their assets, transactions and documents, to make managing them easier and to save them time. We process personal data only to provide that service, and for nothing else.

We never sell personal data, use it for advertising or marketing, use it to train artificial intelligence models, or use it for internal analytics or any purpose not described in this notice. We do not send marketing emails.

Account, subscription and payment data, and the technical logs of the service: we are the controller. We decide how this data is used, as described in this notice.

Everything a workspace owner enters about their assets and about people (co-owners, tenants, buyers, staff, including people who never sign in): the workspace owner is the controller, and we process that data on their behalf as their processor, under our data processing agreement. The workspace owner is responsible for having a lawful basis to enter it and for informing the people concerned.

Account information: your name, email address, password (which we store only in hashed form), phone number and profile photo.

People recorded in a workspace: names, contact details, national ID numbers and images of national ID cards, as entered by the workspace owner, with the person’s consent for an ID card image.

Workspace content: assets, ownership shares, rent contracts, invoices, revenue, expenses, settlements, legal disputes and their sessions, and the files and images attached to them.

Billing information: the brand, last four digits and expiry date of a saved card, an encrypted token from our payment provider that lets us charge it, and a record of each payment. We never receive or store your full card number.

Technical information: the device information and IP address recorded with each sign-in, a record of who opened which file, when and from which IP address, and the service logs we need to keep Assetly secure and working.

Consents: the date you accepted our terms of service and this notice (including storing your data in Germany and processing your financial data) and, for a workspace owner, the date they accepted the data processing agreement. When a workspace owner records a person’s consent to keep an image of their national ID, or a guardian’s consent for a minor, Assetly records who recorded it and when, with the guardian’s name.

Your requests about your data: what you asked for, when it was received and answered, and its outcome.

Contact form messages: if you write to us through the website, your name, email address, company (if given) and message.

Financial data (revenue, expenses, invoices, earnings and ownership splits) and the data of children are sensitive data under the law. We process your financial data only with your explicit consent, given when you create your account. A workspace owner may enter a minor’s data only with the written consent of their parent or guardian, which Assetly records.

Account, subscription and payment data: to perform our contract with you (the terms of service).

Storing data in Germany and processing financial data: your explicit consent.

Technical logs, file access records and security: our legal obligation to keep personal data secure, and to detect and report breaches.

Data a workspace owner enters about other people: the workspace owner’s own lawful basis, which they are responsible for; we act on their instructions.

We use information to provide Assetly: to run your workspace, to show each person only what their role allows, to process subscription payments, and to provide support.

We send service messages by email and in the app, such as email verification, password resets, invitations, overdue invoices, upcoming court sessions and subscription updates.

We also use information to keep the service secure, to prevent misuse and fraud, and to meet our legal obligations.

The workspace owner can see everything in their workspace. Co-owners see the assets they hold a share in, those assets’ invoices and legal disputes, their own share, revenue and expense records, and the settlements made with them. Accountants see the assets assigned to them, with those assets’ ownership shares, invoices, revenue and expense records, and the workspace’s customers. Lawyers see the legal disputes assigned to them and the assets those disputes concern, with those assets’ ownership shares, invoices, revenue and expense records, and the workspace’s customers. Customers see the assets they rent or bought and the invoices issued to them.

Each workspace is kept separate from every other workspace at the database level.

Amazon Web Services: hosting, the database, file storage, email delivery and scheduled tasks, in Frankfurt, Germany.

Vercel: delivers the website’s pages; workspace data passes through it while a page is shown and is not stored there.

Our payment provider: processes card payments and holds the card itself; we keep only a token.

Namecheap (Private Email): hosts our support and data protection officer mailboxes, which receive the messages you send us, including through the website’s contact form. It holds no workspace data.

Each of them processes data only on our instructions and under an obligation to protect it. We will tell workspace owners before we add a new one.

Your data is stored and processed in Germany (Amazon Web Services, Frankfurt), outside Egypt. We transfer it there under the cross-border transfer license of Egypt’s Personal Data Protection Center and with your consent, given when you create your account. We will not move it to another country without updating that license and telling you first.

Workspace data is kept while your workspace exists, including after a subscription ends, so that you can restore access by subscribing again.

When you delete your account, a workspace owner’s workspace and everything in it are deleted 30 days later. A member’s login and personal details are erased at once; the records of the workspace that name them stay with the workspace owner.

Some records are deleted automatically after a set time: ended sign-in sessions after 30 days, notification and email records after 30 days, records of who opened which file after 12 months, payment records after 2 years, our payment provider’s payment notifications after 3 months, Earnings records 3 years after they were settled, and settlements 3 years after they were made. A file you remove is deleted within a day, and its backup copy within 30 more days.

We keep the record of your consents and of your requests about your data for as long as we need to show that we respected them. We may keep some other information for longer, without anything that identifies you, where the law requires it.

Assetly uses a secure, HTTP-only cookie to keep you signed in, and a cookie to remember your language. Your light or dark theme choice is saved in your browser. We do not use advertising or analytics cookies.

We protect information with encrypted connections, hashed passwords, an encrypted payment token, private file storage that is reached only through short-lived links, role-based access, separation between workspaces, a record of who opens which file, and continuous threat detection on our cloud account.

No system is completely secure.

If a breach affects personal data, we report it to the Personal Data Protection Center within 72 hours of becoming aware of it, and tell the people affected within 3 working days of that report, with what happened and what we did about it.

Under Egypt’s Personal Data Protection Law you have the right to know what data we hold about you and to access it; to receive it in a machine-readable form; to correct it; to have it deleted; to withdraw your consent; to object to its processing; to restrict its processing; to be told of any breach that affects it; and to complain.

In your privacy settings you can download all your data, withdraw your consents and delete your account yourself. You can correct your details in your profile. Send any other request to our data protection officer at privacy@assetly-app.com; we answer within 6 working days, and may first need to confirm your identity.

If a workspace recorded your information, you may also contact that workspace’s owner, who is responsible for it; we will help them answer.

You can complain to the Personal Data Protection Center if you believe we have not respected your rights.

Only adults with the legal capacity to enter into a contract can open an account. A workspace owner may record a minor, such as a co-owner, only with the written consent of the minor’s parent or guardian, whose name Assetly records with the consent.

We process personal data under the license of Egypt’s Personal Data Protection Center. The license numbers will be shown here once they are issued.

We may update this notice. When a change is significant, we tell you in your dashboard, with a link to this page, which shows what changed (the previous and the new wording) and the date it applies from. If you keep using Assetly after it applies, you accept the updated notice.

If a change needs your new consent under the law, for example using your data for a new purpose or storing it in another country, we will ask for it before it applies. You can withdraw your consent at any time by deleting your account in your privacy settings.

Changed on 28 October 2026, applying from that date, to match how Assetly works: “Consents” now describes what we actually record (the previous wording was “the date, version, IP address and browser of every consent you give or withdraw”); “Who can see what in a workspace” now lists everything each role sees (the previous wording gave co-owners, accountants and lawyers less than they see); settlements were added to the automatic deletions (3 years after they were made); and Namecheap, which hosts our mailboxes, was added to the providers that process data for us. It also now says that the record of who opened which file includes the IP address (the previous wording was “a record of who opened which file and when”), lists your requests about your data among the information we hold, and calls that record “a record of who opens which file” among our security measures (previously “a record of every file opened”).

This notice is published in Arabic and English. If the two versions differ, the Arabic version prevails.

Our data protection officer: privacy@assetly-app.com. Other questions: support@assetly-app.com.