Use this article to understand how Assembled handles your data and your customers’ data, and what you can do to control it, whether you’re doing a security review or making your own data request. It summarizes the main points of our privacy policy, which has the complete details.
What data Assembled collects
We collect data about the people who use Assembled and anyone who visits our website. For example, we may collect:
- Information about your device, such as your IP address, browser or device type, operating system, or location.
- How you use our products, such as the pages you view, the features you turn on, and usage data that helps us improve your experience.
- Cookies, which keep you signed in, make features work, and help us understand how you use our services.
- Data from third parties, such as the tools you connect to Assembled.
For the full list of the data we can access, see our privacy policy.
How your data is protected
- All data is encrypted in transit with TLS 1.2 or above.
- Data at rest is encrypted with AES-256.
- Assembled is SOC 2 Type II audited by an independent auditor. The audit checks for security, availability, processing integrity, and confidentiality.
- We comply with GDPR, the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and HIPAA.
- We follow industry-standard security protocols and practices.
Note: When you use Assembled through your company’s account, your company controls that data, and we process it only according to your company’s instructions. For how your employer handles your data in Assembled, check your company’s privacy policies.
For our certifications and security documentation, see Security and compliance.
How Assembled uses and shares data
We don’t sell your information, and we don’t share, rent, or disclose customer data to third parties for marketing.
We don’t use your data to train AI models for other customers, or to serve other customers. Each customer’s data is kept separate.
We do share information in these cases:
- With service providers: the minimum needed to deliver our services, such as hosting, analytics, and customer support systems.
- With your company: if your employer set up your account, they control access to that information.
- For legal obligations: to comply with law enforcement requests, protect customer safety, or prevent fraud.
- During business transactions: if we’re part of a merger, acquisition, or bankruptcy proceeding.
- With your consent: when you or your company’s admin authorizes an integration with a third party.
Redact sensitive customer information
You can turn on PII redaction for AI agents and Copilot. Assembled then uses Amazon Comprehend, an AWS service, to detect personally identifiable information (PII) and remove it before it reaches our AI model providers, such as OpenAI and Anthropic. To turn it on, contact our team. For how it works, see AI data security.
Keep in mind: PII redaction makes AI agents and Copilot less able to help. Because context such as customer names and order IDs is removed, they can only answer general questions and can’t personalize replies.
Request data deletion
We keep personal data only as long as we need it to provide our services and meet our legal obligations. To delete your data after your Assembled subscription ends, email privacy@assembled.com.
When you request deletion, we remove all your customer data from our systems and send you a confirmation when it’s done. We process deletion requests within one month.
To have stored AI conversations redacted or deleted automatically while you use Assembled, see Clean up stored conversations.
Contact us about a privacy concern
For questions about privacy, or to exercise your privacy rights, email privacy@assembled.com. You can also send mail to Assembled Privacy Requests, 2525 16th Street, Suite 310, San Francisco, CA 94103, United States.
If you live in the EU, the UK, or Switzerland and we can’t resolve your privacy complaint directly, you can file a complaint at no charge with BBB Data Privacy Framework Services.