Privacy Policy

Last updated 11 August 2026

This policy covers the hosted Assay services at assay.rs, auth.assay.rs and engine.assay.rs. Assay is also open source software you can run yourself; when you self-host it, you are the controller of the data it stores and this policy does not apply.

Who we are

The hosted service is operated by NSM Technologies Limited, registered in England and Wales under company number 16748005, with its registered office at 7 Sanderling Close, Bicester, England, OX26 6WF. We are the data controller for the personal information described here. Contact us at info@nsmtechnologies.co.uk.

What we store

auth.assay.rs is an identity provider. It exists to confirm who you are to the applications you sign in to. To do that it stores:

• your account record — an internal identifier, your email address, whether that address is verified, and your display name
• a password hash, if you set a password. Passwords are never stored in a recoverable form.
• passkey public keys, if you register a passkey. A passkey's private key never leaves your device.
• a link between your account and any upstream provider you signed in with, stored as that provider's subject identifier
• session records, authorisation codes, refresh tokens and your consent decisions for each application you have signed in to

Data we receive from Google Sign-In

If you choose to sign in with Google, we ask Google only for the openid, email and profile scopes. From those we receive your Google account identifier, your email address, whether Google has verified it, and your name.

We use that data for one purpose: to create or recognise your Assay account and to tell the application you are signing in to who you are. We do not use Google user data for advertising, we do not sell or transfer it, we do not use it to train machine learning models, and no human reads it except where you ask us to help with a support issue or the law requires it.

Applications that use Assay to sign you in never receive your Google credentials. They receive an identity token issued by Assay.

Why we may lawfully do this

We process account data to perform the contract by which we provide the service to you. We process security and operational logs on the basis of our legitimate interests in keeping the service available and defending it against abuse.

Logs

Our servers and network provider record technical information needed to operate the service securely, such as IP addresses, timestamps and requested endpoints. These are retained for a short operational period and then discarded.

Who we share it with

We share personal information only with providers that process it on our behalf under contract: our application hosting provider, our managed database provider, our network and content delivery provider, and our transactional email provider, which sends password recovery messages. We do not sell personal information.

We may disclose information where the law requires it, or to establish, exercise or defend legal claims.

International transfers

Our providers operate globally, so your information may be processed outside the United Kingdom. Where that happens we rely on the safeguards UK data protection law recognises, such as adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

How long we keep it

We keep your account record while your account exists. Sessions and authorisation codes expire on their own within minutes to weeks depending on their kind. If you delete your account we remove your account record and everything keyed to it, including upstream links, passkeys, sessions and consents, within 30 days, except where we must retain something to meet a legal obligation.

Your rights

Under UK data protection law you may ask for a copy of the personal information we hold about you, ask us to correct or delete it, ask us to restrict or object to our use of it, and ask us to transfer it to another organisation in a portable format. To exercise any of these, email info@nsmtechnologies.co.uk. We respond within one month and there is no charge.

You can revoke Assay's access to your Google account at any time from your Google account permissions page. Doing so stops future sign-ins through Google but does not by itself delete your Assay account.

Complaints

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Changes

We will update this page when our practices change and revise the date above. Where a change materially affects data we already hold about you, we will contact you.

Contact

NSM Technologies Limited
7 Sanderling Close, Bicester, England, OX26 6WF, United Kingdom
Registered in England and Wales, company number 16748005
info@nsmtechnologies.co.uk