Who is responsible
AssayMark is operated by Darklayer Tech Ltd. Contact us about privacy or your information at info@assaymark.co.uk.
We are responsible for account, enquiry and operational information we use to run AssayMark. When an organisation supplies logs or other personal data for an assessment, that organisation determines its purpose and should have authority to provide it. We process that assessment material to provide the requested service. Organisations should agree any required data-processing arrangements before sharing personal data.
Information we handle
- Account and contact information: email address, account identifiers, company details you provide, password hashes for password accounts, verification/reset records and correspondence.
- Assessment material: uploaded logs or files, website targets and responses, business context, derived findings, reports, remediation records and re-test results. Depending on your input, logs can include IP addresses, user identifiers, timestamps and activity.
- Operational information: request and security logs, session information, error details and records of administrative actions.
- Enquiries and pilot participation: information you submit when requesting a review, feedback and follow-up communications.
Only submit information necessary for the assessment. Remove passwords, access tokens and unrelated personal information. The browser-based secure configuration workflow extracts selected settings locally; this does not mean that ordinary log uploads stay on your device.
Why we use information
We use information to provide accounts and assessments, explain findings, track remediation, respond to requests, maintain recovery copies and protect the service against misuse.
For account and service administration, our basis is performing our agreement with you or taking requested steps before it. For business contacts, security, troubleshooting and proportionate operational records, we rely on our legitimate interests in delivering and protecting the service. We use consent for optional analytics and comply with applicable legal obligations where they require processing. Where we act for your organisation, we follow its agreed instructions.
Providing account and relevant assessment information is necessary to deliver those features; you can browse public pages without submitting an assessment. Automated findings support human security decisions. They are not intended to make decisions with legal or similarly significant effects about individuals.
Google sign-in and the backup connector
Google sign-in: if you choose it, we receive basic identity information authorised by Google, such as your account identifier, email address and profile information, to authenticate and maintain your AssayMark account. Signing in does not give us access to your Gmail or Drive files.
AssayMark Ledger Backup: this separate, operator-only connector stores encrypted copies of deletion records. It requests the limited drive.file permission to create and retrieve its own backup files. It does not request access to the whole Drive, Gmail, contacts or a customer's Drive account. Automatic syncing was enabled on 7 October 2026. It runs after ledger changes, with periodic retries; a new deletion is protected offsite only after a successful backup verification.
The ledger contains account identifiers and hashed identity references used to prevent erased accounts returning during recovery. Its contents are encrypted before upload. The connector keeps its authorisation credentials in protected operator configuration so it can refresh access and perform authorised backup operations. These credentials are not included in the backup files or reports.
We use Google user data only for the sign-in and backup functions described here. We do not sell it, use it for advertising, or use it to train general-purpose AI models. Human access is limited to authorised operational/support needs, with permission where required, security investigations or legal obligations. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
You can revoke a connection through Google Account connections. Revoking the operator backup connector stops future access; it does not remove already stored encrypted copies or delete an AssayMark account. Contact us for account deletion or questions about retained information.
Retention, deletion and recovery copies
Assessments: scheduled maintenance removes assessment records older than 90 days and related evidence under the configured retention rules. Some remediation records are aged by their last activity rather than their creation date. Account details, organisational context and necessary operational records are not all covered by that assessment timer; we retain them while needed to operate the account, address requests and meet applicable obligations.
Account deletion: email us to request deletion. We verify the request and process it through a controlled administrative procedure. Shared organisation ownership may need to be transferred first. Limited deletion records are retained to prevent erased identities being restored from an older backup; they are not the original logs or full account contents.
Backups: application-managed encrypted maintenance backups have a 30-day expiry policy. Expiry depends on maintenance completing successfully. Provider snapshots and manually held recovery copies have separate lifecycles; we cannot promise that every copy is erased within 30 days or immediately after an account request. Hostinger snapshot permanent-deletion timing and isolated restore have not been verified. Deletion-ledger copies are retained for recovery protection, rather than removed with assessment backups.
We use access restrictions and encryption for managed recovery archives. These measures reduce risk but do not guarantee complete security or recovery in every scenario.
Your choices and rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal information. You may withdraw consent for optional processing.
You have the right to object to processing based on legitimate interests. Email info@assaymark.co.uk to make a request. We may ask for information needed to verify your identity. If your employer or another organisation supplied the data, we may refer the request to that organisation or assist it in responding.
You can also complain to the UK Information Commissioner's Office. We welcome the opportunity to address a concern directly first.
Changes to this notice
We update this notice when our practices change and show the update date above. Material changes affecting existing users will be brought to their attention through an appropriate service notice or direct communication.