Privacy Policy

Version: 2026-10-07 · Last updated: 7 October 2026

This policy explains how Retainr OS handles personal data: what we collect, why, who we share it with, how long we keep it, and the rights you have. It applies to the Retainr OS website at getretainr-os.com, the application at app.getretainr-os.com, and the client portal, contractor hub and shared links that studios send from it (together, the "Service").

1. Who we are

Retainr OS is a product of ASLM Digital Solutions LLC, a limited liability company registered in Wyoming, USA, of 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA ("we", "us", "our").

Contact for anything in this policy: support@getretainr-os.com. Put "Privacy" in the subject line and it reaches the person responsible for data protection.

UK and EU representatives. Because we are established outside the UK and the EU and offer the Service to people there, UK GDPR Article 27 and EU GDPR Article 27 require us to appoint a representative in the UK and in the EU. We are appointing representatives in both, and their contact details will be published in this section. Until then, contact us directly at the address above.

2. Two roles: controller and processor

Retainr OS is software that agencies and studios ("Studios") use to run their business. That means we handle personal data in two different capacities, and the rules differ for each.

We are the controller for data about the people who hold Retainr OS accounts and visit our website. That covers Studio owners and team members: their account, sign-in, billing and support data, how they use the Service, and visitors to getretainr-os.com. Sections 3 to 12 describe this processing.

We are a processor for the data a Studio puts into the Service about its own clients, client contacts, contractors, prospects and projects (section 13). The Studio is the controller of that data. It decides what goes in and why, and we process it only on the Studio's instructions under our Data Processing Agreement. If you are a client or contractor of a Studio and want to exercise your rights, contact that Studio first. We will help them answer you.

3. Personal data we collect as controller

We do not run advertising or analytics trackers on the website or in the application. See the Cookie Policy.

4. Why we use it, and our lawful basis

5. AI features

Several features use artificial intelligence. They include drafting proposal copy and scopes, breaking milestones into tasks, pricing suggestions, contract risk review, meeting-note summaries, questionnaire analysis, weekly reports, morning briefings and the in-app assistant.

• Provider. AI requests go to Anthropic, PBC (USA), which provides the Claude models. The request carries the context the feature needs, for example the brief, the project, the proposal or questionnaire answers. For the assistant, that is the records you are allowed to see. It can include personal data about clients and contacts.
• Dictation. If a workspace switches on dictation and you opt in on your device, your voice recording goes to Deepgram, Inc. (USA) for transcription. The audio is held in memory only for the length of the request. We do not store it.
• No training on your data. Anthropic does not use inputs sent through its commercial API to train its models. We send dictation to Deepgram with its model-improvement programme switched off for every request.
• Controls. The assistant is off until a workspace owner turns it on for chosen roles, and it has a kill switch and an optional monthly token quota. Dictation is off by default. Other AI features run only when someone clicks them, within the plan's monthly AI allowance.
• No automated decisions. No AI output in the Service makes a decision with legal or similarly significant effect about anyone. AI output is a suggestion that a person reviews.

6. Who we share personal data with

We do not sell personal data, and we do not share it for advertising. We use the following sub-processors to provide the Service:

We may also disclose personal data:

• to professional advisers (lawyers, accountants) under a duty of confidentiality;
• where the law requires it, or to protect the rights, property or safety of our users or others;
• to a buyer or successor if our business or the Service is sold or reorganised. You would be told, and this policy would continue to protect your data.

We will tell customers at least 30 days before adding or replacing a sub-processor, as our Data Processing Agreement sets out. The up-to-date list is always the table above.

7. International transfers

We are a US company, and some sub-processors process data in the USA. When personal data from the UK or the EEA goes to a country without an adequacy decision, we rely on:

• the EU Standard Contractual Clauses (Commission Decision 2021/914) and, for UK data, the UK International Data Transfer Addendum issued by the ICO (or the UK IDTA); and/or
• the recipient's certification under the EU-US Data Privacy Framework and its UK Extension, where the recipient holds it.

Our Data Processing Agreement with customers incorporates the EU Standard Contractual Clauses and the UK Addendum, and we assess transfers where the law requires. Ask us at the contact address for a copy of the safeguards.

8. How long we keep it

Studios set their own retention rules for their clients' data in Settings → GDPR (section 13).

9. Security

The measures in place include:

• tenant isolation enforced in the database (row-level security), so one workspace cannot read another's data;
• encryption in transit (TLS, with HSTS) and at rest by our hosting providers;
• integration tokens encrypted with AES-256-GCM, and portal passcodes stored only as scrypt hashes;
• two-factor authentication (TOTP), which a workspace can require for all staff;
• a minimum password length of 12 characters, a check against known breached passwords, and lockout after repeated failed sign-ins;
• workspace-level controls for maximum session length, concurrent sessions and an optional IP allowlist;
• an append-only, hash-chained audit log;
• a strict Content Security Policy and other protective browser headers;
• rate limiting on sign-in and other sensitive actions.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the law requires. If you are a Studio, we will notify you without undue delay so you can meet your own obligations. To report a vulnerability, email security@getretainr-os.com.

10. Your rights

If you are in the UK or the EEA, you have the right to:

• access the personal data we hold about you;
• rectify data that is inaccurate. Much of it you can change yourself in Account settings;
• erase your data, where there is no overriding reason for us to keep it;
• restrict or object to our processing, including processing based on legitimate interests;
• data portability. Workspace owners can export the workspace's data as JSON or CSV from Settings at any time;
• withdraw consent at any time, where processing is based on consent. For optional cookies, use "Cookie settings" in the page footer;
• complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EU it is the authority where you live or work.

To exercise a right, email the contact address in section 1. We will answer within one month. We may ask you to confirm your identity first.

11. Children

The Service is for businesses and is not directed at children. You must be 18 or over to create an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. US state privacy laws

We process the personal data of business customers. We do not sell personal information or share it for cross-context behavioural advertising. Residents of US states with consumer privacy laws can make requests through the contact address in section 1.

13. Data we process for Studios (as processor)

Studios use Retainr OS to hold data about the people they work with:

• client contacts: name, email, phone, job title, company address, VAT number, notes the Studio writes;
• contractors: name, email, rates, tax status (IR35/CIS) and performance notes the Studio records. We do not hold contractors' bank details;
• prospects (if the Studio uses the outreach features): name, company, job title, email, LinkedIn URL, and research notes produced with AI;
• project data: proposals, contracts, deliverables, files, time entries, invoices, messages, surveys and onboarding questionnaires;
• signatures and acceptances: when someone signs a contract or accepts a proposal, we record their name, email, signature, IP address, browser user agent and a hash of the document. That record is the evidence of the signature. For proposals we record when a link was first and last opened and how many times. We do not record IP addresses for views. We do not track email opens or clicks.

The Studio, as controller, is responsible for having a lawful basis for this data and for telling these people how it is used. Studios can add links to their own privacy policy, cookie policy and terms. Those links appear in the footer of their client portal and shared pages.

Tools a Studio has for its data subjects:

• Subject access: export everything held about a person as a file (Settings → GDPR).
• Erasure: delete a prospect or client contact, or anonymise a client or contractor while keeping financial records the Studio must retain by law.
• Retention: set retention periods per data class. The enforceable ones (portal access after a project closes, portal feedback) run in a daily job.
• Export: export the whole workspace, or one client or project.

Our obligations as processor, including confidentiality, security, sub-processors, assistance with rights requests, breach notification, and deletion or return of data at the end of the contract, are set out in our Data Processing Agreement, which forms part of our Terms of Service. (Separately, Settings → Legal generates a template DPA a Studio can sign with its own clients.)

14. Changes to this policy

We will post any change here and update the "Last updated" date. If a change is material, we will tell account holders by email or in the application at least 30 days before it takes effect.

15. Contact

• ASLM Digital Solutions, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA
• Email: support@getretainr-os.com (subject "Privacy")
• Security reports: security@getretainr-os.com