Assembled Privacy Policy | Data & Security Practices

Privacy policy

Last updated: May 1, 2026

Assembled Inc. (“ Assembled”, “ we”, or “ us”) provides this Privacy Policy to inform you of our policies and procedures regarding the collection, use and disclosure of information in connection with our website, www.assembled.com (the “ Site”), and our products, services, applications, and other functionality offered on or through the online services (collectively, the “ Services”), and when you attend an Assembled event or otherwise interact with us. This Privacy Policy also applies to individuals registered on our Services (“ Users”), including Users who are provisioned an account by our enterprise customers (“ Customers”). Please read this Policy carefully to understand how we may collect, use, and disclose your information, and what choices you may have with respect to your information. This Privacy Policy does not address our privacy practices relating to Assembled employees and other personnel. This Privacy Policy is not a contract and does not create any legal rights or obligations.

When our Customers use our Services to submit, manage, or otherwise use content relating to our Customers’ data (“ Customer Data”), we have contractually committed ourselves to only process such information on behalf of and under the instruction of the respective Customer, who is the “data controller”. This Privacy Policy does not apply to such processing and we recommend you read the privacy notice of the respective customer if their processing concerns your Personal Data.

What is Personal Data?

When we use the term “Personal Data” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or de-identified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

Information we collect from you and why

Sometimes we collect Personal Data automatically when you interact with our Services and sometimes we collect Personal Data directly from you. At times, we may collect Personal Data about you from other sources and third parties (e.g., GSuite, Zendesk, etc.), even before our first direct interaction.

Personal Data Collected from Site Visitors and Account Holders We collect the following Personal Data submitted to us by visitors to our Site and account holders:

Personal Data Automatically Collected

As is true of most digital platforms, we and our third-party providers may also use (i) cookies or small data files that are stored on your computer or device and (ii) other, similar technologies, such as web beacons, pixels, embedded scripts, location-identifying technologies and logging technologies (collectively, “cookies”) to automatically collect information, which may contain Personal Data, from your devices while you navigate our Services or interact with emails we sent to you.

For more information on how to manage cookies and related data collection technologies, please see the “ Your Choices” section below.

Personal Data from Third Parties

We also obtain Personal Data from third parties; which we often combine with Personal Data we collect either automatically or directly from you. We may receive the same categories of Personal Data as described above from the following third parties:

Third Party Data Collection and Online Advertising

We participate in interest-based advertising and use third party advertising companies to serve you targeted advertisements based on your browsing history. We permit third party online advertising networks, social media companies and other third-party services, to collect information about your use of our online services over time so that they may play or display ads on our Services, on other websites or services you may use, and on other devices you may use. Typically, though not always, the information used for interest-based advertising is collected through tracking technologies, such as cookies, web beacons, embedded scripts, location-identifying technologies, and similar technology, which recognize the device you are using and collect information, including click stream information, browser type, time and date you visited the site, AdID, precise geolocation and other information. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help identify you across devices. We and our third-party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics and market research. We may also use services provided by third parties (such as social media platforms) to serve targeted ads to you and others on such platforms. We may do this by providing a hashed version of your email address or other information to the platform provider. Please see “ Your Choices About Online Ads” below, to learn more about interest-based advertising.

We may also utilize certain forms of display advertising and other advanced features through Google Analytics, such as Remarketing with Google Analytics, Google Display Network Impression Reporting, and Google Analytics Demographics and Interest Reporting. These features enable us to use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick advertising cookie) or other third-party cookies together to inform, optimize, and display ads based on your past visits to the Services. You may control your advertising preferences or opt-out of certain Google advertising products by visiting the Google Ads Preferences Manager, currently available at https://google.com/ads/preferences, or by visiting NAI’s online resources at http://www.networkadvertising.org/choices.

Data Retention

Assembled retains personal data as long as required to provide the services you have contracted for and to comply with applicable laws.

Your Choices

If personal data covered by this Privacy Policy is to be used for a new purpose that is materially different from that for which the personal data was originally collected or subsequently authorized, or is to be disclosed to a non-agent third party in a manner not specified in this Privacy Policy, Assembled will provide you with an opportunity to choose whether to have your personal data so used or disclosed. Requests to opt out of such uses or disclosures of Personal Data should be sent to us as specified in the “Contacting Us” section below.

Certain personal data, such as information about medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, is considered “Sensitive Information”. Assembled will not use this information for a purpose other than the purpose for which it was originally collected or subsequently authorized by you unless Assembled has received your affirmative and explicit consent (opt-in).

You also have choices with respect to technologies we use to automatically collect information as described below:

Depending on your device and operating system, you may not be able to delete or block all cookies. In addition, if you want to reject cookies across all your browsers and devices, you will need to do so on each browser on each device you actively use. You may also set your email options to prevent the automatic downloading of images that may contain technologies that would allow us to know whether you have accessed our email and performed certain functions with it. To learn how to manage privacy and storage settings for Flash Cookies, please visit the Macromedia site. HTML5 LSOs can be managed using browser tools and settings.

If you want to opt out of receiving online interest-based advertisements on mobile apps, please follow the instructions at http://www.aboutads.info/appchoices.Please note that when you opt out of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us or on our online services. It means that the online ads that you do see from DAA program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third-parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties may still use cookies to collect information about your use of our online services, including for analytics and fraud prevention as well as any other purpose permitted under the DAA’s Principles.

How We Use Information

We collect and use the Personal Data described above in order to:

Where an individual chooses to contact us, we may need additional information to fulfill the request or respond to inquiries. We may provide additional privacy disclosures where the scope of the inquiry/request and/or Personal Data we require fall outside the scope of this Privacy Policy. In that case, the additional privacy disclosures will govern how we may process the information provided at that time. We may aggregate or de-identify information submitted to or collected by use of the Services so that the information does not identify you. This Privacy Policy does not restrict our use or disclosure of aggregated or de-identified information that complies with applicable law.

Information Sharing and Disclosure

We disclose Personal Data in the following ways:

Upon request, you are able to access your personal information that Assembled holds and are able to correct, amend, or delete that information where it is inaccurate, or has been processed in violation of the Principles, except where the burden or expense of providing access would be disproportionate to the risks to the your privacy in the case in question, or where the rights of persons other than you would be violated.

If you are a resident of the State of Nevada, Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect about the resident. Please contact us at privacy@assembled.com to submit such a request.

Mobile Messaging (SMS) Privacy

Assembled Inc. (“we,” “us,” or “our”) offers users the option to receive communications via SMS (Short Message Service) or text messaging programs. Participation in these SMS programs is strictly voluntary and subject to the terms described in this Privacy Policy and applicable Terms of Service.

When you enroll in an Assembled SMS program, we collect and process your mobile phone number and related opt-in data solely for the purpose of delivering text messages you have explicitly consented to receive. These messages may include customer support updates, service alerts, appointment reminders, account notices, and, where permitted by you, occasional promotional offers.

We are committed to protecting the privacy of our users. As such:

For questions regarding our SMS privacy practices, or to exercise your rights under this Privacy Policy, please contact us at:

Email: support@assembledhq.com

Address: 2525 16th Street, Suite 310, San Francisco, CA 94103

For EU, UK, and Swiss Individuals: Notice for Personal Data Transfers to the United States

Assembled complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework for the collection, use, and disclosure of certain personally identifiable information that we receive in the U.S. from the European Union (" EU Personal Data"), the United Kingdom (" UK Personal Data"), and Switzerland (“ Swiss Personal Data” and combined with EU, UK, and Swiss Personal Data, “ Personal Data”).

Assembled has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“ EU-U.S. DPF”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Assembled has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of any personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Assembled recognizes that the EU, UK, and Switzerland have established strict protections regarding the handling of Personal Data, including requirements to provide adequate protection for Personal Data transferred outside of the EU, UK and/or Switzerland. To provide adequate protection for all Personal Data regarding consumers, clients, suppliers, business partners, job applicants and employees received in the U.S., Assembled has elected to self-certify to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) administered by the U.S. Department of Commerce. Assembled adheres to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability.

Assembled is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

Further, Assembled is required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Assembled commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States. EU, UK, and Swiss individuals with inquiries or complaints should first contact Assembled by email at privacy@assembled.com or via post at:

2525 16th Street

Suite 310

San Francisco, CA 94103

Dispute Resolution

If a privacy complaint or dispute relating to Personal Data received by Assembled Inc. in reliance on the Data Privacy Framework (or any of its predecessors) cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here: https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/

If a complaint or dispute cannot be resolved through our internal process, we have also agreed to cooperate with the EU and UK data protection authorities, and the Swiss Federal Data Protection and Information Commissioner.

Binding Arbitration

If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “ Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.

Links to Third Party Websites or Services

Our Services may contain links to, or interoperate with, third-party services. When you click on a link to any other website or location, such as if you or one of our Customers provides a third-party service with access to information in your account, that third-party may then collect or access information from you or the associated Customer. The use of such information, including Personal Data, by the third-party service will be governed by the third-party service’s privacy policy. We have no control over, do not review, and cannot be responsible for, these third-party services. We encourage you to read the privacy policies of every website you visit and every third-party service you use.

Our Policy on Children

The Services are not directed to, and we do not intend to, or knowingly, collect or solicit Personal Data from individuals under the age of 13. If an individual is under the age of 13, they should not use our Services or otherwise provide us with any Personal Data either directly or by other means. If a child under the age of 13 has provided Personal Data to us, we encourage the child’s parent or guardian to contact us to request that we remove the Personal Data from our systems. If Assembled becomes aware that a child under the age of 13 has submitted information to us, we will promptly delete the information. If you believe that we may have any information from a child under the age of 13, please contact us at privacy@assembled.com.

Modification of this Privacy Policy

Assembled may modify this Privacy Policy from time to time. The “Last Updated” legend at the top of this page indicates when this Privacy Policy was last revised. If we make material changes to this Privacy Policy, we will notify individuals by email by prominent posting on our Services or through other appropriate communication channels. Any changes to this Privacy Policy will become effective when we post the revised Privacy Policy on the website.

Contacting Us

If you have questions about this Privacy Policy, please contact us privacy@assembled.com or at our mailing address below.

2525 16th Street

Suite 310

San Francisco, CA 94103