What we hold, why we hold it, and for how long.

AUTONOMIQ LLC, 1795 Alysheba Way, Ste 7202, Lexington, KY 40509, is the controller for website enquiry data. For asset and custody records processed inside a customer estate, the customer is the controller and AUTONOMIQ acts as processor under the data processing addendum attached to the master services agreement.

• Enquiry data — name, work email, optional phone, company, company size and the free-text description you submit in the demo or audit form.
• Platform data — user account identifiers, role assignments, and the actor recorded against each custody event.
• Asset data — serial numbers, models, encryption state and disposition outcomes. Asset data is not personal data unless a customer chooses to record an assigned employee.
• Technical data — request logs and error traces retained for security and debugging.

Enquiry data is processed on the basis of legitimate interest in responding to a business request, and is used only to contact you about decommissioning services. Platform and asset data are processed to perform the contract: producing custody records, certificates of erasure and disposition reporting. We do not sell personal data and we do not use enquiry data for advertising profiles.

Enquiry data is retained for 24 months from the last contact, then deleted. Custody and certificate records are retained for the period configured by the customer, defaulting to seven years to match common audit windows. Technical logs are retained for 90 days.

We use infrastructure and communication subprocessors for hosting, database storage, transactional email and error monitoring. The current subprocessor list, including processing location, is issued on request and to all customers 30 days before any addition takes effect.

Depending on your jurisdiction you may request access, correction, deletion, restriction, portability, or object to processing. Requests are answered within 30 days. Write to privacy@autonomiq.app and state the email address you used, so we can locate the record without asking for further identity data.

Customers may pin storage to a specific region. Where data moves outside its region of collection, transfers rely on Standard Contractual Clauses and the safeguards described in the data processing addendum.

Material changes are published here with a revised update date and, for active customers, notified by email at least 14 days before taking effect.