Privacy notice for Corsift Desk and Watch

Effective 27 October 2026.

Who we are

Corsift is a trading name of ASG INFOTECH LIMITED, registered in England and Wales (number 13873222), Sterling House, Maple Court, Maple Road, Tankersley, S75 3DP, United Kingdom. We're the controller of the details this notice covers. Contact us at hello@corsift.com.

What we collect

• When you sign up at start.corsift.com: your email address and, where available, your name (from your Microsoft or Google account if you sign in with one); your company's name; the product you chose; roughly how many devices you have; and which page of our website you came from. If you start signing up but don't finish, your sign-in details are still created.
• Your account: your sign-in identity, the organisations you belong to, your role, and your organisation's plan, trial dates and the record of what it signed up for and when, including the version of our Terms that was accepted.
• When you use Desk or Watch: sign-in events, and short-lived technical logs such as IP addresses and browser details that our servers record. Each workspace also keeps an audit log of what people do in it (for example who changed a setting or connected to a computer, and in Watch the IP address and browser used); that log belongs to the workspace's organisation, which decides how it's used.
• If you use the Watch mobile app, once it's available: your phone's notification token and your notification preferences.
• Billing: your organisation's billing contact, invoices, payments and VAT details.
• When you contact us: your emails and what we say back.

Why we use it, and our legal basis

• To provide Desk and Watch: set up your workspace, sign you in, send you the emails the service needs (such as welcome emails, invitations and alerts) and support you. This is necessary for our contract with your organisation, and in our legitimate interests in running the service for the people who use it.
• To keep Corsift secure and prevent misuse, including misuse of the Corsift agent. This is in our legitimate interests and those of the people whose computers Corsift manages.
• To bill and keep accounts, as the law requires.
• To improve Corsift, using counts and timings that don't identify anyone. This is in our legitimate interests.

We only email you about your account and the service. We don't send marketing unless you've asked for it, and we don't sell your details.

Who we share it with

We share details only with the providers who help us run Corsift, under contracts that require them to protect them:

• Clerk (United States), for sign-in and organisation accounts;
• Railway (servers in the Netherlands), which hosts Desk, Watch and start.corsift.com;
• Resend (United States), which sends our emails;
• Microsoft or Google, if you choose to sign in with them;
• Cloudflare, which Clerk may use during sign-up to check you're not an automated program (Cloudflare Turnstile). It processes technical signals such as your IP address and browser details: see Cloudflare's Turnstile privacy notice;
• Google, which supplies the typeface on start.corsift.com and so sees your IP address when the page loads, and, only if you allow analytics, Google Analytics (see below);
• our accountants and professional advisers, and authorities when the law requires it.

Where details go outside the UK, we make sure UK data protection law allows it: through UK adequacy regulations, including the UK–US data bridge, or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.

How long we keep it

• Account and sign-up details, including the record of which Terms were accepted, for as long as your organisation uses Corsift, and then until its workspace is deleted, which is within 90 days after the service ends.
• Sign-in details for a sign-up that was never finished, within 90 days. A sign-in you use for more than one Corsift account is kept while any of them needs it.
• Workspace audit logs, for as long as the workspace exists; Watch keeps its audit events for 365 days.
• Billing and accounting records, for 6 years after the end of the financial year they relate to, as UK tax law requires.
• Technical logs, for a short time, normally no more than 30 days, unless we need them to investigate a security issue or misuse.
• Support emails, for as long as they're useful for helping your organisation, and no more than 2 years after your organisation stops using Corsift.

Cookies, browser storage and analytics

• Desk and Watch use cookies and browser storage only to make the service work: to sign you in and keep you signed in (set by us and by Clerk); to keep the connection of a mailbox or Microsoft service secure while you set it up (a few minutes); and to remember your workspace and screen preferences. They don't use advertising or analytics cookies.
• start.corsift.com keeps your choices in your browser while you sign up, so they survive signing in with Microsoft or Google. It turns on optional analytics (Google Analytics, through Google Tag Manager) only if you allow them, and never sends form contents or personal details to analytics. Event data is kept for two months, and pseudonymous user data for up to fourteen months. You can change your mind at any time with Privacy choices on the page.

Your rights

You can ask for a copy of your details, or ask us to correct them, delete them, restrict how we use them, or send them to you or someone else in a usable form. You can also object to how we use them where we rely on legitimate interests. Email hello@corsift.com; we'll answer within one month. If you're unhappy with how we've handled your details, you can complain to the Information Commissioner's Office, though we'd like the chance to put it right first.

Changes

If we change this notice in a way that matters, we'll tell you by email. The date at the top shows the current version.