Privacy Policy

• Account data: name, work email, hashed password, organization details, role, and MFA settings.
• Billing data: plan, seats, and subscription status. Card details are handled by Stripe — we never see or store full card numbers.
• Usage and device data: pages viewed, actions taken, IP address, browser/OS, timestamps, and diagnostic/error logs.
• Communications: messages you send to support or sales.
• Customer Data: tickets, documentation, asset and agent telemetry you submit — processed on your behalf and governed by the DPA, not this policy.
• Cookies: a session cookie for authentication and minimal preferences (e.g., theme). See §9.

• Provide, secure, maintain, and improve the Service.
• Authenticate users and prevent fraud, abuse, and security incidents.
• Process payments and manage subscriptions.
• Communicate about your account, security, and service changes (and, with consent where required, product news).
• Comply with legal obligations and enforce our Terms.

Where the GDPR applies, we rely on:

• Contract — to provide the Service you've signed up for.
• Legitimate interests — to secure, operate, and improve the Service (balanced against your rights).
• Consent — for optional communications and non-essential cookies, where applicable.
• Legal obligation — to meet accounting, tax, and other legal requirements.

We do not sell personal data. We share it only with service providers (subprocessors) who help us run the Service under contract, and where required by law or to protect rights and safety. Current subprocessors include hosting/database, email delivery (Resend), payments (Stripe), and — when you enable them — error monitoring and AI providers. The current subprocessor list is in Annex III of our DPA and is updated when it changes.

We may process data in countries other than yours. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and equivalent UK mechanisms.

We keep account data for as long as your workspace is active and as needed to provide the Service. After cancellation, Customer Data is available for export for 30 days and then deleted from active systems, with backups expiring on a rolling schedule. We retain limited records (e.g., invoices) where required by law.

We use industry-standard safeguards including encryption in transit (TLS), encryption of sensitive secrets at rest (AES-256-GCM for the password vault), role-based access control, audit logging, and least-privilege access. No system is perfectly secure; we work to reduce risk and respond promptly to incidents.

Subject to applicable law (including GDPR and CCPA/CPRA), you may request access, correction, deletion, portability, restriction, or objection, and may withdraw consent. We do not sell or “share” personal information for cross-context behavioral advertising. To exercise rights, contact privacy@psadesk.com; we may need to verify your identity. You may also lodge a complaint with your supervisory authority.

We use a strictly-necessary session cookie for authentication and minimal local storage for preferences (such as theme and sidebar state). We do not use third-party advertising cookies. Where required, non-essential cookies are used only with consent.

The Service is not directed to children under 16 and we do not knowingly collect their data.

We may update this policy; material changes will be announced in-app or by email. The “last updated” date above reflects the current version.

Privacy questions or requests: privacy@psadesk.com. (Insert your legal entity name, postal address, and EU/UK representative or DPO where required.)