Privacy Policy

1. Introduction

Deskwoot ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our customer support platform ("Service"). By using the Service, you consent to the data practices described in this policy.

2. Information We Collect

We collect the following types of information:

Account Information: When you register, we collect your name, email address, password, and organization details.

Customer Data: Data you or your customers submit through the Service, including messages, contact information, notes, and conversation history.

Usage Data: We automatically collect information about how you interact with the Service, including pages visited, features used, browser type, device information, IP address, and timestamps.

Integration Data: When you connect third party services (such as Shopify, Stripe, WhatsApp, Facebook Messenger, Instagram, or Slack), the Service processes the data those services provide, on your behalf and as authorized by you, such as customer names, usernames, profile pictures, messages, email addresses, phone numbers, order history, and payment information. We use this data only to provide the Service to you.

Statistics data (with your consent): We use Google Analytics and PostHog to understand how visitors and signed in users use the Service. This may include page views, clicks, session duration, traffic sources, device information and general geographic location. Details in section 10.

Campaign data: When you sign up, we store with your account the campaign details of the link that brought you to us (the parameters utm_source, utm_medium, utm_campaign, utm_term and utm_content), the website you came from, and the industry page or setup offer you came from (the parameters industry and setup). The campaign details and the industry are the same for everyone who clicks the same link and do not identify you. We use them for our own statistics on which campaigns lead to signups and paying customers, and the industry to prepare your setup. Without your marketing consent these values stay in the memory of the open page and are never written to your device. The industry and setup values are never written to your device at all. Legal basis: our legitimate interest under Art. 6 (1) lit. f GDPR in measuring our own campaigns.

Cookies and similar technologies: We use the cookies and storage the Service needs to work (your login, your choice in the cookie banner, your language and theme). Everything else falls into 2 categories you choose in the cookie banner: Statistics (Google Analytics, PostHog) and Marketing (Google Ads, Microsoft Advertising, OpenAI Ads). In the EU, the EEA, the UK and Switzerland none of them loads before you choose (see section 10).

3. How We Use Your Information

We use your information to: (a) provide, maintain, and improve the Service; (b) process transactions and send related information; (c) send you technical notices, updates, and support messages; (d) respond to your comments, questions, and requests; (e) monitor and analyze usage trends to improve user experience; (f) detect, investigate, and prevent fraudulent or unauthorized activities; (g) comply with legal obligations.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with: (a) service providers who assist us in operating the Service (hosting, email delivery, payment processing, analytics); (b) third-party integrations you explicitly connect (Shopify, Stripe, etc.); (c) law enforcement or regulatory authorities when required by law; (d) a successor entity in the event of a merger, acquisition, or sale of assets.

5. Data Storage and Security

Your data is stored on secure servers. We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service.

Deleting your login: you can delete your Deskwoot account yourself at any time, in the web dashboard under Settings > Profile > Delete your account, or in the Deskwoot app for iPhone and Android under More > Settings > Delete account. You confirm with your password. Your profile, email address, password, profile picture, signature, notification settings, 2FA settings, signed in devices and push notification tokens are deleted right away, and you leave your workspace. Replies and notes you wrote stay in your team's conversations as the workspace's records and show as "Deleted user". If you own a workspace that has other members, remove them first, or write to hello@deskwoot.com to have the workspace handed over. If you are the last member of your workspace, the workspace deletion described below starts at the same time. You can also ask for the deletion by email at hello@deskwoot.com, as described at https://deskwoot.com/data-deletion.

Deleting a workspace: when the owner deletes the workspace and confirms the deletion by email, the workspace is deleted 30 days after the confirmation. If the workspace has a paid subscription, the subscription ends with the current billing period and the 30 days start when that period ends. Until then the owner can cancel the deletion. After that, conversations, messages, contacts, integrations and stored files are deleted permanently.

Billing records, such as payments and credit purchases, are kept after either deletion for as long as the law requires. Conversation data and customer interactions are otherwise retained according to your account settings.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

Right of Access: You can request a copy of the personal data we hold about you. Right to Rectification: You can request correction of inaccurate or incomplete data. Right to Erasure: You can request deletion of your personal data. Right to Restrict Processing: You can request that we limit how we use your data. Right to Data Portability: You can request your data in a structured, machine-readable format. Right to Object: You can object to our processing of your data for certain purposes. Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, contact us at hello@deskwoot.com. We will respond within 30 days.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the EEA. When this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data in accordance with applicable law.

9. Third-Party Services

The Service integrates with third-party platforms. When you connect an integration, data may flow between Deskwoot and the third-party service. Each third-party service has its own privacy policy, and we encourage you to review them. We are not responsible for the privacy practices of third-party services.

9a. AI Processing and No-Training Commitment

When you use Deskwoot's AI features (the AI bot Fynn and Copilot), customer conversation content is sent to our AI provider Anthropic for inference. We confirm in writing through our DPA and Anthropic's DPA that conversation data is never used to train Deskwoot's or Anthropic's AI models. Inference only.

AI on our website: the "Ask anything else" field under our FAQs and the live demo on our industry pages send the question you type, together with the earlier questions and answers of that box, to Anthropic to write the answer. We do not store the questions or the answers. To enforce the limits of these fields we keep a keyed hash (HMAC) of your network address and the time for 8 days. Please do not type personal or health details into them.

Voice messages: when a customer sends a voice message or audio file through WhatsApp or Telegram and your workspace has voice message transcription on (Settings, Account; on by default), the audio goes to AssemblyAI (AssemblyAI, Inc., USA), which transcribes it on its servers in the EU and does not use these files to train its models. The transcript is stored with the message, so Fynn, Copilot and your team can read it.

Bring your own key: on paid plans you can run the bot on your own Anthropic API key in the bot settings. Your prompts and customer data then go directly from your workspace to Anthropic under your own account. Deskwoot does not store these prompts and they never pass through a shared inference pipeline.

Identity verification before personal data: before our AI bot shares a customer's order, address or any other personal data, or acts on their behalf, the conversation must be verified. For email, the email itself is the proof: the sender must pass their domain's authentication (SPF or DKIM aligned with the sender's domain) and match the contact on file. An email that fails this gets no personal data and is handed to a person. For WhatsApp, this happens implicitly when the signed sender matches the contact on file. For live chat, we email the customer a link; they open it and confirm on that page within 15 minutes. Order tracking by order number plus postal code is allowed before full verification but never reveals personal data, only the shipping status.

9b. Stripe App Integration

When you connect Stripe, you install the Deskwoot Stripe App from the Stripe Marketplace and paste the restricted API key Stripe shows you after the install (or a restricted key you create yourself) into Deskwoot. The key is limited to your Stripe account and to the permissions below, and we store it encrypted at rest in our database hosted in the EU (the database and the app are hosted by Northflank Ltd on Google Cloud, region europe-west4 in the Netherlands). Installs made through our earlier OAuth flow keep an OAuth access token and refresh token, stored the same way; the access token, valid for an hour, is renewed automatically before it expires and the refresh token rolls forward on every renewal.

Permissions requested: Customers (read), Subscriptions (read and write), Charges and Refunds (read and write), Products (read) and Invoices (read). Read access is used to display the Stripe customer profile and balance, recent payments, subscription state with the product name and recent invoices next to the support conversation, and to let the AI Copilot and the AI bot answer billing questions such as plan, renewal date, last payment or an invoice.

Write access is used in two cases. (i) Agent-triggered: an authorized Deskwoot agent opens the Details tab of the conversation and clicks Cancel or Refund, then confirms in the dialog. (ii) Bot-triggered: the AI bot issues the action after (1) you have explicitly toggled the matching bot permission ON in your Deskwoot account (cancel subscriptions, issue refunds), (2) the customer's identity on the conversation has been verified per the rules described in section 9a, and (3) the customer has typed a confirm word in their language ("confirm", "yes", "proceed", "do it", or the localized equivalent). In both cases, cancellations are issued as cancel-at-period-end (the customer keeps access until the end of the paid period). Every cancel and refund is recorded in your Deskwoot audit log.

What we store: Stripe customer profile, balance, recent payments, subscription state and recent invoices are fetched on demand to render the conversation context and are not retained beyond what is needed to display in the inbox. Stripe customers are imported as contacts (name, email, phone) when you connect and once a day. If you add the optional Stripe webhook, and when the AI bot refunds a payment, Deskwoot also stores that charge or subscription (amount, currency, date, status and the Stripe record) as an order of the contact. We do not store full card numbers, CVC, or any cardholder authentication data, payment data stays inside Stripe.

Uninstall and deletion: revoking the Deskwoot Stripe App from your Stripe Dashboard revokes the key Deskwoot holds. You can additionally remove the integration from Deskwoot at Settings → Integrations, which deletes the encrypted tokens and cached Stripe metadata from our database. You may request earlier deletion of audit-log entries via hello@deskwoot.com.

9c. Deskwoot Mobile App (iPhone and Android)

The Deskwoot app is for the agents of a Deskwoot workspace. It is the same app on iPhone and Android and handles data the same way on both.

What the app sends to us: when you sign in, your email address and password. For each device you are signed in on we store its IP address, the name of its network client (user agent), whether it is an iPhone or an Android phone and when it was last used; you see these devices in the dashboard under Settings, Security. When you allow notifications, the app registers a push token for the device together with its platform, the app version and the app language. The conversations, messages, notes, contacts and settings you read and change in the app are the same Customer Data as in the dashboard (section 2). On start the app also asks us whether its version is still supported.

Photos, videos and files: the app opens the camera, your photo library or your files only when you choose to take a photo or to attach a photo, video or file, or to set a profile or contact picture. Only what you pick is uploaded, and it is stored with Cloudflare R2 like every other attachment.

Push notifications: we send them through Expo (650 Industries, Inc., USA), which passes them to the Apple Push Notification service for iPhones and to Google Firebase Cloud Messaging (Google LLC, USA) for Android phones. A notification contains the conversation number, the contact's name and a preview of the message, written in the app's language. You choose which events notify you in the app, and you can turn notifications for Deskwoot off in your phone's settings.

Live updates: while the app is open on screen it keeps a connection to Ably (Ably Realtime Ltd.), so new messages show up without reloading. The app closes this connection when it goes to the background.

Copilot: when you use Copilot in the app, the conversation is sent to Anthropic as described in section 9a.

Support chat: Contact Support in the app opens a chat with the Deskwoot team. Your name and email address are sent with your messages, and we derive an approximate location (city and country) from your IP address, as for every chat on our website.

Face ID, Touch ID, fingerprint and face unlock: the check runs on your phone, through iOS or Android. The app only learns whether it succeeded. No biometric data ever leaves your phone or reaches us. Your sign in is kept in the phone's secure storage (the iOS Keychain, or storage encrypted with the Android Keystore).

No tracking: the app contains no analytics, advertising or crash reporting tools and does not track you across other apps or websites. To receive updates of the app itself, it asks Expo's update service whether a newer version exists, sending the platform, the app version and a random installation identifier the update service uses.

Signing out and deleting: signing out ends the session of that device and removes its push token. You can delete your Deskwoot login yourself, in the app's settings or in the dashboard; deskwoot.com/data-deletion explains what is deleted and what is kept.

9d. Calendar and Reservation Connections (Google Calendar, Outlook and aleno)

A workspace administrator can connect a Google Calendar or Outlook account (Microsoft 365 or Outlook.com) so that appointments can be booked into the calendars they choose. Deskwoot asks only for the permissions this needs. For Google: your email address, the list of your calendars, the busy times of the calendars your account can see, and the events on calendars you own. For Microsoft: your basic profile and access to your calendars (Calendars.ReadWrite).

What we read: the list of your calendars and when you are busy, meaning the start and end of events and, for Outlook, whether an event is shown as busy or is cancelled. We never read the titles, descriptions, attendees or any other content of your events.

What we write: only the events Deskwoot creates for appointments. Each one holds the appointment type, the customer's name, their email address or phone number and a link to the conversation in Deskwoot, never message content. These events are private and have no attendees, so nobody receives an invitation.

AI: only the free times Deskwoot works out from your busy times reach our AI provider Anthropic, so the AI bot can offer them to a customer. Calendar data is never used to train AI models or for advertising.

Storage and deletion: the access tokens are stored encrypted at rest (AES-256-GCM) in our database in the EU. When you disconnect a calendar under Settings > Integrations > Appointments, Deskwoot deletes its tokens and the calendars chosen for it, and asks Google to end Deskwoot's access unless the same Google account is still connected to another Deskwoot workspace. Events Deskwoot already created stay in your calendar. You can also remove Deskwoot's access at any time in your Google Account under Security, or in the app permissions of your Microsoft account.

Reservation systems: a workspace administrator can connect a restaurant's reservation system (aleno) by pasting the key of an API user the restaurant created for Deskwoot. Deskwoot reads the restaurant's free tables and booking rules, and creates, changes and cancels reservations for guests who ask for it in a conversation. It sends the time, the number of guests, the seating area asked for, the name, the email address and phone number the guest gave or that Deskwoot has for the contact, the guest's language and the guest's note. Deskwoot stores only what it sent or received in the conversation plus the reservation's id and state, never the restaurant's guest list. Only for a guest whose email address or phone number Deskwoot has verified does it look up that guest's own reservations; they are stored only when the guest asks to change one. The free tables and those reservations reach our AI provider Anthropic only to answer the guest and are never used to train AI models. The key is stored encrypted at rest (AES-256-GCM) in our database in the EU and is deleted when you disconnect the system under Settings > Integrations > Appointments. The reservation system works for the restaurant, which is responsible for the guest data held there.

Deskwoot's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

9f. Business software you connect

A workspace administrator can connect business software the business already uses, such as a shop system, accounting software, a CRM, a practice or booking system, or software for jobs and visits. Each connection is the business's own instruction: the business has its own contract with that software's provider, and Deskwoot exchanges data with the software only for the business and only as the paragraphs below describe.

The keys and access tokens of these connections are stored encrypted at rest (AES-256-GCM) in our database in the EU. Depending on the software a business connects, data can go to systems that keep it outside the EU, for example in the USA, Canada, the United Kingdom or Australia.

Deskwoot never deletes anything in the connected software. Deleting a contact in Deskwoot does not delete the person there; the business does that in its own software. When the business disconnects the software, Deskwoot deletes the key or tokens and the links between its contacts and the records there.

What Deskwoot reads, writes and stores for each system:

Shopware: a workspace administrator connects a Shopware 6 shop with the keys of an integration created in the shop's Administration. Deskwoot only reads the shop and never changes or deletes anything in it. It reads orders with their number, dates, total and currency, the order, payment and delivery states, the items (name, quantity and price), the shipping method, the tracking codes and tracking link, the customer's email address and name, and the postal code and country of the delivery and billing addresses. Deskwoot stores this data and creates a contact with the name and email address of a new order's customer. When a team member opens a conversation, or a customer is looked up through the REST API or the MCP server, Deskwoot also reads the name, street and city of each order's delivery and billing address (it shows only the delivery address) and the name and order count of the customer's account, and never stores them. Deskwoot never asks the shop for phone numbers, companies, VAT IDs, birthdays, customer comments, payment methods or payment details, custom fields or documents.

AI: order data reaches our AI provider Anthropic only to write an answer. Before a customer is verified (section 9a), the AI bot gets only the status, order date and tracking of the one order whose number and delivery postal code the customer gave; for a verified customer it can get their 5 newest orders. Copilot reads a contact's orders when a team member asks it. Order data is never used to train AI models. When the AI bot answers about a parcel, its tracking code, postal code and country can go to Ship24 for the live parcel status.

Storage and deletion: the keys are stored encrypted at rest (AES-256-GCM) in our database in the EU. Disconnecting Shopware under Settings > Integrations deletes the keys and the Shopware orders Deskwoot stored; the contacts stay in Deskwoot. When a person's data is erased in Deskwoot, their stored orders keep only the order facts, without personal data or tracking codes. The business deletes the Deskwoot integration in Shopware itself.

Lexware Office: a workspace administrator connects Lexware Office with a Public API key created in Lexware Office. Deskwoot reads the company profile (company name, tax type and whether the company is a small business). It finds a contact's customer in Lexware by the contact's email address, or by a team member's search and link, and reads that customer's name, customer number, contact person, email addresses, phone numbers and city, and the list of their invoices, down payment invoices and quotes with number, date, due date, total, open amount and status, for a quote also the date until which it is valid, and for a paid invoice the payment date. To answer a question about one invoice or quote by its number, it also reads the postal code of the address on that document. Deskwoot reads these documents while they are shown and never stores them. It stores the key, the company name, its Lexware id and tax settings, and which Lexware customer a contact is linked to. When a team member asks, Deskwoot creates a customer in Lexware with the name, email address, phone number and address the team member enters. For a quote request, from a team member or from the AI bot after the customer confirmed it, Deskwoot creates a quote draft in Lexware with the customer's name, address, the description of the job and the preferred dates, without prices. It never sends the customer's email address or phone number with a quote draft, and Lexware creates no customer for it. Deskwoot keeps a short record of each quote draft in the conversation: a summary, the recipient's name and the quote number.

AI: the AI bot reads Lexware only when the business turned this on. Before a customer is verified (section 9a), it gets only the type, number, status, dates and amounts of the one invoice or quote whose number and postal code the customer gave; for a verified customer it can get their own invoices and quotes of the past 365 days. It never sees drafts. Copilot reads the contact's Lexware customer (the linked one, or the one with the contact's email address) with their newest invoices and quotes when a team member asks it. This data reaches our AI provider Anthropic only to write an answer and is never used to train AI models.

Storage and deletion: Lexware Office is a service of Haufe-Lexware GmbH & Co. KG that the business uses under its own contract. The key is stored encrypted at rest (AES-256-GCM) in our database in the EU. Disconnecting Lexware Office under Settings > Integrations deletes the key and the links between contacts and Lexware customers; customers and quote drafts created in Lexware stay there. Deleting a contact in Deskwoot deletes nothing in Lexware, and Deskwoot cannot delete the key in Lexware: the business deletes it under Public API in Lexware Office.

Justimmo: a workspace administrator connects an API export that the agency creates in Justimmo, with the export's username and password. Deskwoot reads only the listings the agency books into that export, as they are published: the title, listing number, type, status, prices and costs with the commission and deposit text, areas and rooms, features, energy values, the description and location text, the place, one title picture, and the names of the listing's agent and of the agency. It keeps the street and house number only when the agency released the address, it never keeps coordinates or the agents' email addresses and phone numbers, and it never reads the agency's contacts, inquiries and offers in Justimmo. Deskwoot keeps a copy of these listings while they are in the export and deletes a listing 30 days after it left.

Deskwoot writes one thing to Justimmo: an inquiry about a listing, sent by a team member, or by the AI bot after the customer confirmed it in the conversation. It carries the listing, the customer's first and last name, their email address and phone number as far as Deskwoot has them, the salutation a team member chose, what the customer wants, their preferred times and message, whether the sender was verified, the marketing category the administrator set and a link to the conversation that only the business's team can open. Justimmo creates or updates the contact and gives the inquiry to the listing's agent. Deskwoot keeps a short record of each inquiry next to the conversation: the listing, what was asked, when, by whom and whether Justimmo took it.

AI: listing data reaches our AI provider Anthropic only to write an answer. The AI bot reads listings when a customer asks about them, and puts the customer's name and contact details into an inquiry only to send what the customer confirms. Copilot sees the inquiries sent from a conversation when a team member asks it. This data is never used to train AI models.

Storage and deletion: the username and password are stored encrypted at rest (AES-256-GCM) in our database in the EU. Disconnecting Justimmo under Settings > Integrations deletes the login and Deskwoot's copy of the listings. Inquiries already sent stay in Justimmo, and the business deletes the API export in Justimmo itself. When a person's data is erased in Deskwoot, the records of the inquiries sent for them are deleted too; the business deletes the contact in Justimmo itself.

Propstack: a workspace administrator connects the agency's Propstack account with an API key created in Propstack; the key's permissions decide what Deskwoot may read and write. Deskwoot reads the agency's marketed listings as they are published (the title, listing number, type, status, prices and costs with the published buyer's commission, areas and rooms, features, energy values, the description, the place, the public listing page, one title picture and the name of the listing's agent) and the agency's listing statuses, contact sources, note types and the names of its users. It keeps the street and house number only when the agency shows the address, and it never stores a listing that is archived or whose status the agency hides from the AI bot. Deskwoot keeps a copy of these listings while they are marketed and deletes a listing 30 days after it left. Propstack also tells Deskwoot about changed listings through webhooks; Deskwoot keeps only the listing's id from them.

For a person in a conversation, Deskwoot reads the matching Propstack contact when a team member opens the conversation or the contact, or when the AI bot sends a request or answers a verified customer: the name, customer number, status, agent, active search profiles and upcoming appointments (time, type, listing and place, never the title or text of an appointment). It shows this data and does not store it; it stores only the link between the Deskwoot contact and the Propstack contact. Deskwoot never reads a contact's income, bank details, ID, date of birth or tax number, and never the agency's warnings, notes, documents, deals, owners, valuations or internal commissions.

Deskwoot writes to Propstack when a team member sends something, or when the AI bot sends a request the customer confirmed in the conversation: a contact with name, email address, phone number, contact source and language, only when no Propstack contact has that email address or phone number (an existing contact is never changed); a note with the request (the listing, what the person wants, preferred times, their message, search criteria or details of a property to sell, whether the sender was verified, and a link to the conversation that only the business's team can open), or a team member's own note; and a search profile. A search profile is saved only after the person agreed to receive matching offers by email, and it records that consent with its time; only a contact Deskwoot creates for it gets Propstack's mailing setting. A note with a contact source can start the agency's own automations in Propstack. Deskwoot keeps a short record of each request next to the conversation.

AI: listing and contact data reaches our AI provider Anthropic only to write an answer. The AI bot names a customer's upcoming appointments only after the customer was verified (section 9a). Copilot reads the linked contact, its search profiles and appointments and the listings of the conversation when a team member asks it. This data is never used to train AI models.

Storage and deletion: the key is stored encrypted at rest (AES-256-GCM) in our database in the EU. Disconnecting Propstack under Settings > Integrations deletes the key, Deskwoot's copy of the listings and the links to Propstack contacts, and removes Deskwoot's webhooks in Propstack. Everything already sent stays in Propstack, and the business deletes the key in Propstack itself. When a person's data is erased in Deskwoot, the link to their Propstack contact and the records of the requests sent for them are deleted too; the business deletes the contact in Propstack itself.

Cliniko: a workspace administrator connects the practice's Cliniko account with the API key of a Cliniko user; we recommend a user with the Scheduler role, which cannot see treatment notes, forms or invoices. Deskwoot reads the key's user (name, email address and role), the account's name, region and online booking rules, the locations, practitioners and appointment types with their online booking settings, and the free times Cliniko offers. For a patient Fynn books for, a patient the team links or looks up, and a contact whose email address matches a record, Deskwoot reads the patient's appointments and the patient's name, email address and phone numbers (to check who someone is) and date of birth (to tell 2 records apart); it stores none of these 4 details from Cliniko. Deskwoot keeps nothing else of a patient record and never asks Cliniko for treatment notes, medical alerts, cases, forms, attachments, letters, invoices or payments.

Deskwoot writes to Cliniko the appointments a patient books, moves or cancels in a conversation, the appointments the team cancels there, and a new patient record with only the first and last name, the email address and a mobile number. Each appointment Deskwoot books carries a short note with a reference and a link to the conversation, never the content of a message; a cancel can carry the team's own note. Deskwoot never changes an existing patient record. Fynn books into an existing record only when the contact is linked to it or after the patient verified their email address (section 9a); otherwise the team chooses the record. Whether Cliniko itself emails the patient about a booking or a cancel depends on the practice's settings in Cliniko.

Deskwoot stores the key, the account facts and the list of locations, practitioners and appointment types, the Cliniko patient ID for each contact that is linked, and the time, type, practitioner, location and state of the appointments booked or taken over through Deskwoot. It keeps no copy of the patient list.

AI: the free times, appointment types, practitioners and locations, and for a verified patient their own upcoming appointments, reach our AI provider Anthropic only to write an answer. Copilot reads a linked patient's name and next 3 appointments when a team member asks it, never a date of birth, an email address or a phone number. This data is never used to train AI models.

Storage and deletion: the key is stored encrypted at rest (AES-256-GCM) in our database in the EU. Disconnecting Cliniko deletes the key, the list of locations, practitioners and appointment types, and every link between contacts and Cliniko records; appointments keep their history in Deskwoot, and nothing changes in Cliniko. The practice archives the API key in Cliniko itself.

Jobber: a workspace administrator connects the business's Jobber account by signing in to Jobber and allowing Deskwoot access. Jobber asks the administrator to let Deskwoot read and write clients and their properties, requests, visits and assessments, and jobs, and read quotes, invoices and team members. Deskwoot uses less than that: it writes only what this paragraph names and never writes jobs or assessments. It reads the account's id, name and country.

Deskwoot finds a contact's Jobber client by the contact's email address or phone number, or by a team member's search and link. When a team member opens the conversation or the contact, Deskwoot reads that client's name, company, email addresses, phone numbers, city and service addresses, their requests, quotes, jobs and invoices (number, title, status, dates, totals, amounts still owed and the link in Jobber) and their visits that are not done yet (time, title, job and the first names of the team members on it). For a verified customer who asks the AI bot about their own records, it reads the same lists with the Client Hub links and without the team's names. When a verified customer asks to move a visit, it reads the visit with the client's email addresses and phone numbers, to check who is asking, and, for each team member on the visit, when the items on their schedule start and end. Deskwoot stores none of this, apart from what is named below.

Deskwoot writes to Jobber when a team member sends something, or when the AI bot sends a request the customer confirmed in the conversation: a new client with the name, email address, phone number and service address (and a company, when a team member enters one), only when no client in Jobber has that email address or phone number or a team member creates it anyway; a new property when the client does not have the service address yet; and a request with a title and a note that holds the details, the preferred times, the channel, a Deskwoot reference and, unless the team member took it out, a link to the conversation that only the business's team can open. When the sender's email address or phone number belongs to a client but the sender is not verified (section 9a), the request waits for the team, who chooses the client. For a visit a verified customer moves in a conversation, Deskwoot writes only the new start and end time, at once or after a team member confirms it, as the business's booking rules say. Apart from adding a property, Deskwoot never changes an existing client, and it never cancels or deletes a visit or changes its team.

Deskwoot stores the tokens, the account's id, name and country, which Jobber client each contact is linked to (and the clients a team member marked as not this contact), and a short record of each request next to the conversation: a summary, the client's name and the request's link in Jobber. For a visit a customer asked to move, it keeps the time, title, job number, link and state with the ids of the visit and the client, and keeps them in line with Jobber while the visit is open. Jobber tells Deskwoot through webhooks when the business removes Deskwoot in Jobber, when a client is deleted and when a visit changes; Deskwoot keeps only the type and ids of these events, and an event about a client or a visit only when a contact is linked to that client or Deskwoot follows that visit.

AI: for a verified customer, the AI bot gets their own requests, quotes, jobs, invoices and upcoming visits with statuses, dates and job numbers, never the team's names, notes, line items or service addresses; totals, amounts still owed and the Client Hub links where the client answers a quote or pays an invoice reach it only when the business turned this on. For a move it gets the customer's upcoming visits and the free times. Copilot reads the linked client, or the one client that matches the contact exactly, with their open items when a team member asks it, never an email address, a phone number or the team's names. This data reaches our AI provider Anthropic only to write an answer and is never used to train AI models.

Storage and deletion: the tokens are stored encrypted at rest (AES-256-GCM) in our database in the EU. Disconnecting Jobber under Settings > Integrations deletes the tokens and the links between contacts and Jobber clients, and asks Jobber to end Deskwoot's access; the records of requests and moved visits stay in the conversations. When the business removes Deskwoot in Jobber, Jobber ends the access and Deskwoot deletes the tokens at once; the links stay until an administrator removes the connection in Deskwoot. Clients, properties, requests and visit times already sent stay in Jobber. When a person's data is erased in Deskwoot, the link to their Jobber client, the records of the requests sent for them and the visits Deskwoot followed for them are deleted too; the business deletes the client in Jobber itself.

10. Analytics and Tracking

Our cookie banner asks for your consent in 2 categories:

- Statistics: Google Analytics 4 and PostHog. We see how our website is used.

- Marketing: Google Ads, Microsoft Advertising and OpenAI Ads. We measure which ad led to a signup.

The banner offers "Accept all", "Reject all" and "Settings". Under "Settings" you switch each category on or off and confirm with "Save choices". We store your choice in your browser's localStorage (deskwoot-consent), without any identifier. You can change or withdraw it at any time with the "Cookie settings" link in our footer. When you switch a category off, we delete its cookies and storage entries named below and tell the services that consent is denied.

In the EU, the EEA, the UK and Switzerland none of these services loads before you choose (Google calls this basic consent mode). Outside these regions, where the law does not require consent first, all of them load without a banner and set the cookies named below. There we store a choice only once you make one yourself with the "Cookie settings" link.

Google Analytics (Statistics): We use Google Analytics 4 (GA4), loaded as the Google tag from googletagmanager.com, to understand how visitors use our website and to improve the Service. Our GA4 property ID is G-EBYJ09M1YP.

Google Analytics collects the following types of information: pages visited and navigation paths, time spent on pages and session duration, device type, operating system, and browser information, approximate geographic location (city/country level), referral sources and how you arrived at our website, and general interaction patterns.

Google Analytics uses the cookies _ga and _ga_EBYJ09M1YP to distinguish unique users and track sessions. This data is processed by Google LLC in accordance with their privacy policy, which you can review at https://policies.google.com/privacy.

We do not use Google Analytics data to personally identify individual users. The data collected is used in aggregate to analyze trends, administer the site, and improve user experience.

You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout.

Product analytics and session replay (PostHog, Statistics): With your statistics consent we use PostHog for product analytics, feature flags, error tracking, and session replay. PostHog runs on our website, on the signup and login pages and in the signed in dashboard, where it links the events to your user account. Session replay never runs in the dashboard (/app), because the dashboard shows customer conversations. Without statistics consent PostHog does not start and writes nothing to your browser. With it, PostHog keeps its data in a cookie and in localStorage (ph_<project key>_posthog).

Provider: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA.

Data hosting: Your PostHog data is processed on EU servers (eu.i.posthog.com, hosted on Google Cloud in Frankfurt, Germany). Access by PostHog personnel based in the USA may nonetheless occur for support and operations. We rely on the EU Commission's Standard Contractual Clauses (SCCs) together with PostHog's Data Processing Addendum as the legal basis for this transfer.

Data collected: Page views, clicks, feature interactions, custom product events (such as signup, subscription changes, inbox connected), device and browser information, approximate geographic location, and, outside the dashboard, session recordings (mouse movement, clicks, scroll position, page navigation). In the recordings all text and all form inputs are masked; only elements we mark as safe are shown.

Purpose: Understanding how our product is used, improving the user experience, debugging issues reported by customers, measuring the impact of new features, and detecting errors.

Legal basis: Your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG, given in our cookie banner. Outside the EU/EEA, UK, and Switzerland, statistics run without a banner where local law allows it (for example the CCPA, under which you can object).

Retention: Up to 7 years by default, in line with PostHog's platform retention. You may request earlier deletion at any time.

How to opt out: Click "Reject all" in the cookie banner, or switch off Statistics at any time with the "Cookie settings" link in our footer. You can also request deletion of your session recordings via hello@deskwoot.com.

More information: https://posthog.com/privacy

Advertising and conversion tracking (Marketing): With your marketing consent (outside the EU/EEA, UK, and Switzerland: unless you reject it) we load a small number of advertising pixels so we can measure which ads led to a signup. The pixels we run are:

- Google Ads (gtag): conversion measurement for our Google Search and Display campaigns. Loaded with the same Google tag from googletagmanager.com. Identifier captured: gclid query parameter, plus Google managed cookies (_gcl_*). Provider: Google LLC. Privacy: https://policies.google.com/privacy.

- OpenAI Ads (oaiq, beta): conversion measurement for ChatGPT Ads. Pixel script loaded from bzrcdn.openai.com/sdk/oaiq.min.js. It sets a random browser identifier in the first party cookie __obref (1 year) and, when you arrive from an OpenAI ad, stores the oppref query parameter in the first party cookie __oppref (30 days). Provider: OpenAI L.L.C. Privacy: https://openai.com/privacy.

- Microsoft Advertising (UET tag): conversion measurement for our Microsoft Advertising (Bing) campaigns. Script loaded from bat.bing.net/bat.js. Identifier captured: msclkid query parameter, plus Microsoft managed cookies (_uetsid, _uetvid). Provider: Microsoft Corporation. Privacy: https://privacy.microsoft.com/privacystatement.

From our server: when you sign up, and later when you buy a plan, our server also sends the conversion to Google (for purchases with the gclid you signed up with) and to OpenAI's Conversions API, so it is counted even if your browser blocks the pixel. We do this only with your marketing consent, or outside the EU/EEA, UK, and Switzerland when you did not reject marketing.

What we share: the conversion event itself (signup completed, plan upgraded), an event identifier so duplicates can be deduplicated, the ad click identifier (gclid / msclkid / oppref / raid) that was originally on the landing URL, the source URL of the page the conversion happened on, and, for some pixels, a hashed (SHA-256) version of your email address. We never share the conversation content, customer messages, or product data with any ad network.

Legal basis: Your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG, given in our cookie banner. Outside the EU/EEA, UK, and Switzerland, advertising follows local law, under which you can object.

How to opt out: Click "Reject all" in the cookie banner, switch off Marketing under "Settings", or use your browser's ad blocker. You can withdraw your consent at any time with the "Cookie settings" link in our footer; from then on your browser sends no further conversion events, and if you change it while signed in, our server sends none either.

11. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service with a new "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: hello@deskwoot.com Address: Neltacore, LLC, 1908 Thomes Avenue, Cheyenne, WY 82001, USA