Overview
This policy explains what personal data deskee.io ("Deskee", "we", "us") collects when you use our service desk platform and website, why we collect it, and the choices you have. It applies to visitors, account holders, and end users who interact with a Deskee-powered chat widget on our customers' sites.
Who we are
Deskee is operated by Deskee Ltd. For any question about this policy or your data, contact us at hello@deskee.io.
Information we collect
Depending on how you use Deskee, we collect:
- Account information — name, email address, company, and billing details when you sign up or upgrade a plan.
- Ticket and conversation content — messages exchanged between end users, your AI model, and your human agents through a Deskee-powered desk.
- Configuration data — routing rules, escalation settings, and the AI provider credentials you choose to connect (see "AI model providers" below).
- Usage and log data — pages visited, actions taken in the dashboard, device and browser information, and timestamps, collected automatically to keep the service reliable and secure.
- Cookies — small files stored in your browser; see "Cookies" below.
Cookies
We use strictly necessary cookies to keep you signed in and to remember your cookie preference. With your consent, given via the cookie banner, we also use analytics cookies to understand how the site is used so we can improve it. You can withdraw consent at any time by clearing your browser's local storage for this site or contacting us.
How we use your information
We use personal data to: provide and maintain the service desk infrastructure (queues, routing, escalation, handoff); operate billing for Free, Pro and Enterprise plans; respond to support requests; secure the platform against misuse; and improve our product. We do not sell personal data.
AI model providers and your data
Deskee's architecture is deliberately split: we run the service desk infrastructure, and you choose the AI model that powers conversations. When you connect a provider such as OpenAI, Anthropic, Google, Mistral, or a custom/self-hosted endpoint, ticket and conversation content is sent directly to that provider using the API key or endpoint you supplied, under that provider's own terms and privacy policy. We recommend reviewing your chosen provider's data handling practices, particularly if you operate in a regulated industry. Deskee stores your provider credentials securely and only uses them to route your conversations as instructed.
Chatbots can use Deskee's built-in AI instead, and do by default. Conversation content is then processed by the AI providers we use as sub-processors: currently OpenAI (in the United States) and Amazon Web Services (Amazon Bedrock, in London). Neither uses it to train their models. We may move the built-in AI between these providers; our Data Processing Agreement lists the current ones.
Google Calendar integration
You can link a Google Calendar to any of your Deskee calendars, on that calendar's Google Calendar tab. When you do, you authorise Deskee — through Google's OAuth consent screen — to access that Google account for these purposes only: reading free/busy information (start and end times only, never event titles or details) so that times you're already busy aren't offered to people booking; if you turn on "Also add bookings to this Google Calendar", creating an event for each booking made through Deskee and deleting it again if that booking is cancelled; and, for calendars set to use Google Meet, adding a Meet link to that event. We also read the Google account's email address so we can show you which account is linked. We request the narrowest scopes that allow this (calendar.freebusy and calendar.events, plus openid and email).
We store the OAuth access and refresh tokens Google issues, encrypted at rest, together with the linked account's email address and the IDs of the events we create (so we can remove them if a booking is cancelled). Free/busy information is fetched each time availability is checked and is not stored. Data from your Google Calendar is not passed to any AI model provider: the chatbot only ever sees the resulting open time slots, never your Google events. The events we create contain the booking's details — the visitor's name and email address, and their phone number and notes when they give them — so the booking appears in your calendar. We do not use data received from Google APIs to develop, improve or train AI or machine-learning models, and we never sell it or use it for advertising.
You can unlink a Google Calendar at any time by setting the Deskee calendar's Google Calendar tab to "Not linked", or revoke Deskee's access directly in your Google Account under "Third-party apps with account access". Once access is revoked, Deskee immediately stops checking availability in, and adding bookings to, that Google Calendar; bookings carry on in Deskee on their own.
Deskee's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The Deskee mobile app
The Deskee app for iPhone, iPad and Android is for Deskee users and their teammates. When you sign in, we use your email address to send you a one-time code. While you use it, the app handles the same account, profile and conversation data described above, plus a push notification token for your device (issued by Apple or Google), the device type and the app version, so we can alert you when a chatbot hands a conversation to a person.
The app only uses your microphone when you tap it to reply by voice: the recording is sent to our speech-to-text provider, turned into text, and not kept. It only uses your camera or photo library when you choose a profile photo. You can turn any of these permissions off in your device's settings at any time.
The app has no ads, doesn't track you across other companies' apps or websites, and doesn't include third-party analytics. Signing out removes your device's push token from your account.
Merch shop orders
When you buy from our merch shop, we collect your name, email address, delivery address and phone number, and what you ordered. Payment is handled by Stripe: we see whether a payment succeeded, but never your full card details. If you claim the free AI conversations offer, we also keep the link to the post you send us and which network it's on.
We use these details to fulfil and deliver your order, to email you about it (your receipt, dispatch and tracking, and the codes that come with your shirt), to handle returns and questions, to check offer claims, and to keep the records the law requires. This is necessary to perform our contract with you, and to meet our legal obligations. Buying a shirt doesn't sign you up to marketing emails.
We share your name, delivery address and phone number with our print partner and our courier, only so they can print and deliver your order; couriers ask for a phone number in case of delivery problems. Orders sent outside the UK are shared with the destination country's customs as part of delivery.
We keep order records for 6 years after the end of the financial year they belong to, as UK tax law requires. Offer claim links are kept with the order. You can ask for a copy of your data, or ask us to correct or delete it, as described below, subject to those legal requirements.
Sharing and disclosure
We share personal data with: sub-processors who help us run the service (such as hosting, AI model hosting, email delivery, text message delivery and payment processing providers), under contracts that protect your data; the AI model provider you configure, as described above; and authorities where required by law. We do not share your data with third parties for their own marketing purposes.
Data retention
We retain account and ticket data for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, or dispute-resolution requirements. You can request deletion of your data at any time, subject to those obligations.
International transfers
Where personal data is transferred outside the UK or European Economic Area — including to AI model providers you configure — we rely on appropriate safeguards such as standard contractual clauses, or the provider's own compliant transfer mechanisms.
Security
We use industry-standard technical and organisational measures, including encryption in transit, access controls, and regular review of our infrastructure, to protect personal data against unauthorised access, loss, or misuse.
Your rights
If you are in the UK or EEA, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise any of these rights, email hello@deskee.io. If you're not satisfied with our response, you can complain to the UK Information Commissioner's Office (ICO) or your local data protection authority.
Children's privacy
Deskee is a business-to-business product and is not directed at children. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy from time to time. If we make material changes, we'll update the date at the top of this page and, where appropriate, notify account holders directly.
Contact us
Questions about this policy or your data can be sent to hello@deskee.io.