1. Who this applies to
This policy covers two groups: customers who sign up for an nDesk account to run the widget on their own site, and end visitors who chat with the widget on a customer's website. If you're a visitor, the customer running the widget is generally the data controller for your conversation — contact them directly for requests about your own data, and see section 6 for how we process it on their behalf.
2. Data we collect
Depending on how you interact with us, we collect:
- Account data — name, work email, company, and billing details when you sign up or subscribe to a plan
- Content you provide to power the assistant — help centre articles, uploaded docs, and any knowledge base you connect
- Conversation data — messages exchanged through the widget, including visitor messages, AI responses, and handoffs to your team
- Usage data — pages visited on our site, features used in the dashboard, and device/browser information, collected via cookies and similar technologies (see our Cookie policy)
- Support data — anything you send us when you contact support, including message content and attachments
3. How we use it
We use the data above to:
- Provide, operate, and maintain the Service, including generating AI responses from your content
- Process payments and manage subscriptions
- Send service notifications, security alerts, and — where you've opted in — product updates
- Monitor, debug, and improve reliability and quality of the assistant
- Comply with legal obligations and enforce our terms of service
4. AI processing
To generate answers, the widget sends relevant excerpts of your content and the visitor's message to the language-model providers we use to power the assistant. We select subprocessors that contractually commit not to use your data to train their own general-purpose models, and we only send what's needed to answer the specific conversation.
5. Sharing and subprocessors
We don't sell personal data. We share data only with:
- Subprocessors that host infrastructure, process payments, send email, or provide the AI models behind the assistant, under contracts that limit their use of your data to providing the service to us
- Professional advisors (legal, accounting) where necessary
- Law enforcement or regulators where required by law, or to protect the rights, safety, and property of nDesk, our customers, or others
- A successor entity in the event of a merger, acquisition, or asset sale, with notice to affected customers
6. Data retention
We keep account and billing data for as long as your account is active and as needed to meet legal and accounting obligations after closure. Conversation transcripts are retained according to the retention window your organisation configures in the dashboard, or a default retention period if none is set. You can request earlier deletion at any time.
7. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, email us — if you're a website visitor, we may need to route your request to the customer whose site you contacted us through, since they control that relationship.
8. International transfers
We and our subprocessors may process data in countries other than your own. Where required, we rely on recognised transfer mechanisms (such as standard contractual clauses) to protect data moved across borders.
9. Security
We use encryption in transit, access controls, and regular review of our subprocessors' security practices. No method of transmission or storage is 100% secure, so we can't guarantee absolute security, but we work to protect data appropriately for its sensitivity.
10. Children's privacy
The Service isn't directed at children under 16, and we don't knowingly collect personal data from them. If you believe a child has provided us data, contact us and we'll delete it.
11. Changes to this policy
We'll update the effective date at the top of this page when we make changes, and notify account owners of material changes by email or in-product notice.
12. Contact
Questions about this policy or a request about your data? Email info@ndesk.chat.