Privacy Policy

This Privacy Policy explains how DeskCrew (“DeskCrew,” “we,” “us”) handles information when you use our hosted support-helpdesk service (the “Service”) at deskcrew.io. DeskCrew is a multi-tenant SaaS platform: businesses (“Customers” or “tenants”) use it to run support for their own end-customers.

Our role: processor vs. controller

For the support data that flows through the Service (tickets, messages, attachments, knowledge-base content, and the end-customer details inside them), DeskCrew acts as a data processor. The tenant business that operates the workspace is the data controller: they decide what to collect and why, and they are responsible for having a lawful basis and an appropriate notice to their own end-customers. DeskCrew processes that data only to provide the Service and on the tenant’s instructions.

For the small amount of data we collect about our direct account holders (the people who sign up to operate a DeskCrew workspace) and our public website visitors, DeskCrew acts as a controller.

What we collect and process

• Account & workspace data: the name, email, and authentication credentials of agents/operators who sign in, plus workspace settings and configuration.
• Support content (processed on behalf of tenants): tickets and conversation history, the email address or identifier of an end-customer who contacts a tenant, knowledge-base articles, feedback-board posts, and any attachments submitted through the widget, public board, email, Slack, or Discord.
• Usage & technical data: logs, IP address, browser/user-agent, and basic analytics needed to operate, secure, and debug the Service.
• Approximate location: when a customer writes in through the website widget or chat, an approximate country is derived from the request. The IP address itself is not stored for this.
• Waitlist data: if you join the early-access waitlist, the email address (and optional details) you submit.

We do not sell personal data, and we do not use support content to train AI models. Our AI Policy explains which features use AI and what they see.

Visitor journeys

A business can turn on journey capture in its support widget. It is off unless the business turns it on. When on, the widget records, for that site only: the pages viewed, time on each page, deepest scroll position, clicks on links and buttons (the visible text and the link only), the landing page, the referrer, UTM campaign tags, device class (mobile, tablet or desktop), browser language and timezone. It never records keystrokes, form field values or anything typed into an input. The journey is stored under random visitor and visit IDs kept in that site’s browser storage (deskcrew.vid.<key>) and is deleted after 90 days. The business uses it to decide when to open the chat and to give its own support agent context; it is processed on the business’s behalf, like other support content. A visitor who gives an email in the chat is linked to their customer record in that workspace. A site with a consent banner can switch capture off for a visitor by setting window.DeskCrewConsent = false before the widget loads.

Wallets and transactions pasted into a chat

A business can connect an NFT collection so the assistant can answer holder questions with read-only facts from the public chain. A wallet address or transaction hash pasted into a chat is kept only in that message, like any other message text. Nothing is stored about a wallet beyond that, there is no wallet index per workspace, and nothing is ever written to any chain.

Where data is stored

The Service and its database are hosted in Singapore on managed cloud infrastructure. Some subprocessors operate in the United States; transfers are covered as described in our Data Processing Agreement.

Sub-processors

We rely on subprocessors for hosting and storage, network protection, email delivery, AI answers (only for AI features a workspace has turned on), subscription payments, and the card checkout used to buy USDC credit. Each is listed by role and region in our Data Processing Agreement. A current list of named subprocessors is available to customers on request.

The x402 agent door

DeskCrew offers an optional keyless “agent door” where autonomous AI agents can call tools and pay per action in USDC on supported public chains (Base, Polygon, Sei, Avalanche, Solana, and Algorand). These agent interactions are anonymous: we do not collect names, emails, or other personal identifiers from agents: only the on-chain payment and the request payload required to perform the requested action. What an agent may do on a desk is set by that desk; see our AI Policy for which actions need a person’s approval.

Cookies & sessions

We use only strictly necessary cookies and browser storage, to keep operators signed in and to keep the Service secure. We do not use advertising or cross-site tracking cookies. Our Cookie Notice lists each one.

Data retention

We retain support content for as long as the tenant’s workspace is active, and then for a limited wind-down period after termination, unless the tenant instructs us to delete it sooner. Account and waitlist data is kept while the relationship is active. Backups and logs are retained for a limited period for security and recovery.

Your rights (GDPR / CCPA)

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to opt out of the sale or sharing of personal data (we do not sell it). End-customers of a tenant should direct these requests to that tenant (the controller); we will assist the tenant in responding. For data DeskCrew controls directly, contact us using the details below. End-customers who receive a DeskCrew email can also use the one-click unsubscribe link in that email.

Security

We protect data in transit with HTTPS, isolate each workspace’s data, encrypt sensitive secrets at rest, and verify inbound-email webhooks cryptographically. See our Security page for details.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

Contact

Questions or privacy requests: hello@deskcrew.io.

This policy is provided for transparency and is not legal advice. Please review it with qualified counsel before relying on it.