How we handle your data

CXdesk is a shared inbox for customer support teams. This page explains what personal data we collect, why we collect it, who we share it with and how long we keep it.

The short version

We don't sell personal data, and we don't use it for advertising.
The emails and files your customers send to your workspace belong to you. We store and process them only to run your workspace.
Each workspace has its own separate database.
When a workspace is deleted, its database, attachments and stored emails are deleted with it.

Who we are

CXdesk ("CXdesk", "we") runs this website and the CXdesk app. For any privacy question, email hello@cxdesk.org.

Our two roles

We decide how your data is used (we're the "controller") when you visit our website, request a trial, try the live demo or have a CXdesk login.

We process data for our customers (we're the "processor") for everything inside a workspace: the emails, contacts, attachments and notes. The company that owns the workspace decides what goes into it. If you emailed a company that uses CXdesk and have a question about your data, contact that company. We'll help them answer.

What we collect

When you visit our website

If you accept analytics cookies, Google Analytics records the pages you view, how you arrived, your approximate location, and your device and browser. If you reject them, Google Analytics doesn't load at all (see Cookies).
Our fonts are loaded from Bunny Fonts, which receives your IP address to deliver them.

When you request a trial

Your name, email, company, chosen workspace address, team size and plan.
Optionally, the tool you use today and any message you add.
Your IP address, to stop spam and repeated submissions.
If you tried the live demo in the same browser, we link your request to that demo's activity.

When you try the live demo

Each demo is a private workspace filled with made-up sample data. Anything you type stays inside it, and no email ever leaves a demo.
We record the industry and plan you picked, the page that sent you to us, your device type, your country, which areas and features you open, plan switches and your answer to the exit question.
To prevent abuse, we keep a one-way code made from your network address, not the address itself.
A cookie lets you return to your demo.

When you use CXdesk

Your name, email, profile photo, role and teams.
Your password, stored only as a one-way hash. We can't read it.
Your IP address and browser for your sign-in sessions and your workspace's activity log.
What you do on tickets (replies, notes, assignments, status changes), which becomes part of each ticket's history.

Inside your workspace

Emails your workspace receives and sends, including names, email addresses, message text and attachments; contacts; internal notes; ticket details; satisfaction survey answers; and the reports built from them. We process this on your behalf, as described in Our two roles.

How we use it

To run the service: receive and send email, store tickets, sign you in.
To send service emails: invitations, password resets, trial reminders and deletion warnings.
To keep things secure: spot abuse, limit repeated attempts and keep activity logs.
To reply to trial requests and set up workspaces.
To improve the website and demo, using totals and trends, not individual profiles.
To meet legal obligations.

If you're in the EU or UK, we rely on our contract with you to run your account, on our legitimate interests for security, follow-ups and improving the product, on your consent for analytics cookies, and on legal obligations where they apply.

We use a small number of service providers, who may only use the data to provide their service to us:

Amazon Web Services: sending and receiving email, and file storage.
Google: website analytics, only if you accept analytics cookies.
Bunny Fonts: website fonts.

We also share data if the law requires it, or with a buyer if CXdesk is sold or merged. We'd tell you before that happened.

Where it's stored

Your data is stored in the European Union (France) and the United States. If you're elsewhere, we rely on safeguards such as the European Commission's Standard Contractual Clauses where the law requires them.

How long we keep it

Workspace data stays as long as the workspace exists.
After a trial ends without a subscription, the workspace becomes read-only and is deleted 90 days later. We email the workspace admins 14 and 3 days before.
Deleting a workspace deletes its database, its attachments and the emails we stored for it.
Demo workspaces are deleted after 2 hours without activity, or 24 hours at most. We keep the demo's activity record, which has no name or email address.
Trial requests are kept so we can follow up and know which workspace came from which request. Ask us and we'll delete yours.

How we protect it

All traffic is encrypted over HTTPS.
Each workspace's data is kept separate from every other workspace.
Attachments are stored privately and only people in your workspace can open them.
Incoming email is scanned for viruses.
Admin actions, sign-ins and setting changes are recorded in an activity log.

Your rights

Depending on where you live, you can ask to see, correct, delete or export your personal data, and object to or limit how we use it. Email hello@cxdesk.org and we'll reply within 30 days.

For data inside a workspace, contact the company that owns it. You can also complain to your local data protection authority.

Cookies

Cookie	What it does	How long
`cxdesk-session`	Keeps you signed in and keeps forms working.	Until you sign out or the session ends
`XSRF-TOKEN`	Protects forms from being sent by other websites.	Same as your session
`cxdesk_demo`	Lets you return to your live demo.	24 hours
`_ga`, `_ga_*`	Google Analytics: counts visits and tells them apart. Only set if you accept.	Up to 2 years
`cxdesk_cookie_consent`	Remembers whether you accepted or rejected analytics cookies. Kept in your browser's storage.	Until you change it or clear your browser data

You can change your choice at any time with Cookie settings at the bottom of every page. Rejecting removes the Google Analytics cookies.

Children

CXdesk is a business tool and isn't meant for anyone under 16.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we'll email workspace admins before it takes effect.