Privacy Policy

This Privacy Policy does not apply to websites, apps, or services that we do not own or control.

4.1 Account and profile data

When you create or use a NivaDesk account, we may collect:

• name;
• email address;
• password or authentication information;
• profile photo or avatar;
• company or workspace name;
• role within a workspace;
• language, timezone, and app preferences;
• login method, such as email/password, Google sign-in, or Apple sign-in.

4.2 Workspace and business content

When you use NivaDesk, you or your team may add content such as:

• customer or client details;
• order details;
• workflow status;
• order notes;
• customer notes;
• task lists and reminders;
• delivery dates and timelines;
• addresses;
• uploaded files;
• images, PDFs, design files, documents, and attachments;
• team member roles and access permissions;
• history logs and activity records.

You are responsible for ensuring that any personal data you upload to NivaDesk has been collected and added lawfully.

4.3 Payment and subscription data

If you purchase a paid plan, we or our payment providers may process:

• billing name;
• billing address;
• email address;
• payment method information;
• subscription plan;
• invoices and transaction history;
• tax or accounting information where required.

We do not store full card numbers ourselves. Payment details are processed by third-party payment providers such as Stripe, Apple, Google, or other payment platforms depending on how you subscribe.

4.4 Device, usage, and technical data

When you use our website or apps, we may collect:

• IP address;
• device type;
• operating system;
• browser type;
• app version;
• crash reports;
• log-in times;
• pages or features used;
• performance and diagnostic data;
• approximate location based on IP address;
• cookies and similar technologies.

This helps us keep NivaDesk secure, improve performance, fix bugs, and understand how users interact with our services.

4.5 Communication data

If you contact us, we may collect:

• your name;
• email address;
• message content;
• support requests;
• feedback;
• attachments or screenshots you send us;
• records of our communication with you.

4.6 Data from third-party login or integrations

If you choose to sign in with or connect a third-party service, such as Google or Apple, we may receive limited information from that service, such as:

• name;
• email address;
• profile image;
• authentication identifier.

If future NivaDesk integrations allow access to services such as calendar, files, email, storage, or other business tools, we will only access the data needed to provide the feature you choose to use.

We will not use your workspace content to advertise to your customers.

Contract

We process data when necessary to provide NivaDesk to you, manage your account, process payments, and deliver features you request.

Legitimate interests

We may process data for our legitimate business interests, including improving NivaDesk, preventing misuse, securing our services, responding to support requests, and understanding product usage.

Consent

We may rely on consent for optional features, marketing emails, cookies that are not strictly necessary, or certain third-party integrations.

Legal obligation

We may process data when required to comply with law, tax, accounting, security, fraud prevention, or regulatory obligations.

We do not claim ownership of your uploaded content. You retain all rights to the content you upload, subject to the rights you grant us to operate and provide the service.

Client Files and cloud-stored message attachments require an active eligible paid plan to open, preview, download, upload, rename, or delete them through the app. If eligible paid access ends, those files may be retained for up to 90 days so access can be restored if the workspace resubscribes during that period; after the retention period they may be deleted.

7.1 Your customers' WhatsApp messages (customer inbox)

If your workspace connects a WhatsApp Business number, NivaDesk receives the messages your customers send to that number and keeps the replies your team sends from NivaDesk, so that your team can read and answer them in the customer inbox. For these messages your business is the controller, and NivaDesk processes them on your behalf.

Messages travel through the WhatsApp Business Platform, which is operated by Meta. Meta processes messages and files, and may keep its own copies of them, under Meta's own terms and policies. NivaDesk cannot delete copies held by Meta: deleting a message or a conversation in NivaDesk removes it from NivaDesk only.

How long NivaDesk keeps them:

• customer messages and your team's replies are deleted from NivaDesk automatically 90 days after they arrive, and a conversation is deleted with everything in it once its most recent message is 90 days old;
• a photo or PDF a customer sends is copied into NivaDesk only when a member of your team opens it, and that copy is deleted 30 days after the customer sent the file;
• a workspace owner can delete a customer's conversation at any time, which removes it from NivaDesk straight away;
• deleted messages can remain in NivaDesk's database backups for up to 14 days, and deleted file copies can remain recoverable in our cloud storage for up to 7 days, until each of these expires;
• your customer's phone number is not stored in readable form with their messages: the inbox shows only its last four digits, and the full number is kept encrypted only while a reply can still be sent (about a day after their last message).

7.2 Your customers' Instagram messages (customer inbox)

If your workspace connects an Instagram professional account, NivaDesk receives the Direct messages your customers send to that account and keeps the replies your team sends from NivaDesk, so that your team can read and answer them in the customer inbox. For these messages your business is the controller, and NivaDesk processes them on your behalf.

To connect the account you sign in with Instagram and allow NivaDesk to read the account's basic profile (its ID and username) and to manage its messages. NivaDesk keeps the account's ID and username, and an access token that lets it receive and send the account's messages. The token is stored encrypted and renewed automatically while the account stays connected. Disconnecting the account in Settings → Customer Channels deletes the token and the connection straight away; conversations already in the inbox stay until they are deleted as described below. If you remove NivaDesk in your Instagram account's settings instead, Instagram sends NivaDesk a data deletion request, and NivaDesk deletes the token, the connection and that account's customer conversations from NivaDesk.

Messages travel through Instagram, which is operated by Meta. Meta processes messages, and may keep its own copies of them, under Meta's own terms and policies. NivaDesk cannot delete copies held by Meta: deleting a message or a conversation in NivaDesk removes it from NivaDesk only.

What NivaDesk keeps, and for how long:

• customer messages and your team's replies are deleted from NivaDesk automatically 90 days after they arrive, and a conversation is deleted with everything in it once its most recent message is 90 days old;
• a workspace owner can delete a customer's conversation at any time, which removes it from NivaDesk straight away;
• deleted messages can remain in NivaDesk's database backups for up to 14 days, until these expire;
• photos and other attachments sent on Instagram are not stored in NivaDesk: a message with words keeps only its words, and a message that is only an attachment is not kept;
• your customer's Instagram account ID is not stored in readable form with their messages: the inbox shows only a short label, and the ID is kept encrypted only while a reply can still be sent (about a day after their last message);
• NivaDesk's AI features do not read the customer inbox: nothing in it is sent to an AI model by NivaDesk.

7.3 Your Amazon orders (Amazon seller connection)

Availability. The Amazon seller connection is not open to customers yet: Amazon has not yet published NivaDesk's Selling Partner application, so a seller cannot complete Amazon's consent page, and NivaDesk receives no data from Amazon about any customer. When it opens, it will cover these Amazon marketplaces: the United Kingdom, Germany, France, Italy, Spain, the Netherlands, Sweden, Poland, Turkey, the United Arab Emirates and India. Amazon serves all of them through the endpoint of its Selling Partner API that it calls the "Europe" region; that name is Amazon's technical grouping of marketplaces, not a statement about where your data is processed, which is described below. The rest of this section describes what happens once a workspace connects an account.

If your workspace connects an Amazon seller account, NivaDesk reads that account's orders through Amazon's Selling Partner API so that they appear as orders in your workspace. You give this permission on Amazon's own consent page. NivaDesk then holds a refresh token for the account, which it uses only to read orders. The token and everything else NivaDesk receives from Amazon are handled in a dedicated system that runs in London (Google Cloud region europe-west2), the same region as the rest of NivaDesk, but separate from it.

NivaDesk does not accept personal data about your buyers from Amazon. Buyer names, delivery addresses, e-mail addresses, phone numbers and tax identifiers are refused at the boundary of that dedicated system: they are not stored there, not sent on to your workspace and not shown anywhere in NivaDesk. Any field that system has not been told is safe is refused too, and an order that cannot be read without such a field is left out rather than stored. What travels is the order itself: Amazon's order number, dates, status, totals, delivery service level, marketplace, and for each item its title, SKU, ASIN, quantities and prices.

What NivaDesk keeps, and for how long:

• a connection record (your Amazon seller ID, the marketplaces you chose, the dates of connection and of the last sync) and the refresh token, for as long as the connection is active;
• a copy of each order in the dedicated system, kept for 90 days after NivaDesk last updated it from Amazon. An automatic job runs every 30 minutes and deletes a limited number of copies that have passed the 90 days each time it runs; copies it has not reached yet, or that a failed run did not delete, are deleted by the following runs. The dedicated system keeps no backups of these copies;
• the order created in your workspace, which is your record like any other order: it stays until you delete it and follows section 17;
• technical logs of the dedicated system (request times, document paths that include Amazon order numbers, your seller ID in connection events, and error codes) kept for up to 400 days for security and audit; they never contain buyer data or tokens.

Disconnecting the account. When you disconnect the account in Settings, NivaDesk marks the connection as disconnected straight away and every sync stops: no further request is made to Amazon on your behalf, and nothing more is stored or sent to your workspace, including an order that was being read at that moment. NivaDesk then destroys the refresh token and deletes the order copies held in the dedicated system; if either step fails, it is retried automatically until it is done. Orders already created in your workspace are not deleted by disconnecting: delete them in your workspace if you no longer want them. A connection you make later is a new connection and is not affected by this cleanup. Amazon's own records of your orders are Amazon's, under Amazon's terms, and NivaDesk cannot delete them.

7.4 Your own Google Calendar and Outlook calendar (read only)

Availability. This connection is being tried out with a small number of named people at EGGcraft before it is offered to other workspaces; it is not open to customers yet.

If you choose to connect your own Google Calendar or Microsoft Outlook calendar, NivaDesk reads the meetings in the calendars you pick so that they appear in your own NivaDesk calendar. You give this permission on Google's or Microsoft's own consent page. NivaDesk asks only for read-only access: with Google, to see the list of your calendars and to see their events; with Microsoft, to read your calendars and to keep that access while you stay connected. NivaDesk does not read your e-mail and never creates, changes or deletes anything in your Google or Microsoft calendar.

Who sees them. The meetings NivaDesk reads are shown only to you, in your own NivaDesk calendar. Your workspace owner, administrators and other members cannot see them; they are not turned into tasks, orders or other workspace records, and they are not shared with other workspaces. NivaDesk's AI features and its connections for AI assistants do not read them.

What NivaDesk keeps, and for how long:

• a connection record (the account e-mail address the provider shows, the calendars you chose, and the time of the last sync), for as long as the connection exists;
• an access token and a refresh token, stored encrypted and readable only by NivaDesk's servers, for as long as the connection exists;
• a copy of each meeting in the calendars you chose that falls between 30 days ago and 180 days ahead: its title, time, place, video-call link and a link back to the meeting at Google or Microsoft. Copies are refreshed when you open your calendar and otherwise about every 30 minutes; a meeting that is changed, cancelled or deleted at the provider, or that leaves that period, is updated or removed at the next sync;
• deleted copies can remain in NivaDesk's database backups for up to 14 days, until these expire.

Disconnecting. You can disconnect at any time from the calendar ('Your other calendars'). NivaDesk then deletes the connection record, the tokens and every copy of your meetings, and asks Google to withdraw NivaDesk's access; with Microsoft you can also remove NivaDesk from your account's app permissions. Nothing in your Google or Microsoft calendar is changed. If you leave a workspace or your access is suspended, NivaDesk removes the connection and its copies at the next sync.

Google user data. NivaDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. NivaDesk uses this information only to show you your own meetings: it does not use it for advertising, does not sell it, does not use it to develop or train AI models, and people at NivaDesk do not read it unless you ask us to, for security, or where the law requires it.

If you add another user to a workspace, you confirm that you have permission to provide their email address or other relevant information.

10.1 What NivaDesk receives through an assistant connection

• the requests the assistant makes on your behalf: which tool, and the details it sends with it;
• connection data: which assistant registered with us (its name and return addresses), which NivaDesk account and workspace you connected, and when the connection was made, renewed, expires or was ended;
• technical request data, such as time, IP address and user agent, for security and troubleshooting.

NivaDesk has no access to your conversation with the assistant, the assistant's memory or chat history, or the files you keep in the assistant. The one exception is a file you hand to a NivaDesk tool yourself: when you ask ChatGPT to attach a receipt, ChatGPT gives NivaDesk a link to that one file and NivaDesk downloads it, as described in section 10.1.1.

Text you write in the conversation can still reach NivaDesk when the assistant puts it into a request: for example the words you search for, the fields of an order you ask it to create, the text of a note, or a status to set. NivaDesk receives that text as part of the request and stores it only where the tool saves it, for example in the order or note you asked for.

10.1.1 Receipts and other files

ChatGPT: when you share a receipt or invoice in ChatGPT and ask it to attach it to a bank transaction, ChatGPT gives NivaDesk a link to that file, with its name and type. NivaDesk downloads the file from that link (HTTPS only, public internet addresses only, no redirects, up to 15 MB; images, PDF, HTML or plain text) and stores it in your workspace's private receipt storage, where it goes through the same malware scan as other uploads. Image receipts are read with Google Cloud Vision to find the amount, date and merchant; ChatGPT may also send the amount, date and merchant it read from the document. If one transaction clearly matches, the file is attached to it; otherwise it waits in the workspace's receipt inbox until a transaction is chosen, and a file from which nothing can be read is deleted. Only the workspace owner can do this.

Claude: the receipt tool does not move a file from Claude to NivaDesk. When you ask Claude to attach a receipt, NivaDesk gives Claude only a single-use link to a NivaDesk page, valid for 15 minutes. You open it while signed in as the workspace owner and upload the file yourself on NivaDesk's Bank page, through NivaDesk's normal upload checks. Claude receives the link; the file goes from your device to NivaDesk, not through Claude.

10.2 What the assistant receives, and who handles it

When the assistant calls a tool, NivaDesk returns the result to it: the workspace data you asked about and are allowed to see. Depending on the tool, this can include order details, your customers' names and contact details, notes, workflow status, due dates, inventory, financial figures and bank transactions.

Those results become part of your conversation with the assistant and are handled by its provider, OpenAI for ChatGPT or Anthropic for Claude, under your agreement with that provider and its privacy policy (OpenAI: https://openai.com/policies/privacy-policy; Anthropic: https://www.anthropic.com/legal/privacy). The provider is a service you choose and connect; it is not a NivaDesk subprocessor, and we do not control how it stores or uses your conversations.

If your workspace holds personal data of your own customers, connecting an assistant is an instruction from you to us to send the data you request to that assistant. Some marketplaces do not allow their buyers' personal data to be shared with assistants; NivaDesk withholds that data from assistant results.

10.3 How long we keep it

• a connection stays active until it is disconnected. Each access key lasts 30 days; an assistant that registers for renewal (Claude does) can renew it in the background with a renewal key that is valid for 90 days and replaced at every renewal, so a connection that is not used for 90 days ends. A connection whose assistant does not renew ends when its 30-day access key expires. A connection also ends when its user loses access to the workspace;
• records of a connection's keys: we store a fingerprint of each key, never the key itself, together with what is needed to check it: your NivaDesk account ID (not your e-mail address), the workspace, the assistant and its return address, the permissions granted, and when the key was issued, expires, was used or was ended (and, if it was ended, by which account). The record of an access key is kept until that key expires (at most 30 days after it was issued), also after a renewal has replaced it, and the record of an unused renewal key until it expires (at most 90 days). Once a renewal key or a sign-in code has been used, we keep only its fingerprint, the connection it belongs to and when it was used or ended, for as long as that connection can still be renewed, so that if it is presented again we can recognise it and end the connection; a sign-in code that is never used (it is valid for 10 minutes) is kept for one day after it expires. When a connection ends because it is disconnected, replaced by a new connection of the same assistant app, or ended by us for security reasons or because its user no longer has access to the workspace, all of its records are marked for deletion at that moment; when a connection simply stops being used, they are marked for deletion when its last key expires. Marked records can no longer be used and are removed by our database's automatic deletion, usually within a day of being marked (our database provider does not guarantee an exact time), and may remain in backups for a limited time (section 17). When you delete your NivaDesk account, the records of your assistant connections, and of the connections to the workspace deleted with your account, are deleted as part of the deletion. In NivaDesk, the e-mail address shown next to a connection is read from the workspace's member list when it is shown, not from these records;
• orders, notes and receipts created through an assistant are workspace content and are kept like any other workspace content (section 17); a receipt that is waiting in the receipt inbox stays there until it is attached or deleted;
• a record of which assistant tool read personal data, by which account and when (without the data returned) is kept with the workspace's other access records and is deleted with the workspace; there is no fixed deletion period before that;
• request logs of our cloud functions, including those that serve assistant connections, are kept for 30 days; our website host may also keep standard access logs for the assistant addresses on nivadesk.app, under its own retention.

10.4 How to stop it

You can disconnect NivaDesk in the assistant's own settings at any time. In NivaDesk, the workspace owner sees every assistant connection to the workspace under Settings › Integrations, on the ChatGPT card and on the Claude card (Claude and Claude Code), each with the member who made it, and can end a single connection or all of that assistant's connections; ending one does not affect the others, and it stops working immediately. Other members end their own connections in the assistant's settings or ask the workspace owner. Once your NivaDesk account is deleted, an assistant connection can no longer reach any workspace.

We do not sell data received through an assistant connection or use it to advertise to you or your customers. Questions about assistant connections can be sent to contact@nivadesk.co.uk.

Some cookies are necessary for the service to work. Others, such as analytics or marketing cookies, may depend on your consent where required by law.

You can manage cookies through your browser settings. Disabling some cookies may affect the functionality of our website or app.

Bot protection (reCAPTCHA and App Check)

To protect sign-up, sign-in and our APIs from automated abuse, our website and apps use Google reCAPTCHA and Firebase App Check. These services may set cookies and collect device, browser and usage information, which is sent to Google to tell genuine users apart from bots and other automated traffic.

Your use of reCAPTCHA is subject to the Google Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms). We rely on our legitimate interest in keeping the service secure and preventing fraud and abuse.

We only provide service providers with the information they need to perform their services for us.

However, no system is completely secure. We cannot guarantee that personal data will always remain completely secure, but we work to protect it and respond appropriately if a security issue occurs.

If you delete your account or request deletion, we will delete or anonymise personal data unless we need to keep it for legal, security, accounting, dispute resolution, or legitimate business reasons.

If you are in the UK, you can contact the Information Commissioner's Office at ico.org.uk.

To exercise your rights, contact us at: contact@nivadesk.co.uk

We may ask for information to verify your identity before responding to a request.