Privacy Policy

1. Information We Collect

We collect information that you provide directly, information created through your use of the Service, and information from the businesses that use Desk to serve their own customers. Depending on how you interact with the Service, this may include:

• Contact and identity information — your name, email address, and phone number.
• Appointment details — services booked, dates and times, the business you are booking with, and related notes.
• Payment information — payments are processed by Stripe. Desk does not store full card numbers; we receive limited transaction details (such as amount, status, and the last four digits of a card) needed to manage bookings and records.
• Subscription and purchase information — for business users who buy a Desk Pro subscription or SMS credit packs, Stripe processes the payment and Desk keeps the related billing records: subscription plan and status, seat count, renewal dates, purchased credit balances, and a Stripe customer reference. Desk does not store the card itself.
• Account information — for business users, login credentials, business name, and service configuration.
• Usage and device information — basic technical data such as IP address, browser type, device model, operating system, app version, language, pages or screens viewed, and app interactions. Mobile app analytics also uses an app-installation identifier and approximate location derived from IP addresses, as explained below.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Understand how the website and mobile apps are used, measure engagement and feature adoption, and improve the Service;
• Schedule, confirm, change, and remind you about appointments;
• Process payments through our payment processor, Stripe, including Desk Pro subscriptions and SMS credit purchases billed by Desk;
• Send transactional communications, including appointment confirmations and reminders, booking updates and cancellation or reschedule notices, invoice notifications, secure payment links, and customer support messages by SMS and email;
• Maintain client records and history for the businesses you book with;
• Secure the Service, prevent fraud and abuse, and comply with legal obligations.

3. SMS Messaging

Desk uses SMS text messaging to support appointments, booking updates, invoices, secure payment links, and customer support communications. This section describes the data involved and how we handle SMS communications.

Information collected for SMS

To send text messages, we collect and use your name, email address, phone number, appointment details, and invoice or payment-related details when applicable (such as the service, date, time, business, and invoice status associated with your booking). Stripe processes payment card details; Desk does not store full card numbers.

How we use phone numbers and SMS

We use your phone number to send transactional, service-related SMS messages, including appointment confirmations, appointment reminders, booking updates, cancellation or reschedule notices, invoice notifications, secure payment links, and customer support messages. Payment links may be sent by SMS when you have requested or agreed to receive service-related messages from a business using Desk. We send these messages only to support the appointments, payments, and customer service connected to that business.

Message frequency and rates

Message frequency varies based on your service activity. Message and data rates may apply according to the terms of your mobile carrier. Desk does not charge you for receiving SMS messages.

Opting out and getting help

You can opt out at any time by replying STOP to any message. After you reply STOP, we will stop sending SMS messages to that number, except for a single confirmation that you have been unsubscribed. You can reply HELP at any time to receive help and support information, or contact us at support@deskapp.pro.

How we share SMS information

SMS consent and mobile information are not shared, sold, rented, or traded with third parties or affiliates for marketing or promotional purposes. We share your phone number only with the service providers that help us deliver messages (such as our SMS provider) and only as needed to send the service-related messages described above.

Consent is not a condition of purchase

Consent to receive SMS messages is not a condition of any purchase or of using the Service. You may use Desk and book appointments without agreeing to receive text messages.

4. Cookies, Local Storage, and Analytics

Our website uses first-party cookies necessary for the Service to work or to remember a choice you made, and optional Google Analytics cookies that you can disable in Cookie settings. We use Google first-party advertising measurement cookies for US visits, and do not use remarketing or advertising personalization. On public marketing pages, we use Vercel Web Analytics and Speed Insights to understand visits, referral sources, download-button clicks, demo interactions, and page performance. These tools do not use analytics cookies. We exclude the account dashboard, sign-in, and customer booking pages from this collection; we do not send client records, form values, or authentication tokens. Only supported campaign tags are retained in Vercel analytics URLs. We honor browser Do Not Track and Global Privacy Control signals for these tools.

Google Analytics 4 loads by default on public website pages. Storage and advertising measurement are enabled by default only for US visits; elsewhere the tag uses a denied-storage, cookieless mode. You can turn it off using Cookie settings in the footer. It measures public page visits, referral sources, download-button clicks, and interactions with our sample demo. It uses cookies such as _ga and _ga_… to distinguish browsers and sessions, and processes browser and device information. We configure analytics cookies to expire after 180 days without extending that lifetime on each visit. Google first-party cookies such as _gcl_… may preserve an ad click across public pages in the US. Google may process click identifiers and conversion data to measure and optimize our Google Ads campaigns. Outside the US, advertising storage and advertising user data are denied, and Google redacts ad data in denied-storage mode. We disable Google signals and advertising personalization. We exclude sign-in, account dashboards, payments, and customer booking pages; we do not send client records, form values, or authentication tokens. Measured page URLs retain only validated campaign tags and Google advertising click identifiers (GCLID, WBRAID, GBRAID), and referral URLs are reduced to their origin. You can reject or withdraw consent using Cookie settings in the footer. Opting out stops further Google Analytics collection and removes its accessible first-party analytics and advertising measurement cookies from this site.

• Authentication (sb-…-auth-token) — keeps business users signed in and their session secure. Set only after you sign in.
• Selected business (desk_business) — remembers which business a signed-in user is working in when their account has more than one.
• Language (desk_lang) — remembers the language you choose on a business’s booking page, so your next visit opens in it. If you have not chosen one, the page follows your browser’s language setting and stores nothing.

We also use your browser’s local storage for display preferences such as light or dark theme and calendar view options. These stay on your device and are not sent to us. We also remember your website analytics choice in local storage for up to 180 days.

When website Google Analytics is enabled, we use session storage to remember the ID, language, and view time of the last measured blog article in the current tab. This lets us attribute a store-link click through the homepage or demo to that article for 30 minutes after its view. Clicks do not extend this window. Expired entries are removed when checked; closing the tab ends session storage. Rejecting analytics or a Do Not Track / Global Privacy Control signal clears this context.

You can delete or block cookies in your browser settings. Blocking the cookies above will not stop you from browsing, but signing in and staying signed in will not work without the authentication cookie.

We do not sell or share personal information for cross-context behavioral advertising or use these tools to serve targeted ads. On the website, Do Not Track and Global Privacy Control signals disable our website Google Analytics, Vercel analytics, and performance collection. These browser signals do not control analytics inside the Desk mobile apps.

Mobile app analytics

The Desk iOS and Android apps use Google Analytics for Firebase, provided by Google, to measure app usage and improve the product. The SDK sends usage events and technical information to Google, including an identifier assigned to an installation of the app, device and app characteristics, event times, sessions, and engagement. Google derives approximate location, such as a country or city, from masked IP addresses. Firebase Analytics does not use your device’s GPS or request location permission for this purpose.

Our app events record successful sign-ins, accepted registration requests, creation of businesses, clients, services and appointments, and views of the main tabs. These events describe that an action occurred; they do not include customer names, email addresses, phone numbers, client or business record identifiers, appointment notes, message contents, passwords, or payment card details. We do not send your Desk account identifier to Firebase Analytics. Usage events are associated with an app installation, so they are not anonymous data.

Firebase can also measure purchases and subscriptions made through supported app-store purchase flows, including product identifiers and prices when such flows are used. This does not send payment card details or customer appointment records to Firebase Analytics.

We configure mobile analytics without advertising-ID collection, ad-personalization signals, or cross-app advertising tracking. We use the reports for product analytics. For information about Google’s processing, see How Google uses information from sites or apps that use its services.

Analytics collection starts automatically in app versions that include this integration. The current mobile apps do not include an in-app analytics opt-out. Browser cookie controls and SMS opt-outs do not disable mobile analytics. Contact privacy@deskapp.pro with questions or to exercise applicable privacy rights. This notice does not replace any separate consent required by applicable law.

5. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

• With the business you book with — when you book an appointment, your booking details are shared with that business so it can provide the service.
• With service providers — including Stripe (payment processing), our SMS provider (message delivery), Vercel (website hosting, analytics, and performance measurement), and Google (website Google Analytics and Firebase mobile app analytics). We disclose information needed for these services under applicable contractual terms. Our custom mobile analytics events do not include SMS consent or phone numbers.
• For legal reasons — when required to comply with applicable law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Desk, our users, or others.
• In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

As noted above, mobile information and SMS consent are never shared with third parties for marketing purposes.

6. Data Retention

We retain personal information for as long as needed to provide the Service, maintain appointment and payment records, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we take reasonable steps to delete or de-identify it.

Analytics data is subject to the retention settings of the analytics service; aggregated reports may remain after individual event data expires. Deleting your Desk account does not automatically identify and delete Firebase usage events, because we do not associate them with your Desk account ID. We will explain the information needed to locate relevant records when handling a privacy request.

Desk and its service providers may process information in the United States and other countries where they operate. Those countries may have different data-protection laws. Applicable safeguards for international transfers are governed by law and our arrangements with the relevant service providers.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and access controls. Payment card data is handled by Stripe, a PCI-DSS compliant processor. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Choices and Rights

You may, subject to applicable law:

• Access, correct, or update your personal information;
• Request deletion of your personal information;
• Opt out of SMS messages at any time by replying STOP;
• Unsubscribe from non-essential email communications.

To exercise any of these rights, contact us at privacy@deskapp.pro. We will respond within the timeframe required by applicable law.

9. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Where a change requires consent under applicable law, an update to this Policy alone does not constitute that consent.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact:

Desk App, LLC
17233 15th Ave NE
Shoreline, WA 98155
United States
Phone: +1 (512) 228-1725
Email: privacy@deskapp.pro