Privacy Policy

Last updated: March 2026

This Privacy Policy explains how CommDesk ("we", "us", "our") collects, uses, and protects your personal data when you use CommDesk ("the Service"). We are committed to protecting your privacy and complying with applicable data protection laws including GDPR.

1. Data We Collect

Data	Why we collect it	Legal basis
Email address & password hash	Account authentication	Contract
Contact records you enter	Core CRM functionality	Contract
Deal and discussion records	Core CRM functionality	Contract
Communication logs	Activity history in the app	Contract
Subscription & billing status	Access control for paid features	Contract

We do not collect payment information directly. Payments and billing are handled by Lemon Squeezy (a Merchant of Record), who process your card details and issue receipts under their own privacy policy. CommDesk only receives your subscription status (active/inactive) and email address from Lemon Squeezy.

2. How We Use Your Data

To provide and maintain the Service
To authenticate your account and keep it secure
To diagnose and fix technical errors
To send important service notifications (no marketing without consent)

3. Data Storage & Security

Your data is stored on Supabase (PostgreSQL), hosted on AWS infrastructure in the Mumbai, India (ap-south-1) region.
All data is encrypted in transit (TLS) and at rest (AES-256).
Access to your data is restricted by Row-Level Security policies — no other user or workspace can access your records.
We do not store your data on any other servers.

4. Data Sharing

We do not sell your data. We share it only with the following sub-processors:

Sub-processor	Purpose	Location
Supabase	Database & authentication	India (Mumbai)
Cloudflare	Hosting & CDN	Global
Lemon Squeezy	Payment processing & billing (Merchant of Record)	US
Anthropic	Business card scanning (optional feature)	US

5. Your Rights (GDPR)

If you are in the EEA, UK, or Switzerland, you have the following rights:

Right of access — export all your data from Settings → Account → Export all my data
Right to erasure — delete your account and all data from Settings → Account → Delete my account
Right to portability — your data export is in JSON format, machine-readable
Right to rectification — edit your data directly in the app at any time
Right to object — contact us at support@commdesk.app

6. Data Retention

Your data is retained for as long as your account is active. When you delete your account, all data is permanently removed within 24 hours. We do not keep backups of deleted accounts beyond 7 days.

7. Cookies

CommDesk uses only essential cookies required for authentication (Supabase session tokens). We do not use advertising or tracking cookies. No cookie consent banner is required for essential cookies under GDPR.

8. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect data from children.

9. Changes to This Policy

We may update this policy. Material changes will be notified by email or in-app. The date at the top of this page reflects the latest revision.

10. Contact & Data Controller

CommDesk is operated as an independent software service. For privacy questions or to exercise your rights:
support@commdesk.app
We aim to respond within 2 business days.