איפה השיחות שלכם נמצאות, ומי יכול להגיע אליהן

What this covers

This policy covers the DutyDesk service, the DutyDesk Desktop and DutyDesk Planner applications, and this website. The two applications work differently, and each has a section of its own below.

For the conversations, customer records, filled-in forms, ratings and staff roster in a workspace, the business that owns the workspace decides what is collected and why, and we handle that data on its behalf. For the accounts of the people who sign in, for billing and for this website, we decide, and this policy says how.

The service drives a WhatsApp account through an interface that is not the official WhatsApp Business API. That is your decision and your responsibility, and the terms of service describe it.

DutyDesk Cloud: what we hold

Your workspace lives in a database on a server of ours in Google Cloud’s me-west1 region — Tel Aviv — and nowhere else. The database cannot be reached from the internet except through the service itself.

• The content of messages sent and received, and the conversations themselves
• Contacts and customer records: names, phone numbers, notes, tags, stages, your own fields and appointments — and who asked to be taken off your list, with the word they sent
• Forms and what customers filled in on them: the answers, a signature or photos if the form asks for them, and the questions as they were asked
• Review requests: when each was sent and opened, whether the Google button was pressed, and the rating and comment if the customer left them
• The staff roster: each person’s name, phone number and position, their shifts and answers, and the messages that told them
• Payments on appointments: what was marked on each (“Deposit asked” or “Paid”), and if you connected an accounting service (Morning, iCount, Invoice4U or Keep), the amount, the method, the day, and the receipt’s number and link
• Rules, flows, campaigns and any files attached to them
• The WhatsApp sign-in and every connection token — sealed with AES-256-GCM, under a key that belongs to the workspace alone, before they are written down
• Your team: names, email addresses and roles; passwords only as a scrypt hash, and sign-ins only as a hash
• Usage and billing counters, and an activity log of who connected, changed or deleted what, and from which IP address

The channels you connect

Your Google data

If you connect a Google Calendar to DutyDesk Cloud, it asks Google for three calendar permissions and no more: permission to see whether a given time is taken (calendar.events.freebusy), permission to read the list of your calendars and nothing else (calendar.calendarlist.readonly), and permission to create, change and cancel events on calendars you own (calendar.events.owned), so that the appointments booked in DutyDesk can appear in your calendar. Alongside those it asks for your account’s email address, so the screen can tell you which account is connected.

We deliberately do not ask for the broad calendar permission, nor for any permission to read your events, and DutyDesk Cloud never reads the contents of your events. It writes to your calendar only if you choose a calendar for appointments, only into that one calendar, and only the events it made itself. The permission to write reaches only calendars you own — not ones other people have shared with you. You can also leave that permission unticked on Google’s screen; the calendar is then read and never written to. DutyDesk Desktop asks for the same permissions but keeps everything on your computer; the next section covers it.

Your Google data in DutyDesk Desktop

DutyDesk Desktop can put the appointments it books straight into your Google Calendar. If you connect one, the app asks Google for the same three permissions as the cloud: free/busy (calendar.events.freebusy), the list of your calendars (calendar.calendarlist.readonly), and permission to create, change and cancel events on calendars you own (calendar.events.owned). Alongside those it asks for your account’s email address, so the screen can tell you which account is connected.

All of this happens on your computer. The app talks to Google directly: nothing from your calendar passes through our servers or is stored by us, and the token never reaches us.

We deliberately do not ask for the broad calendar permission, nor for permission to read every event on every calendar you can see. The permission to write reaches only calendars you own — not ones other people have shared with you.

Limited Use

DutyDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your Facebook and Instagram data

Connecting a Facebook Page or an Instagram professional account is not available yet. When it is, this is what will apply.

The service will ask for permission to read the messages your customers send that Page or account and to reply to them, and nothing more. It will not read your posts, your comments, your followers or your insights, it will not fetch your customers’ profiles, and it will never touch your personal profile.

Meta allows a business to reply for 24 hours after a customer writes, and the service will reply automatically only inside that window. It will send no campaigns on Messenger or Instagram.

The access token will be held sealed in our database in the me-west1 region, and the messages in your workspace beside the rest of your conversations. Disconnecting in the dashboard deletes the token on our side and ends access at once. You can also remove DutyDesk in your Facebook account’s Business Integrations settings.

Meta Platform Terms

DutyDesk's use of information received from Meta's APIs will adhere to the Meta Platform Terms and the Messenger Platform policies, including the messaging window described above.

DutyDesk Desktop, the desktop application

DutyDesk Desktop is sold separately from the cloud plans, as a yearly licence for two computers. It runs on your own computer and uses AI keys of your own. Its conversations, contacts, rules and connection details sit in a local database on that computer, which we have no access to and hold no copy of.

What it sends us is a validity check of the product key against the licensing server, every few minutes — the key itself, a one-way hash of the computer’s hardware identifier, and the IP address of the request. When it is activated, and again if the licensing server has no name for the computer or the computer has been renamed, it also sends the computer’s name and operating system, so that the licence’s list of computers can tell them apart. When AI replies are on, the messages to be answered go from your computer to the AI provider whose key you entered, under your own agreement with that provider, and not through us.

The licensing server keeps what it needs to check a licence, and nothing beyond that:

DutyDesk Planner, the Facebook group poster

DutyDesk Planner is sold separately, as a monthly licence for two computers, priced by the Facebook accounts you post from. It runs on your own computer and works your Facebook accounts through Google Chrome on that computer. You sign in to Facebook in Chrome, and your password goes to Facebook, never to Planner. The sign-ins stay in Chrome profiles on that computer. Your accounts’ groups, lists, posts, images, comments and statistics sit in a local database there, which we have no access to and hold no copy of.

What you post, and the replies you write, go from your computer to Facebook under your own account, and Meta’s own policies apply to them. Planner reads the comments on your posts from Facebook in the same way, to show them to you.

What it sends us is a validity check of the licence key against the licensing server — when it starts, at intervals the licensing server sets, after the computer wakes and when you press “Check now” — carrying the key itself, a one-way hash of the computer’s hardware identifier, which product the key is for, and the IP address of the request. At start-up and every six hours it also asks our server whether there is a newer version of the application, and newer page rules, which it uses to find its way around Facebook’s pages. Those are ordinary downloads, and they tell us the IP address of the request and nothing more. Nothing about your Facebook accounts, groups, posts or comments is sent to us, except what you choose to send to a DutyDesk workspace you connect Planner to: for each chat link it makes there, the names of the post and the group it is for, the promotion the post belongs to, and, if you turn it on, the post’s words and whether you marked it sold; and the brief or post you ask the workspace’s AI to write or translate. Comments on your posts are never sent.

The licensing server keeps the same records for a Planner licence as for a DutyDesk Desktop licence, listed above, and which product the licence is for.

When you ask us for help, you choose what to send: the report from “Check-up” in Planner’s settings, or a screenshot. We see only what you send.

Planner’s data is deleted when you delete it: uninstall it, or remove its data folder, which also holds its Chrome profiles and its weekly backups. A backup you saved somewhere else stays with you, and is yours to delete. We cannot do it for you, because we cannot reach the computer.

This website and the dashboard: cookies and analytics

The theme and accessibility choices you make on the website are kept in your own browser and never sent to us. The website’s fonts come from Google Fonts, so Google sees the address of the browser that asks for them. Signing in to the dashboard sets a cookie that keeps you signed in.

Analytics, only if you agree. On the website and in the dashboard we ask whether we may use Google Analytics, a service of Google Ireland Limited, to count visits and see which pages are used, where visitors arrive from (a search or a campaign, for example) and a few steps that matter to us: clicking to start a trial, registering, downloading DutyDesk Desktop, getting in touch, and connecting a channel in the dashboard. Until you agree, nothing is loaded from Google Analytics and nothing is sent to it.

If you agree, Google Analytics sets cookies whose names begin with _ga to tell visits apart, and receives your browser’s IP address, its type and screen size, and the pages you open. It does not receive your name, your email address or anything from your workspace or your conversations, and before anything is sent we strip the parts of a page address that could identify you, such as a password-reset link. Google processes this data for us under its data processing terms, possibly outside Israel, and keeps it for two months. Advertising features and Google signals are off, and we do not share the data with Google for its own purposes.

Your answer is kept for six months in a cookie named dutydesk_consent, shared by the website and the dashboard. Change it any time with “Cookie settings” at the foot of the website or in the dashboard’s account menu. Saying no costs you nothing: everything works exactly the same.

Retention and deletion

Conversations, contacts and everything else in a workspace are kept for as long as the workspace exists; nothing in it expires on its own, except the photos and files customers send, which are deleted 90 days after they arrived and are gone from our storage within a week after that. A workspace whose trial or plan has ended is paused, not emptied.

Forms customers filled in, and the ratings they gave, are kept with their contact, and deleting the contact — or the workspace — deletes them too. The roster keeps its staff and their past shifts until the workspace is deleted, unless an admin deletes a member of staff, which removes them and the shifts they worked at once; someone only taken off the roster stays in its history, with their name and number.

Deleting a workspace: the owner deletes it in Settings, once any plan on it is cancelled. Every channel is disconnected at once, and asking starts a thirty-day clock, at the end of which the workspace — the messages, the contacts, the rules and the files — is erased. Thirty days rather than at once, so that a misread dialog on a Friday is recoverable. Backups already written delete themselves sixty days after they were made.

The first workspace an account opened cannot be deleted from the dashboard. To delete your account together with it, write to us, and we will delete both the same way.

Messages arriving from a channel are held in the processing queue for seven days after they are handled, or thirty if handling failed. Billing records are kept for as long as the law requires them to be kept.

If you use the desktop application, its data is deleted when you delete it: uninstall it, or remove its data folder. We cannot do it for you, because we cannot reach it.

Your rights

You may ask to see the data we hold about you, to correct it, or to have it deleted. Write to the address below and we will answer.

If you are a customer of a business that uses DutyDesk, that business decides about your conversations with it, the forms you filled in for it and the ratings you gave it, and your request is best sent to it. If you write to us instead, we will pass it on to the business and help it answer. To stop its campaigns reaching you, reply with a stop word, such as STOP.

If you work for a business that plans its shifts in DutyDesk, the same goes for your details and your shifts: the business decides about them, and your request is best sent to it.

Changes to this policy

A material change will be published here and the date above will change with it. A change to the Google permissions the service asks for requires you to grant them again, so nothing can widen quietly.

Contact

alphamergers@gmail.com