Privacy Policy

Last updated: October 9, 2026

NoDesk ("we", "us", "our") operates the nodesk.io platform and the NoDesk mobile app. This policy describes how we collect, use, and protect your information.

Information We Collect

When you use NoDesk, we may collect:

• Account information: Your email address, plus your name and company name if you provide them. The mobile app signs you in with a one-time code sent to that email address.
• Subscription records: If you subscribe in the mobile app, Apple processes the payment. We receive the purchase details Apple provides to app developers: the product, transaction identifiers, purchase and expiry dates, and renewal status. We do not receive your card number or your Apple Account sign-in details. If you subscribe on our website, Stripe processes the payment and we receive a payment record without your full card number.
• Push notification tokens: If you allow notifications, we store the device token Apple issues to your app so we can tell you when your agent has replied or needs you.
• OAuth/API tokens: Access, refresh, or API tokens from connected services (Jobber, QuickBooks Online, GoHighLevel, Google, Facebook, BoldTrail, Podio, Clover, and GitHub). These are encrypted at rest and used solely to operate your AI agent.
• Messages and attachments: The messages you send to your agent and its replies, plus any photos, files, or voice notes you attach. These are stored on your own dedicated agent server so your agent can keep context between conversations. Voice notes are transcribed so your agent can act on them.
• Usage data: Logs of webhook events, OAuth connections, and agent activity for troubleshooting and audit purposes.

Our mobile app asks for microphone, camera, and photo library access only when you choose to record a voice note or attach an image. Those permissions are optional, the app works without them, and nothing is captured in the background.

We do not use your data for advertising, and we do not track you across other companies' apps or websites.

How We Use Your Information

• To authenticate and maintain connections to your third-party accounts.
• To operate your NoDesk AI agent on your behalf.
• To troubleshoot issues and improve our service.
• To confirm that your subscription is active and provide the service you paid for.
• To communicate with you about your account.

Third-Party Services

AI and Voice Processing

To answer requests and perform the work you ask for, your agent sends your messages, relevant conversation history, attachments, and relevant information retrieved from connected services to its configured AI provider. NoDesk supports OpenAI and xAI connections. Your selected model and connected provider determine which service processes a request.

Voice features have separate processing routes. Recorded audio may be sent to the configured transcription provider, including Groq, OpenAI, xAI, Mistral AI, or ElevenLabs. Text selected for spoken playback may be sent to the configured speech provider, including Microsoft (Edge speech), OpenAI, xAI, or ElevenLabs. A locally configured transcription engine may instead process audio on your agent server. Custom provider configurations can have other recipients; verify their processing arrangements before using them.

The mobile app's AI data-sharing disclosure identifies the processors it can verify before requesting permission. Withdrawing that permission stops new sharing initiated from that app on that device. It does not recall data already sent, cancel agent work already accepted or independently scheduled, or change permissions on other devices. Disconnect services and stop scheduled work separately when needed.

Integration Processing

Composio provides the connection and tool-routing service for some integrations, including Gmail. Requests, relevant service data, and associated connection information pass through Composio for those integrations. Other integrations use direct provider connections. Information needed to carry out an action you request may be sent to the connected service as well as the configured AI provider. Only connect accounts and share information you are authorized to use.

We integrate with the following services. When you connect an account, we access only the data scopes you authorize:

• Jobber, field service management data (jobs, clients, invoices).
• QuickBooks Online, accounting data (invoices, payments, customers).
• GoHighLevel, CRM data (contacts, conversations, opportunities, calendars).
• Google, Gmail and Google Calendar data.
• Facebook, lead ads data and page management.
• BoldTrail, real estate CRM lead/contact data when authorized or token-connected.
• Podio, CRM and project records across your authorized apps.
• Clover, point-of-sale orders, inventory, and customer data.
• GitHub, repository contents and deployments via the NoDesk GitHub App.

Payments and Infrastructure

These companies process data for us so the service can run:

• Apple, in-app subscription purchases and delivery of push notifications to your device.
• Stripe, payments for subscriptions bought on our website.
• Hetzner, hosting for your dedicated agent server.
• Railway, hosting for the NoDesk account service.
• Resend, delivery of sign-in codes and account email.

We do not sell your data to third parties.

Data Security

Connection credentials are encrypted using industry-standard encryption before storage. This covers both OAuth tokens and any API token you supply. We use HTTPS for all data transmission. Access to production systems is restricted and audited.

Data Retention

We retain the data described above until your account is deleted. We do not currently run an automated retention schedule or purge job, so data is not removed on a timer.

Disconnecting an integration in your connection portal disables it: NoDesk stops using that connection and stops sending its credentials to your agent. Disconnecting does not revoke NoDesk's access at the provider, and does not by itself erase the stored connection record. To revoke NoDesk's access at the provider, use that provider's own controls. See our data deletion page for the per-provider steps. Account deletion removes the stored connection records along with the rest of your account data.

Your Rights

• Disconnect any integration at any time through your connection portal.
• Contact support@nodesk.io with questions about the personal data associated with your account.
• Request deletion of your account and all associated data. Account deletion removes your client record, connected-integration credentials, agent records, access links, audit history, and any leads captured for you. Narrow exceptions: our Stripe payment records are retained with your account identifier removed, so a past payment cannot be re-processed against a deleted account; a minimal record of Apple subscription purchases is retained so a past purchase cannot be attached to a different account; and ordinary server request and application logs, plus audit entries not linked to any one account, are retained under our hosting provider's log-retention policy rather than being deleted per-account.

Data Deletion

You can request deletion of your account from inside the mobile app. We email you a code to confirm the request. You can also email support@nodesk.io or visit our data deletion page. Once a request is confirmed, our support team carries out the removal as an operator procedure rather than an automated pipeline, and confirms completion with you by email.

Deleting your NoDesk account does not cancel a subscription bought through Apple. Cancel it in your Apple Account subscription settings so you are not charged again.

Contact

For questions about this policy, contact us at support@nodesk.io.

Changes

We may update this policy from time to time. Changes will be posted on this page with the updated date.