Introduction

This Privacy Policy governs the processing of personal data in connection with beardesk and the beardesk.ai website (together, the “Service”), which are provided by Beardesk (“we”, “us” or “our”).

Beardesk is the controller of personal data processed in respect of website visitors and account holders, and is the data fiduciary in respect of such data for the purposes of the Digital Personal Data Protection Act, 2023 of India. In respect of conversations received by an account holder from its own clients, Beardesk acts as a processor on that account holder’s instructions, and the account holder remains the controller.

All enquiries, requests and complaints relating to personal data must be addressed to privacy@beardesk.ai. That address also serves as the contact point for grievances under the Digital Personal Data Protection Act, 2023. General enquiries unrelated to personal data may be addressed to support@beardesk.ai.

Scope

This Policy applies to the following categories of individual.

Visitors to the beardesk.ai website, in respect of whom Beardesk processes limited technical data as described below.
Account holders, being the businesses and individuals who subscribe to the Service, and their authorized users.
Clients of account holders, being the individuals who communicate with an account holder through the Service. Where you are such an individual, the account holder determines the purposes and means of processing your conversation, and any request in respect of that conversation should be directed to that account holder in the first instance. Beardesk will assist the account holder in responding.

This Policy does not apply to any third-party website, platform or messaging channel to which the Service connects. The processing of personal data by such third parties is governed by their own terms and privacy notices, and Beardesk accepts no responsibility for it.

Personal data we process

Website visitors

Beardesk processes server log data generated in the ordinary course of serving the website, which may include the Internet Protocol address of the requesting device, the user agent string, the resource requested and the time of the request. Such data is retained for a limited period for the purposes of delivering the website, maintaining its security and investigating misuse.

Where you have consented, the website also processes data collected by analytics and advertising technologies, which is described in the section on cookies and similar technologies below. That data may include the pages you visit, the features you engage with, the paths you take between them and the advertisements that brought you to the website.

Account holders

Identity and contact data, comprising the name, business name and email address supplied on registration, and any further contact details subsequently provided.
Account and configuration data, comprising the settings, connected channels, seat allocations and preferences associated with the account.
Usage data, comprising records of interactions with the Service, feature usage, diagnostic events and error reports, processed to operate, support and improve the Service.
Transaction data, comprising the record of subscriptions purchased, amounts charged, dates of payment and the partial card identifiers supplied to Beardesk by the payment provider. Full payment card numbers are not transmitted to, processed by or stored by Beardesk at any time.
Correspondence, comprising the content of communications between you and Beardesk, retained so that enquiries may be answered and disputes resolved.

Conversations and knowledge base content

The content of messages exchanged between an account holder’s clients and the Service, across each channel the account holder has connected.
Any personal data volunteered by a client within such a message, the categories of which are determined by the client and by the account holder’s own practices.
Metadata associated with a conversation, including channel of origin, timestamps and delivery status.
Knowledge base content supplied or designated by the account holder, including web pages, documents and other material from which the Service derives its responses.

Beardesk does not solicit special categories of personal data within the meaning of Article 9 of the GDPR, nor any equivalent category under applicable law. Where such data is volunteered by a client in the course of a conversation, it is processed as an inseparable part of that conversation and is subject to the same technical and organizational measures as all other conversation content. Account holders are required by the Terms of Service not to solicit personal data they do not require.

Purposes and lawful bases

Beardesk processes personal data only where a lawful basis under Article 6 of the GDPR is available, and only for the purposes set out below. Where the Digital Personal Data Protection Act, 2023 applies, processing is undertaken for the lawful purposes described and, where required, on the basis of consent obtained in accordance with that Act.

To provide, operate and maintain the Service, on the basis that processing is necessary for the performance of the contract between Beardesk and the account holder.
To administer subscriptions and process payments, on the basis that processing is necessary for the performance of that contract.
To provide technical support and to respond to correspondence, on the basis of Beardesk’s legitimate interest in supporting its account holders and in the proper administration of its business.
To secure the Service, to detect, prevent and investigate fraud, abuse and unauthorized access, and to maintain the integrity and availability of the Service, on the basis of Beardesk’s legitimate interest in protecting the Service and its users.
To improve the Service, including by analyzing aggregated usage patterns and diagnostic data, on the basis of Beardesk’s legitimate interest in developing and improving its product.
To comply with legal obligations to which Beardesk is subject, including obligations relating to taxation, accounting and the retention of financial records.
To measure how the website and the Service are used, and to select and measure advertising on this and other websites, on the basis of consent, such consent being withdrawable at any time without detriment.
To send product communications, where and only where the recipient has consented to receive them, such consent being withdrawable at any time without detriment.
To establish, exercise or defend legal claims, on the basis of Beardesk’s legitimate interest in the protection of its legal position.

Beardesk does not sell personal data. Personal data collected by advertising and analytics technologies is shared with, or made accessible to, the parties operating them, and only where you have consented to those categories; that sharing is described in the section on cookies and similar technologies below. Beardesk does not subject any individual to a decision producing legal or similarly significant effects that is based solely on automated processing.

Artificial intelligence and conversation content

The Service generates responses using artificial intelligence models operated by third-party providers. In order to generate a response, the content of the relevant message, together with such part of the account holder’s knowledge base as is material to it, is transmitted to the applicable provider for processing, and the generated response is returned to the Service. Such transmission is necessary for the operation of the Service and constitutes a disclosure to a processor engaged by Beardesk.

Each such provider is engaged under written terms which restrict its processing of that content to the generation of the response requested, and which expressly prohibit the use of that content for the training, fine-tuning or improvement of any model. Beardesk undertakes as follows.

Conversation content is not used to train, fine-tune or otherwise develop any model operated by Beardesk.
Conversation content is not used to train, fine-tune or otherwise develop any model operated by any third party.
Conversation content is not sold, licensed, rented or otherwise made available to any person for that person’s own purposes.
Conversation content is not accessed by Beardesk personnel except where strictly necessary to investigate a fault reported by the account holder, to address a security incident, or where access is required by law.
Each access of the kind described above is restricted to authorized personnel and is logged.

Disclosure of personal data

Beardesk discloses personal data only to the categories of recipient set out below, and only to the extent necessary for the purpose stated. Each recipient is engaged under a written agreement imposing obligations of confidentiality and security, restricting processing to Beardesk’s documented instructions, and requiring the return or deletion of personal data on termination of the engagement.

Providers of artificial intelligence model services, for the generation of responses, subject to the restrictions set out above.
Providers of infrastructure, hosting, storage and content delivery services, for the operation of the Service.
Providers of payment and billing services, for the processing of subscriptions and payments and for the discharge of their own legal obligations. Where a payment provider acts as merchant of record, it is the seller in respect of that transaction and processes personal data as a controller in its own right for that purpose.
Providers of transactional communication services, for the delivery of operational messages required by the Service.
Providers of analytics and error monitoring services, for the identification of faults and performance issues.
Professional advisers, including legal, accounting and audit advisers, where necessary for the conduct of Beardesk’s business.
Competent authorities, regulators, courts and law enforcement agencies, where disclosure is required by law or is necessary to establish, exercise or defend legal claims.

In the event of a merger, acquisition, reorganization or sale of assets, personal data may be transferred to the acquiring or successor entity.

International transfers

Beardesk is established in India. The recipients described above operate in a number of jurisdictions, and personal data processed through the Service is accordingly transferred across international borders, including from the European Economic Area, the United Kingdom and India.

Where personal data is transferred from the European Economic Area or the United Kingdom to a jurisdiction not benefiting from an adequacy decision, such transfer is made pursuant to the Standard Contractual Clauses approved by the European Commission, supplemented in respect of United Kingdom transfers by the International Data Transfer Addendum issued by the Information Commissioner. Beardesk assesses the circumstances of each transfer and applies supplementary measures where necessary to ensure a level of protection essentially equivalent to that afforded within the exporting jurisdiction.

A copy of the transfer mechanism relied upon in respect of a particular recipient may be requested by writing to privacy@beardesk.ai.

Retention

Personal data is retained only for so long as is necessary for the purposes for which it was collected, and thereafter in accordance with the periods set out below.

Account data, conversation content and knowledge base content are retained for the duration of the subscription, such retention being necessary for the operation of the Service.
Following termination or cancellation of a subscription, such data is deleted within 90 days. That period is afforded so that the account holder may reinstate the subscription or export its data.
Where an account holder requests deletion before the expiry of that period, Beardesk will give effect to the request without awaiting its expiry.
Data which Beardesk is required by law to retain, including records relating to taxation and accounting, is retained for the period prescribed by the applicable law and is thereafter deleted.
Server logs are retained for a limited period for security and diagnostic purposes and are then deleted or aggregated so as no longer to identify any individual.

Personal data may persist in backup media for a limited period following deletion from the production environment. Such media is maintained on a rolling cycle, is not restored into the production environment save in the event of a disaster recovery, and is overwritten in the ordinary course of that cycle.

Security

Beardesk implements appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction or damage, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing.

Personal data is encrypted in transit using industry standard transport encryption, and is encrypted at rest.
Access to personal data is restricted to personnel who require it for the performance of their duties, is subject to authentication controls, and is logged.
Processors are selected having regard to the sufficiency of their technical and organizational measures and are bound contractually to maintain them.
Beardesk maintains procedures for the detection, investigation and remediation of security incidents.

No method of transmission or storage is entirely secure, and Beardesk does not warrant absolute security.

Cookies and similar technologies

Beardesk and the parties named below use cookies and similar technologies, which include pixels, tags, software development kits, local storage and device identifiers. References to cookies in this section are to all of them. They fall into the categories set out below.

Strictly necessary

These cookies are required for the website and the Service to operate. They support authentication, session management, load balancing, fraud prevention and security, and they record the choices you make about the categories below. They cannot be disabled, and the Service cannot be provided without them.

Functional

These cookies remember choices you make, such as your language, region or time zone, and the state of parts of the interface. Their absence does not prevent the website from working, but features may not be presented as you last left them.

Analytics and performance

These cookies collect information about how the website and the Service are used, including the pages visited, the features engaged with, the paths taken between them, approximate location derived from IP address, and errors encountered. The information is used to measure and improve performance and to understand which parts are useful. It may be collected by third-party analytics and product monitoring providers acting on Beardesk instructions.

Advertising and targeting

These cookies are set by Beardesk and by advertising networks and social media platforms. They record your visit, the pages you view and the links you follow, and they are used to build a profile of your interests, to select advertising for you on this and other websites, to measure whether that advertising led to a visit or a subscription, and to limit the number of times an advertisement is shown. Where these cookies are set, personal data may be shared with, or made accessible to, the party operating them, and that party may combine it with data it holds from other sources.

Third-party content

Parts of the website embed content served by other parties, including a scheduling tool used to book a call and hosted video. That content is delivered from the provider systems, which receive your IP address and may set their own cookies and run their own analytics inside the embedded frame. Beardesk does not control those cookies and their use is governed by the privacy notice of the provider concerned.

Your choices

Cookies other than strictly necessary ones are set only where you have consented, and consent is requested when you first visit the website. Consent may be withdrawn or changed at any time, and withdrawal takes effect for the future and does not affect anything done while consent was in place.

Browsers allow cookies to be blocked or deleted, and most offer a setting to reject third-party cookies outright. Blocking strictly necessary cookies will prevent parts of the website and the Service from working. Advertising networks and platforms may also offer their own opt-out mechanisms, which operate independently of any choice recorded here.

Your rights

Subject to the conditions and exemptions provided by applicable law, you may exercise the following rights in respect of personal data concerning you.

To obtain confirmation as to whether personal data concerning you is processed, and to obtain access to that data and to information concerning its processing.
To obtain a copy of that data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
To obtain the rectification of inaccurate data and the completion of incomplete data.
To obtain the erasure of personal data.
To obtain the restriction of processing, and to object to processing carried out on the basis of legitimate interests.
To withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Requests must be submitted to privacy@beardesk.ai. Beardesk will respond within one month of receipt, which period may be extended by two further months where the request is complex or where a number of requests have been received, in which case you will be informed of the extension and of the reasons for it within the initial period. No fee is payable, save where a request is manifestly unfounded or excessive. Beardesk may request such information as is reasonably necessary to verify your identity before giving effect to a request.

European Economic Area and United Kingdom

The rights set out above are conferred by Articles 15 to 22 of the GDPR and of the UK GDPR. You have the right to lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or the place of the alleged infringement, or, in the United Kingdom, with the Information Commissioner’s Office. You are not required to contact Beardesk before doing so, although Beardesk would welcome the opportunity to address the matter.

India

Under the Digital Personal Data Protection Act, 2023 you have the right to obtain a summary of the personal data processed and of the processing activities undertaken, the right to obtain the identities of other data fiduciaries and processors with whom the data has been shared together with a description of the data so shared, the right to correction, completion, updating and erasure, and the right to nominate another individual to exercise these rights in the event of your death or incapacity.

Grievances must be addressed to privacy@beardesk.ai, which is the designated contact for that purpose. Beardesk will respond within the period prescribed by the Act. Where a grievance is not resolved to your satisfaction, you may make a complaint to the Data Protection Board of India.

Children

The Service is intended for use by businesses and is not directed to children. Beardesk does not knowingly collect personal data from any individual under the age of eighteen years, and does not knowingly process the personal data of a child within the meaning of the Digital Personal Data Protection Act, 2023 without verifiable parental consent.

Where Beardesk becomes aware that personal data of a child has been collected, whether through a conversation or otherwise, it will delete that data without undue delay. Any person who believes that such data has been provided should notify privacy@beardesk.ai.

Amendments

Beardesk may amend this Policy from time to time. The date stated at the head of this Policy indicates when it was last revised, and the revised Policy takes effect upon publication.

This page is the authoritative statement of the Policy at any time, and the date at its head shows when it was last revised. Continued use of the Service following a revision constitutes acknowledgment of the amended Policy.