Legal
Privacy Policy
Last updated September 2026
What we collect
Account details you give us directly (name, email, workspace name), and the data you put into your workspace, such as tickets, contacts, deals, and any custom fields you add. We don't sell any of it, ever.
How we use it
To run the product: authenticate you, route and store your tickets/contacts/deals, send transactional email (login codes, ticket notifications), and provide support if you ask for it.
Who can see your workspace data
Only members of your workspace, scoped by the roles and team access an owner configures. Go1Desk staff only access workspace data to debug an issue you've reported, or when legally required to.
Connected messaging channels
If a business connects a messaging channel to their workspace (such as WhatsApp, Instagram, or Facebook Messenger), Go1Desk receives the messages people send to that business's own account, so its team can read and reply from one place. That means the message content, any photos or files attached to it, the sender's display name and their platform account identifier, and the time each message was sent. We use it for one thing only: showing that conversation to the business you messaged and delivering their reply back to you. We do not use it to build advertising profiles, we do not sell it, and we do not use it to train AI models. We are not the business you are messaging; we are the software they use to answer you. Each connection is authorised by the business through the platform's own permission screen, and can be revoked by them at any time, or by you by removing the app from your platform account.
Deleting messaging channel data
You can ask for everything we hold from your messages to be erased. Removing Go1Desk from your Facebook or Instagram account settings sends us a deletion request automatically, and we act on it and give you a confirmation code and a page showing the status. You can also email [email protected] directly. Deletion covers the message content and your platform identifier held in our systems; it does not cover any copy the business itself has exported, or the record held by the platform you messaged from, neither of which is ours to erase.
Payment data
We don't store your card details ourselves. When you buy seats, routing addresses, or upgrade a plan, payment is handled by our payment processor (Paddle, acting as merchant of record); card numbers and payment credentials go directly to them, never through our servers or database.
Sub-processors
We use a small set of third parties to run the product: Resend (transactional email delivery), Paddle (payment processing and billing), Sentry (server-side error monitoring; helps us catch and fix bugs, doesn't track your browsing), PostHog (product analytics; see “Analytics” below), and our hosting/infrastructure providers (Cloudflare, and our cloud VM host). Each only receives the data it needs to do its job. For example, Resend receives the email address and content of a message we're sending you, not your ticket data. Where a business has connected a messaging channel, the platform it runs on (Meta, for WhatsApp, Instagram and Messenger) is the source of those conversations rather than a sub-processor of ours: they hold the conversation under their own terms, and we receive a copy on behalf of the business you contacted.
Analytics
We use PostHog (hosted in the EU) to understand how the product is used: which pages get visited, where visitors arrived from, and where people get stuck in a flow. It's configured without analytics cookies: the data is tied to a single browsing session and isn't used to recognise you across visits or follow you to other sites. We use it to fix confusing parts of the product, not to build a profile of you or to sell anything to anyone.
Cookies & local storage
We use a session cookie to keep you signed in; that's it for cookies. Our analytics don't set any (see “Analytics” above). A handful of preferences (light/dark theme, sidebar layout, whether you've completed the product tour) are saved in your browser's local storage, which stays on your device and isn't sent to us. We don't use advertising or cross-site tracking cookies.
Security
Passwords are hashed, never stored in plain text; two-factor authentication is available on every account. All traffic to Go1Desk is encrypted in transit (HTTPS). Access to workspace data inside our own systems is limited to what's needed to run and support the product.
International data transfers
Go1Desk's infrastructure (hosting, email delivery, error monitoring, payment processing) is provided by global service providers, which may process data outside your own country. Each sub-processor listed above maintains its own safeguards for cross-border data transfer.
Children's privacy
Go1Desk is a business tool and isn't directed at, or intended for use by, children. We don't knowingly collect data from anyone under 16.
Data retention & deletion
Your data stays as long as your workspace is active. Deletion isn't self-serve; email [email protected] to request that your workspace and everything in it be permanently deleted, and we will, within a reasonable window. If your subscription is cancelled, we keep your data for a reasonable grace period in case you want to reactivate, then delete it.
Your rights
You can ask us what data we hold about you, ask us to correct it, or ask us to delete it, by contacting us below. We'll respond within a reasonable timeframe consistent with applicable data protection law.
Contact
Questions about this policy: [email protected].