Privacy policy · My Desk Studio

1. Who we are

My Desk Studio (My Desk DevOps and My Desk CRM) is provided by My Desk Studio, Cultiv8, 37, Gurusamy Nagar, Codissa Road, Peelamedu, Coimbatore, Tamil Nadu 641004, India (“we”, “us”). This policy follows India's Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

2. Our two roles

Your account data (you and your team using My Desk Studio): we decide how it's used, so we are the data fiduciary.
Data you put into the products — especially the leads, contacts and companies in My Desk CRM, and the cloud data in My Desk DevOps: your organization decides how it's used, so your organization is the data fiduciary and we act as its data processor. If you're one of our customer's contacts, please contact that organization about your data.

3. What we collect

Account details: name, work email, company name, workspace address, password (stored only as a one-way hash), role and team membership.
Billing details: plan, seats, subscription and payment status. Card, UPI and bank details are entered with Razorpay and are not stored by us.
Customer data in the products: CRM records (leads, contacts, deals, quotes, invoices, notes, custom fields) and, for DevOps, cloud resource metadata, costs, metrics, logs and security findings from accounts you connect. Cloud credentials you provide are encrypted at rest.
Website forms: what you send through the contact form or newsletter sign-up, and website-form leads you collect for your own CRM.
Usage and security data: sign-in events, IP address, device and browser details, and an audit log of important account actions, used for security and to prevent abuse.
Website analytics: our own cookie-free analytics count page views and sign-up steps, with the page path and referring website only — no advertising trackers and no personal profile.

4. Why we use it

To provide and secure the service, sign you in, and keep each organization's data separate.
To bill subscriptions and handle payments, refunds and invoices.
To send service emails: sign-up codes, password resets, invitations, billing and support messages. Product updates only if you subscribe, and you can unsubscribe at any time.
To provide AI features on paid plans. Your data is used only to produce your result and is not used to train AI models.
To answer support requests, improve the product, and meet legal obligations.

We process account data with your consent given at sign-up and for the legitimate uses the DPDP Act allows (such as providing the service you asked for, and meeting legal requirements). We don't sell personal data.

5. Who processes data for us

Amazon Web Services: hosting and databases (India — Mumbai region) and AI processing (which may run in AWS regions outside India, such as the United States).
Razorpay: payment processing.
Our email provider: sending service emails.
Your connected services (for example your AWS, Azure or Google Cloud accounts, Slack or Jira) when you choose to connect them.

Each is bound to protect the data and use it only to provide its service to us. We may disclose data if required by law or a lawful order.

Connected mailboxes and calendars (Google and Microsoft 365)

My Desk CRM users can connect their own Google (Gmail, Google Calendar) or Microsoft 365 (Outlook) account. You sign in on Google's or Microsoft's own page; we never see your password, and you can disconnect at any time in Settings or from your Google or Microsoft account.

What we access: we send emails from your mailbox only when you click Send on a draft; we create calendar events and invitations only when you choose a time; we read your free/busy times to suggest slots; and, where you allow it, we read emails exchanged with leads and contacts already in your CRM so they appear on that record's timeline. Other emails are not stored.
How we protect it: access tokens are encrypted, every send and invitation is recorded in your organization's audit log, and AI agents only prepare drafts — a person approves every message.
Google user data: My Desk Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google or Microsoft user data to train AI models, we do not sell it, and we do not use it for advertising.
Deletion: disconnecting removes the stored tokens immediately. Emails already saved on CRM records stay until you delete them or close your account.

6. Where data is stored

Our servers and databases run in India (AWS Mumbai). When you use AI features, the text needed for that request is processed by AI services in AWS regions that may be outside India, and is not stored there or used for training. Other providers may process limited data outside India. All transfers follow the DPDP Act and any restrictions the Government of India notifies.

7. How long we keep it

Account and customer data: while your account is active; deleted within 30 days after the account is closed.
Billing and tax records: as long as the law requires (usually up to 8 years).
Security logs and audit events: up to 1 year. Website contact messages: up to 2 years. Sign-up codes expire after 10 minutes.

8. Security

We use HTTPS everywhere, hashed passwords, encryption of stored cloud credentials, role-based access, rate limits, login lockout and audit logging. See our security page. If a personal data breach affects you, we'll notify you and the Data Protection Board of India as the law requires.

9. Cookies

We use only an essential sign-in cookie (and a small preference cookie for the workspace domain) to keep you signed in. No advertising or third-party tracking cookies. Razorpay may set its own cookies inside its payment window.

10. Your rights

Under the DPDP Act you can ask to: access a summary of your personal data and how it's processed; correct, complete or update it; erase it (where we don't need to keep it by law); withdraw consent (this may stop parts of the service); nominate someone to exercise your rights if you can't; and raise a grievance. Email admin@mydeskstudio.com. We respond within 30 days. Team members' requests about data held by their organization in the CRM go to that organization first.

11. Children

The service is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's data.

12. Grievance Officer

[Grievance Officer name], My Desk Studio, Cultiv8, 37, Gurusamy Nagar, Codissa Road, Peelamedu, Coimbatore, Tamil Nadu 641004, India. Email: admin@mydeskstudio.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days. If you're not satisfied, you may complain to the Data Protection Board of India.

13. Changes

We'll post updates here and email account owners about material changes before they take effect.

Last updated: 14 October 2026