Privacy Policy

Information We Collect

We collect only the data necessary to provide and improve the Service. We do not build advertising profiles, sell data, or collect data beyond what is described here.

Session content is never visible to us. All remote session data (screen frames, input events, file transfers) is encrypted end-to-end between the initiating client and the target agent. The TucDesk relay infrastructure handles only encrypted ciphertext and does not log source or destination IP addresses.

How We Use Your Information

We use the information we collect for the following purposes:

• Service provision: Authenticating users, establishing encrypted connections between clients and agents, and maintaining the session audit trail your organization requires
• Security: Detecting and preventing unauthorized access, abuse, fraud, and other security threats to the platform and to your organization
• Communication: Sending service-related notices (security alerts, Terms updates, downtime notifications) and, only with your explicit consent, product updates
• Product improvement: Analyzing anonymized usage patterns to identify bugs, prioritize features, and improve performance
• Legal compliance: Complying with applicable legal obligations, responding to lawful requests, and enforcing our Terms of Service

We do not use your data for advertising purposes. We do not build behavioral profiles for sale to third parties. We process your data only as a data processor acting on your instructions, or as a data controller where legally required.

Data Storage & Retention

Account data and session metadata are stored on encrypted infrastructure with access restricted to authorized personnel only. We apply the principle of least privilege — engineers access production data only when operationally required and only with logged, audited access.

Default retention periods:

• Account data: Retained for the life of the account plus 30 days after deletion, to allow recovery from accidental deletion
• Session metadata (timestamps, agent IDs, duration): Retained for 90 days by default; configurable per organization
• Session recordings (if enabled by your organization): Retained per your organization's configured policy; not accessible to TucDesk staff
• Usage analytics: Aggregated and anonymized after 30 days; individual event logs deleted after 90 days
• Billing records: Retained for 7 years for tax and financial compliance purposes

You may request deletion of your account and associated data at any time by contacting privacy@tucdesk.app. We will fulfill deletion requests within 30 days, subject to legal retention requirements.

Third Parties & Subprocessors

We share data with third parties only as necessary to provide the Service. We do not sell, rent, or trade your personal information. Third-party subprocessors we engage include:

• Cloud infrastructure providers: For hosting, compute, and encrypted storage (subject to data processing agreements)
• Payment processors: For handling billing transactions; they receive only tokenized payment data
• Email delivery: For transactional emails (password resets, security alerts, invoices); email addresses only
• Error monitoring: Anonymized crash and error data (no PII or session content)

We may disclose data if required by law, court order, or governmental authority. Where legally permitted, we will notify you before complying with such requests. We will challenge requests that we believe are overbroad or unlawful.

We will never voluntarily disclose the contents of encrypted sessions because we technically cannot — session content is encrypted with keys we do not hold.

Security Practices

Security is not an afterthought — it is foundational to TucDesk's architecture:

At the platform level, we additionally apply: TLS 1.3 for all API and dashboard communications; bcrypt (cost 12+) for password hashing; short-lived API tokens with scoped permissions; and regular third-party security audits.

To report a security vulnerability, please see our responsible disclosure policy or email security@tucdesk.app. We aim to acknowledge all reports within 24 hours.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data. We honor these rights regardless of where you are located:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete personal data
• Erasure: Request deletion of your personal data (subject to legal retention obligations)
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing of your data for certain purposes
• Restriction: Request that we limit how we use your data while a dispute is resolved
• Withdrawal of consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact privacy@tucdesk.app. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

Cookies & Tracking

The TucDesk dashboard uses strictly necessary cookies only:

• tucdesk_session — Encrypted session cookie for authentication. HTTPOnly, Secure, SameSite=Strict.
• tucdesk_csrf — CSRF protection token.

We do not use advertising cookies, third-party tracking pixels, or behavioral analytics cookies. We do not use Google Analytics or similar third-party analytics platforms that track individual users across sites.

Contact

For privacy-related inquiries, data requests, or concerns about this policy:

• Privacy requests: privacy@tucdesk.app
• Legal inquiries: legal@tucdesk.app
• Security reports: security@tucdesk.app
• Company: PTH Global (operating as TucDesk)