Privacy Policy

Effective November 7, 2026. GreetDesk is operated by a Canadian sole proprietor in Ontario. We handle personal information in accordance with applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA). Our proprietor is responsible for privacy practices; contact privacy@greetdesk.ca.

Information we collect and why

From account owners, we collect email, name and optional sign-in profile information, business websites and content, assistant settings, installation status, subscription identifiers and usage records. We use these to authenticate accounts, provide and improve the service, manage billing, prevent abuse and communicate with you. Stripe handles payment details; we do not store full payment card numbers.

From visitors using an assistant, we collect chat messages and answers, timestamps, a visitor identifier, usage information, and names and contact details voluntarily provided as leads. We may process IP addresses for abuse prevention. Website content and relevant chat context are sent to our AI provider to generate answers or lead summaries. Leads and summaries may be emailed to the business. Do not submit sensitive health, financial, identity or other confidential information in chat.

Customer and visitor responsibilities

Customers are the controllers of their visitors’ data: they decide why their assistant collects information and how to use it. GreetDesk processes that information on their behalf to deliver the service. Customers must give appropriate notices, obtain required consent, and handle visitor requests. These descriptions do not remove either party’s obligations under PIPEDA. For GreetDesk’s own account, billing and support activities, we determine the purposes of processing.

Sharing and service providers

Our subprocessors include Anthropic for AI responses, Railway for hosting and storage, Stripe for payments, and Resend for email. We disclose information needed for their functions, and may also disclose it when legally required or necessary to protect rights and security. We do not sell personal information. Processing may occur outside Canada, including in the United States, where information may be subject to local laws and lawful access requests.

Retention and security

Chat transcripts and associated leads are retained for 90 days by default and removed by the hourly maintenance job. Visitor session copies follow the same limit. Backup copies rotate after 14 days, so removed information can remain in backups temporarily. Account, billing and security records may be retained longer as needed to provide service, resolve disputes and meet legal obligations. Contact us to request account deletion or discuss a shorter retention period.

We use access controls, encrypted HTTPS connections and restricted account access to reduce risk. No system is perfectly secure. We investigate privacy incidents and provide notifications when required by law.

Cookies and communications

We use essential sign-in and security cookies. The widget uses a browser visitor identifier to maintain conversations and apply usage limits. Optional lifecycle emails include an unsubscribe link; account, sign-in and billing messages remain necessary to operate the service.

Your choices and requests

You may ask to access or correct personal information, withdraw consent where applicable, or request deletion by writing to privacy@greetdesk.ca. We may verify your identity and explain any legal or operational limits. Withdrawing consent can prevent us from providing some features. Visitors should first contact the business whose assistant they used; we assist that business with requests and can help direct you to it.

Contact our privacy officer at privacy@greetdesk.ca to raise a concern. You may also complain to the Office of the Privacy Commissioner of Canada. We will post policy updates here and notify account owners of material changes.