Privacy at myDesk

• Account details. Your email address, and a name if you or your firm give one. We use these to sign you in and to tell your colleagues who did what.
• What your firm puts on its desk. Firm details, team members and their roles, matters, clients and contacts, deadlines, invoices, time and expense entries, trust and operating ledger entries, reconciliations, imported bank statement lines, and trust account details such as account and routing numbers.
• Uploaded files. Documents your firm uploads, and files a client sends through the client portal, along with text read from them to suggest a name or fill a form.
• Activity and audit records. A log of changes and sensitive actions, for example when bank numbers are saved or revealed, so your firm can see who did what.
• Usage information. The site loads an analytics script that records page visits and similar usage information. It is meant to count and understand visits, not to identify you, but like any web request it can involve technical details such as your browser type and IP address.

Records about your clients are entered by your firm. Your firm decides what goes on its desk and what is shared with each client.

The site runs on Vercel. Desk records are stored in a Postgres database hosted by Neon in the United States. Uploaded files are stored inside that same database, not as public files: there is no public link to a document, and each download checks that the person asking is allowed to see it.

A firm's records are scoped to that firm. Bank account and routing numbers are shown masked, and are never shown in the client portal.

• Email links. Resend delivers sign-in links and team invitations from our domain when configured. If delivery fails, our platform email service is the fallback. These providers process the recipient address and email content for delivery. When you sign in by email we send a one-time link. It works once and expires after 15 minutes. We store only a hash of the link's token, never the token itself.
• Session cookie. After you sign in, a cookie keeps you signed in for up to 30 days, or until you sign out. Its token is also stored only as a hash. It is needed for the desk to work, not for advertising.
• Sign in with Google. If you choose it, we ask Google only for the “openid” and “email” scopes: who you are and your email address. We do not ask for access to your mail, calendar, contacts or files.
• Client portal. Clients sign in with a private link their firm sends them. Portal sign-ins are kept separate from firm sign-ins.

We use the information to run the service: to sign you in, show your desk, send sign-in and service emails, keep the audit trail, prevent abuse, fix problems and improve the product. We do not sell personal information, and we do not use your desk records for advertising.

We rely on service providers that process data on our behalf, only as needed to provide the service: hosting (Vercel), the database (Neon), email delivery for sign-in and service emails, site analytics, and identity providers you choose to sign in with, such as Google. When paid plans are sold, payments are handled by a hosted payment provider; we do not store card numbers.

We may also disclose information when the law requires it, for example in response to a valid legal request, or to protect the rights and safety of our users or the service.

We keep your firm's records while its account is open, because they are the firm's working record. To ask for a copy, a correction or deletion, write to support@getmydesk.app. We will confirm the request comes from someone entitled to make it.

Please keep in mind that trust and accounting records often must be kept for a set number of years under bar and licensing rules. Before you ask us to delete them, make sure you have kept the copies you are required to keep. Deleted data can remain in backups for a limited time until those backups are replaced.

If a client of a firm asks us about their information, we will usually refer them to that firm, which controls what is on its desk.

We take reasonable steps to protect information, described plainly on our security page. No online service can promise perfect security.

If this notice changes, we will update it here and change the date at the top. Questions go to support@getmydesk.app, and a person will answer.