Privacy Policy

This Privacy Policy explains how DeskLab ("DeskLab", "we", "us") collects, uses and protects information when you use the DeskLab web application at desklab.ai (the "Service"). DeskLab is operated by MyStay, Porto, Portugal. If you have questions, contact us at daniel@mystay.pt.

1. What DeskLab is

DeskLab is a customer-relationship management (CRM) tool for teams. A business (the "Workspace") connects its communication channels — email, and optionally messaging and telephony providers — to a shared inbox. Incoming messages become tickets that the Workspace's team members ("Agents") and, where the Workspace enables it, an AI assistant can read and reply to. Google Calendar can be connected to book appointments with customers.

2. Information we collect

• Account information. Name, email address and profile picture of each Agent who signs in.
• Workspace data. Contacts, tickets, notes, tags, appointments and settings created in DeskLab.
• Connected-channel data. Messages received on and sent from the channels a Workspace connects, including Google user data described in section 4.
• Usage and technical data. Browser type, pages visited, timestamps and error reports, used to keep the Service working and secure.

3. How we use information

We use information only to provide, maintain, secure and improve the Service: to display tickets and contacts to the Workspace's Agents, to send replies, to book appointments, to generate AI-assisted replies and summaries when the Workspace enables them, to respond to support requests and to detect abuse. We do not sell personal data and we do not use it for advertising.

4. Google user data

A Workspace administrator may connect a Gmail account and a Google Calendar to DeskLab through Google's OAuth consent process. Connection is optional and can be revoked at any time. When connected, DeskLab requests the following permissions and uses them only as described:

• Gmail read access (gmail.readonly). DeskLab reads messages received in the connected mailbox and turns them into tickets in the Workspace's shared inbox, showing the sender, subject, body and attachments to the Workspace's Agents. We do not modify, label or delete messages in Gmail.
• Gmail send (gmail.send). DeskLab sends replies to tickets from the connected mailbox. A reply is sent either when an Agent writes it and clicks Send, or — if the Workspace administrator has assigned an AI assistant to that mailbox — automatically by the AI assistant, replying to the customer who wrote in. Automated replies are sent only in response to messages received in the connected mailbox and only to their senders; DeskLab never sends marketing, bulk or unsolicited email. The Workspace administrator can disable the AI assistant at any time.
• Google Calendar (calendar). DeskLab reads availability and creates, updates or cancels appointments on the connected calendar when an Agent or the AI assistant books an appointment for a customer.

Who can see Google user data. Because the connected mailbox is shared, all Agents of the Workspace that connected it can read the tickets created from it and the replies sent from it, as configured by the Workspace administrator. This is the core function of the Service. DeskLab staff do not read your Google user data except when strictly necessary for security, to comply with law, or when you ask us to investigate a specific problem and agree to it.

Limited Use disclosure. DeskLab's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

• only use Google user data to provide or improve user-facing features of DeskLab (the shared inbox, replies, appointment booking and the related AI assistance);
• do not transfer Google user data to third parties except to the service providers listed in section 6 as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you;
• do not use Google user data for serving advertisements;
• do not allow DeskLab staff to read Google user data except as stated above;
• do not use Google user data, including Gmail content, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.

AI processing. To classify tickets, draft or send replies and book appointments, DeskLab sends the relevant message or calendar text to a third-party AI model provider acting as our processor under terms that prohibit them from using it to train their models; the provider may retain request data for up to 30 days solely to monitor for abuse, after which it is deleted. Only the data needed for the specific feature is sent.

5. Storage, retention and security

Data is stored on cloud servers in the European Union or the United States. Data is encrypted in transit (TLS). Access to production systems is restricted to authorised personnel. OAuth tokens and other channel credentials are stored in our database and used only to perform the actions described above; we are working to encrypt them at rest. Tickets and messages derived from Gmail are kept for as long as the Workspace keeps them. When a Workspace disconnects Gmail or Google Calendar, we revoke the token and stop syncing; data already imported remains in the Workspace until deleted by an Agent. When a Workspace is deleted, all its data is deleted within 30 days, except where retention is required by law.

6. Sharing

We share data only with service providers that host or process it on our behalf — cloud hosting, database, AI model providers, messaging and telephony providers (for the channels a Workspace connects), email delivery and error monitoring — under agreements that restrict their use of the data to providing services to us; when required by law; or to protect the rights, property or safety of DeskLab, our users or the public.

7. Your rights and choices

Workspace administrators can export or delete Workspace data and disconnect any channel from DeskLab settings. Google access can also be revoked at myaccount.google.com/permissions. Individuals whose data is held in a Workspace (customers who wrote to a connected mailbox) should contact that business; we act as their processor and will assist them. If you are in the EEA or UK, you have the rights granted by the GDPR, including the right to lodge a complaint with your supervisory authority (in Portugal, the CNPD).

8. Children

DeskLab is a business tool, not directed to children under 16, and we do not knowingly collect their data.

9. Changes

We may update this policy from time to time. We will post the new version on this page and, for material changes, notify Workspace administrators by email or in the app.

10. Contact

DeskLab / MyStay · Porto, Portugal · daniel@mystay.pt