Privacy Policy

1. Who we are

Deskspark ("Deskspark", "we", "us") is a CRM built for recruitment agencies, provided by Deskspark Ltd, a company registered in England and Wales (no. 17474181), registered office 4-6 Greatorex Street, London, E1 5NF, United Kingdom. This policy explains what data we collect through the Deskspark application, why, and what rights you and the people in your pipeline have over it.

2. What we collect

We collect two categories of data:

• Your account data: name, work email, company, and how you use Deskspark (pages visited, features used) to run and improve the product.
• Candidate and client data you enter: names, contact details, employment history, notes, and interview outcomes your agency stores in Deskspark to run its own recruiting process. This is your data; we process it on your behalf as a data processor, not the data controller, for the individuals it describes.

3. Voice and AI features

Vicki, Deskspark's AI copilot, may send the text of your requests to a third-party AI provider to generate a response, and may send reply text to a third-party voice provider (ElevenLabs) to generate spoken audio. We do not send candidate or client records to these providers beyond what you explicitly ask Vicki about in a given request.

4. Who we share data with

We use sub-processors to run Deskspark, including hosting (Vercel), database and authentication (Supabase), the AI providers above, email delivery for broadcasts (Resend), and address geocoding outside the UK for radius search (Mapbox). Data is currently hosted in the United States. We do not sell candidate, client, or account data to anyone. For agencies acting as a data controller over their own candidate and client data, see our Data Processing Agreement.

5. Cookies

We use essential cookies to keep you signed in and remember your preferences. We do not use third-party advertising cookies.

6. Your rights

Depending on where you or the candidates in your pipeline are located, you may have the right to access, correct, export, or delete personal data held in Deskspark (for example under UK GDPR, EU GDPR, or the CCPA). Account owners can do this directly for their workspace's data: an Admin can export any record (Settings → Export All Data, or a per-contact export from that contact's page) and can permanently erase a record via Trash → Delete Forever, which removes it and every directly linked record (call logs, notes, attachments, hotlist and shortlist entries) immediately. Business records that reference someone by name for accountability or record-keeping purposes (email correspondence, the internal activity feed, and the security audit log) are retained as a legitimate business record rather than deleted, consistent with this policy's retention terms below; contact us if you need one of those reviewed individually. Contact us for anything you can't handle yourself.

7. Data retention

Deleting a record in Deskspark moves it to Trash rather than erasing it immediately, so a mistaken or malicious deletion can be undone: an Admin can restore it anytime within 90 days, or permanently erase it sooner via Trash → Delete Forever. Anything still in Trash after 90 days is automatically and permanently purged by a daily background job. We retain account and candidate/client data on this basis for as long as your subscription is active, plus a reasonable period afterward for backups and legal obligations.

8. Contact

Questions about this policy or a data request: privacy@deskspark.io.