Draft — not legal advice. This is placeholder copy to unblock launch prep. Have a qualified lawyer review it against your actual data flows and jurisdictions (especially UK/EU candidate data) before this goes live for real customers.

Privacy Policy

Last updated: [date]

1. Who we are

Deskspark ("Deskspark", "we", "us") is a CRM built for recruitment agencies, provided by [Your Company Legal Name], [registered address]. This policy explains what data we collect through the Deskspark application, why, and what rights you and the people in your pipeline have over it.

2. What we collect

We collect two categories of data:

Your account data — name, work email, company, and how you use Deskspark (pages visited, features used) to run and improve the product.
Candidate and client data you enter — names, contact details, employment history, notes, and interview outcomes your agency stores in Deskspark to run its own recruiting process. This is your data; we process it on your behalf as a data processor, not the data controller, for the individuals it describes.

3. Voice and AI features

Vicki, Deskspark's AI copilot, may send the text of your requests to a third-party AI provider to generate a response, and may send reply text to a third-party voice provider (ElevenLabs) to generate spoken audio. We do not send candidate or client records to these providers beyond what you explicitly ask Vicki about in a given request.

4. Who we share data with

We use sub-processors to run Deskspark, including hosting (Vercel), database and authentication (Supabase), and the AI providers above. Data is currently hosted in the United States. We do not sell candidate, client, or account data to anyone. For agencies acting as a data controller over their own candidate and client data, see our Data Processing Agreement.

5. Cookies

We use essential cookies to keep you signed in and remember your preferences. We do not use third-party advertising cookies.

6. Your rights

Depending on where you or the candidates in your pipeline are located, you may have the right to access, correct, export, or delete personal data held in Deskspark (for example under UK GDPR, EU GDPR, or the CCPA). Account owners can do this directly for their workspace's data; contact us for anything you can't handle yourself.

7. Data retention

We retain account and candidate/client data for as long as your subscription is active, plus a reasonable period afterward for backups and legal obligations, then delete it on request or after [retention period].

8. Contact

Questions about this policy or a data request: privacy@deskspark.example.