The paperwork, in plain language

This policy explains how ReDesk Technologies Private Limited handles personal data across redesk.ai, the ReDesk platform, our mobile applications, and our sales and support interactions.

It covers two different relationships. When you visit our site or hold a ReDesk account, we are the controller of your data. When our customers put their own customers' data into the platform, we are a processor acting on their instructions — that relationship is governed by the Data processing addendum.

• Providing, maintaining and securing the platform.
• Billing, collections and financial reporting.
• Product analytics in aggregate, to decide what to build next.
• Sending service notices, and — with consent — product news you can unsubscribe from at any time.
• Detecting and preventing fraud, abuse and security incidents.
• Meeting legal, tax and regulatory obligations.

Where the GDPR or comparable law applies, we rely on: performance of a contract (running your account); legitimate interests (security, product improvement, direct B2B marketing); consent (non-essential cookies and marketing email); and legal obligation (tax and statutory records).

For customers in India, we process personal data consistently with the Digital Personal Data Protection Act, 2023, including notice, purpose limitation and the ability to withdraw consent.

We do not seek sensitive personal data. Some workflows — subsidy applications, KYC, loan underwriting — require identity documents. Those are encrypted, access-limited to the people processing that specific application, and deleted once the retention obligation ends.

Do not upload health data, biometric data or payment card numbers into free-text fields.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose it in four situations only:

• Service providers under contract — hosting, email delivery, payments, analytics, support tooling. The current list is published on the Sub-processors page.
• Your own workspace — owners and admins can see content created by their members.
• Legal and compliance — when required by valid legal process, or to protect rights and safety. We notify you unless legally prohibited.
• Business transfer — in a merger, acquisition or asset sale, with notice before your data becomes subject to a different policy.

We use strictly necessary cookies for login and security, and — only with your consent — analytics and product-usage cookies. There are no advertising cookies on redesk.ai. Full detail, including how to change your choice at any time, is in the Cookie policy.

We honour Global Privacy Control and Do Not Track browser signals as an opt-out of non-essential tracking.

Data is encrypted with AES-256 at rest and TLS 1.2+ in transit. Access follows least privilege, is reviewed quarterly, and is logged. We run continuous monitoring and independent penetration tests each year.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority within the timelines the law requires, and publish what we learned.

You can access, correct, export, delete or restrict processing of your personal data, object to processing based on legitimate interests, and withdraw consent at any time. Most of this is self-service in account settings.

For anything else, write to privacy@redesk.ai. We respond within 30 days and never charge for a first request. If you are unhappy with our response you may complain to your supervisory authority, or in India to the Data Protection Board.

Primary hosting is in India (Mumbai region). Some sub-processors operate outside India. Where personal data leaves the country we rely on Standard Contractual Clauses or equivalent safeguards, and we assess each transfer before it begins.

ReDesk Technologies Private Limited, Bengaluru, Karnataka, India. Data protection contact: privacy@redesk.ai. We will publish material changes to this policy 30 days before they take effect.