Skip to main content
DM DESK
Log inBook a call

Data Processing Addendum

Last updated October 16, 2026

This Data Processing Addendum (“DPA”) is part of the DM DESK Terms of Service. It covers the personal information about your customers that DM DESK handles for you. Words with a capital letter mean what they mean in the Terms.

1. What this covers and who is who

“Customer Personal Information” means personal information about the people who message your business through the Service: their messages, the orders, bookings and requests they make, and any name, phone number, email or address they share. You decide why and how it is used. DM DESK handles it for you as your service provider under the California Consumer Privacy Act, and as your processor under any similar law.

2. Your instructions

We handle Customer Personal Information only on your instructions. Your instructions are the Terms, this DPA, and the settings you choose in the Service. The business purposes are:

  • answering your customers' messages on your behalf;
  • building their orders, bookings and requests and passing them to you or to the systems you connect;
  • handing a conversation to you when a person is needed, and alerting you;
  • keeping the Service secure, finding and fixing errors, and preventing abuse;
  • billing you and supporting your account;
  • improving your own agent, such as suggesting changes to its knowledge and settings; and
  • building and improving the quality of the Service, as permitted for service providers under Cal. Code Regs. tit. 11, §7050(a)(3). We do not use Customer Personal Information to perform services for another business or to build a profile of any person for another business. We review conversations to find and fix problems in our software. Fixes are made to DM DESK's code and instructions.

3. What we will not do

  • We will not sell or share Customer Personal Information, as those words are used in the California Consumer Privacy Act.
  • We will not keep, use or disclose it for any purpose other than the business purposes above, including any commercial purpose of our own.
  • We will not keep, use or disclose it outside the direct business relationship between you and DM DESK.
  • We will not combine it with personal information we receive from another business or collect ourselves, except where the law allows a service provider to do so.
  • It is never used to train AI models, by us or by our AI providers.
  • No business's conversations or customer information are given to another business that uses DM DESK, used to answer another business's customers, or used to train any AI model.

DM DESK understands these limits and will comply with them. We will tell you if we decide we can no longer meet them.

4. Other providers we use

The providers we use to run the Service are named in Section 3 of our Privacy Policy. Those that handle Customer Personal Information for us, such as our AI, hosting, database, email and text message providers, may use it only to provide their service to us. Platforms you connect yourself, such as Instagram, Shopify, Square and Clover, receive what the connection needs and handle it under their own terms with you. We keep the list current. We email the account owner before a new provider starts handling Customer Personal Information for us. If you object, you may cancel before it starts. More about each provider is on our Subprocessors page.

5. Security

  • Data is encrypted in transit and at rest.
  • Each business's data is isolated at the database level, so one business cannot see another's conversations or records.
  • Access tokens for the accounts you connect are stored encrypted.
  • Access to production systems is limited to what is needed to run the Service.
  • Payments stay on your own checkout. DM DESK never processes card payments.

6. Security incidents

If we learn of a security incident that affects Customer Personal Information, we will notify you without undue delay. We will tell you what we know about what happened, what information was involved, and what we are doing about it, and we will keep you updated. You are responsible for any notice the law requires you to give your own customers or a regulator. We will help you with the facts you need.

7. Requests from your customers

We will help you answer a request from one of your customers to see, correct or delete their information. If a customer writes to us directly, we may tell them to contact you, or work with you to answer. How a deletion is done is described in our Data Deletion Instructions.

8. When your account ends

We delete Customer Personal Information about 30 days after your subscription ends. When you delete your account from Settings, it is deleted right away. What little we keep afterward, and why, is listed in our Privacy Policy. If you want a copy of your customers' conversations first, ask us before your account ends and we will give you one.

9. Checking on us

You may take reasonable and appropriate steps to make sure we use Customer Personal Information as this DPA says. Once a year, on written request, we will answer a reasonable written security questionnaire. If you tell us of a use you believe breaks this DPA, we will work with you to stop it and put it right.

10. How this fits with the Terms

If this DPA and the Terms disagree about Customer Personal Information, this DPA controls. The limits on liability in the Terms apply to this DPA. It changes the way the Terms change: with at least 30 days' notice by email for a material change. Questions, or a signed copy: email privacy@dm-desk.com.

DM DESK is operated by DM Desk LLC, a California limited liability company.