What changed in our terms

What changed on October 29, 2026 in the Terms of Service, the Data Processing Addendum, the Privacy Policy and the Subprocessors list (now Providers we use, in the Privacy Policy), each change word for word. For a business that uses DM DESK, they apply once its owner or a manager accepts them; DM DESK asks on their next visit to the dashboard. Until then, that business's conversations are not used to improve DM DESK for other businesses.

1. Terms of Service

Section 7, Customer content and data, has a new paragraph:

Improving the Service. You direct DM DESK to use your customers' conversations, including messages received through Instagram, to find and fix problems in the Service and to improve it for all Customers. We may keep short pieces of conversation text as tests and examples for our software. Before we keep them, we remove names and contact details and mark them with where they came from, so they can be removed. They are kept with our source code and sent to our AI providers when our software runs. They are never given to another Customer and never used to train AI models.

Section 4, Subscriptions and billing:

Before: Paid plans are billed in advance on a recurring basis through Stripe. Applicable taxes may be added.

Now: Paid plans are billed in advance on a recurring basis through our payment processor. Applicable taxes may be added.

2. Data Processing Addendum

Section 2, Your instructions, the last of the purposes:

Before: building and improving the quality of the Service, as permitted for service providers under Cal. Code Regs. tit. 11, §7050(a)(3). We do not use Customer Personal Information to perform services for another business or to build a profile of any person for another business. We review conversations to find and fix problems in our software. Fixes are made to DM DESK's code and instructions.

Now: building and improving the quality of the Service for all Customers, which you direct under section 7 of the Terms and which service providers may do under Cal. Code Regs. tit. 11, §7050(a)(3). We review conversations to find and fix problems in our software, and we may keep pieces of them, including messages received through Instagram, as tests and examples for our software, with names and contact details removed and marked with their source. Fixes are made to DM DESK's code and instructions. We do not use Customer Personal Information to perform services for another business or to build a profile of any person for another business.

Section 4, Other providers we use:

Before: The providers we use to run the Service are named in Section 3 of our Privacy Policy.

Now: The kinds of providers we use to run the Service are listed in Section 3 of our Privacy Policy.

Before: More about each provider is on our Subprocessors page.

Now: More about each kind of provider is in our Privacy Policy, under Providers we use. You can ask us for their names at any time.

3. Privacy Policy

Section 3, Who we share information with, lists the providers that run DM DESK by the kind of service. Meta, Apple and the platforms a business connects stay named. The list is now:

• Meta Platforms, Inc.: to send and receive messages via the Instagram API.
• AI providers: to write and check replies, translate messages, set up a Customer's assistant, describe a Customer's writing style from their own Instagram captions, and suggest improvements to their assistant.
• A speech provider: to transcribe voice messages and read replies aloud.
• Database, sign in and hosting providers.
• A payment processor: subscription billing.
• Email delivery and text messaging providers: to send our emails, and text alerts to Customers and staff who opted in.
• Apple: to deliver push notifications to the DM DESK app.
• An error monitoring provider.
• A website reader: to read a business's public website when our own reader can't.
• Bot protection on our forms, and a maps provider for address suggestions and public business details.
• A scheduling provider: to book setup calls.
• Company email, and code hosting whose tests and notes quote the words of a few customer messages without names or contact details.
• Clover (Fiserv), Square, and Shopify: to read menus and create checkouts and orders for Customers who connect them.

Before, the list was:

• Meta Platforms, Inc.: to send and receive messages via the Instagram API.
• Anthropic: to write AI replies, and to describe a Customer's writing style from their own Instagram captions (voice analyzer).
• OpenAI: to transcribe voice messages into text and read replies aloud.
• Supabase: database hosting and authentication.
• Vercel: application hosting.
• Stripe: subscription billing and payment processing.
• Resend: email delivery.
• Firecrawl: to read a business's public website when our own reader can't.
• Twilio: to send text message alerts to Customers and their staff who opted in.
• Apple: to deliver push notifications to the DM DESK app, using the device token described above.
• Calendly: to book setup calls with Customers.
• Cloudflare: bot protection on our forms.
• Google: address suggestions during setup, and Google Workspace for our own email.
• Clover (Fiserv), Square, and Shopify: to read menus and create checkouts and orders for Customers who connect them.
• Sentry: error monitoring and diagnostics.
• GitHub: hosting of our source code, whose tests and notes quote the words of a few customer messages.

Two paragraphs changed:

Before: Message content is processed by our AI providers, Anthropic (to write replies, and to describe a Customer's writing style from their own Instagram captions when they use the voice analyzer) and OpenAI (to transcribe voice messages and read replies aloud), solely to provide the service, under commercial terms that do not allow them to use it to train their models.

Now: Message content is processed by our AI and speech providers solely to provide the service, under commercial terms that do not allow them to use it to train their models.

Before: More about each of these is on our Subprocessors page.

Now: More about each kind of provider is under Providers we use, below. A Customer can ask for their names by writing to privacy@dm-desk.com from the email address on the account.

In these sentences a provider's name became the kind of provider, and the rest stayed the same:

• Billing information: “handled directly by Stripe” became “handled directly by our payment processor”
• Deleting an account: “only invoices held by Stripe or Shopify” became “only invoices held by our payment processor or Shopify”
• The voice analyzer: “sends them to Anthropic to describe your writing style” became “sends them to our AI provider to describe your writing style”
• Booking a setup call: “The booking page is run by Calendly.” became “The booking page is run by our scheduling provider.”
• dm-desk.com/book: “go to Calendly, which runs that calendar” became “go to our scheduling provider, which runs that calendar”
• The microphone in the chat: “the recording is sent to OpenAI to be turned into text, and the reply may be sent to OpenAI to be read aloud. We do not keep the recordings. OpenAI may keep them” became “the recording is sent to our speech provider to be turned into text, and the reply may be sent to it to be read aloud. We do not keep the recordings. The speech provider may keep them”
• The demo at dm-desk.com/try: “Sometimes a web reading service (Firecrawl) reads it for us.” became “Sometimes a web reading service reads it for us.”
• Page view counts: “through Vercel Web Analytics.” became “through our hosting provider's analytics.”

4. Subprocessors, now Providers we use

Before: The page named each company (Anthropic, OpenAI, Supabase, Vercel, Stripe, Firecrawl, Resend, Twilio, Apple, Sentry, Cloudflare, Google and GitHub), with what it does, the information it handles and a Location column, and a sentence on where Vercel's network first receives a request. Our own tools were named as Google Workspace and Calendly.

Now: Providers we use, in section 3 of the Privacy Policy, lists each kind of provider, what it does and what information it handles, without the company names or a location column. A Customer can ask for the current names of these providers by writing to privacy@dm-desk.com from the email address on the account.

Scroll the table sideways to see what each kind of provider handles.

5. Three pages moved

The words of three pages moved into the Privacy Policy and the Terms, and each old address now leads to the new place:

• The Cookie Notice is now Cookies and browser storage, in section 1 of the Privacy Policy.
• The Subprocessors page is now Providers we use, in section 3 of the Privacy Policy.
• The Acceptable Use and AI Terms are now section 5 of the Terms of Service; their part on AI output was already section 6.

Questions about these changes: email privacy@dm-desk.com.