Privacy Policy

DM DESK (“DM DESK,” “we,” “us,” or “our”) is operated by DM Desk LLC, a California limited liability company. This policy explains what information we collect, how we use it, and what choices you have, whether you are a business that uses DM DESK to manage its Instagram and website chat conversations (a “Customer”) or someone who messages a Customer's business (an “End User”).

For a Customer, this policy is part of the agreement you accept when you create an account. For an End User, it is a notice. It tells you how your information is handled when you message a business that uses DM DESK.

When you message a business that uses DM DESK, that business decides why your information is collected. We process it for the business under a written contract and do not use it for our own purposes, except to secure and improve the service. That contract is our Data Processing Addendum. The business's own privacy notice covers how it uses your information.

1. Information we collect

From Customers (business accounts)

• Account information: name, email address, business name, and location details you provide when signing up.
• Billing information: handled directly by our payment processor. DM DESK does not receive or store full payment card numbers.
• Business content: hours, FAQs, menus, pricing, house rules, and any other material you give the AI to answer questions on your behalf.
• Your Instagram account, if you connect it: its account ID and username, and an access token (encrypted) that lets DM DESK send and receive its direct messages. If you use the voice analyzer, DM DESK reads the captions of up to 25 of your recent posts and sends them to our AI provider to describe your writing style. The captions are not stored; only the style notes you choose to save are.
• Usage data: how you use the dashboard, inbox, and settings, for support and to improve the service, never to train AI models.
• A device token from Apple, if you turn on notifications in the DM DESK app, so we can send alerts to that device. It is removed when you sign out of the app.
• Your name, email and the time you pick, if you book a setup call. The booking page is run by our scheduling provider.
• A mobile number for text alerts, if you add one and opt in, with a record of your consent: when you opted in, the wording you agreed to, and the IP address and browser you used. See Text messaging below.
• Your answer and any comment, if you answer one of our feedback emails.

From Customers who connect a point of sale or online store

When you connect Clover, Square, Shopify, or another supported system, we receive data through that provider's official API, limited to the permissions you approve: your business profile (name, address, phone, and email), your menu or catalog (items, prices, options, tax rates, and order types), and the orders and payments created through DM DESK. We use this data only to answer your customers accurately, build their orders, and label the orders DM DESK creates in your system. Access tokens are encrypted at rest. We never receive full payment card numbers. Payments are processed by your provider's own hosted checkout.

From End Users, through Meta's Instagram platform

When someone messages a business that uses DM DESK on Instagram, Meta Platforms, Inc. (“Meta”) shares certain information with us through its official APIs so the business can respond. This may include:

• The content of the message and attachments sent to the business.
• The sender's Instagram-scoped ID, a number Meta assigns to that person's conversation with the business. We do not request or store their username or profile.
• Conversation metadata: when each message was sent, and the thread history with that business.
• Details the End User chooses to share in the conversation, such as a name, phone number, email, address or order number. These are used only to follow up on their request, to pass it to the business, or to look up their order.

From people who use a Customer's website chat

When someone chats with a Customer through the DM DESK chat on the Customer's website, we receive and store the messages they send, the replies, the contents of any order they build in the chat, and any name, phone number, or email they choose to share. The chat keeps a random visitor ID in the visitor's browser so the same conversation continues across pages; it is not used to follow anyone across other websites. On a Customer's Square Online store, the chat uses that store's own session in the visitor's browser only to add the order to the store's cart.

If a visitor opens the Customer's website from a link we sent in an Instagram conversation with that Customer, the link carries a random code so the chat can continue that same conversation on the website. The code contains no Instagram ID, name or message text, works only in the first browser that opens it, and stops working after seven days. The earlier Instagram messages are not shown in the website chat; they are used only to continue that conversation for that Customer.

Voice messages

If a visitor uses the microphone in the chat, the recording is sent to our speech provider to be turned into text, and the reply may be sent to it to be read aloud. We do not keep the recordings. The speech provider may keep them for up to 30 days to check for abuse, then deletes them. We keep the text of the conversation like any other chat. Voice messages are transcribed only to answer them and are not used for any other purpose. We do not create, collect or keep voiceprints or any other biometric identifier.

From people who use the Try It Now demo

When someone enters a website address in the demo at dm-desk.com/try, we store that address, the public content we read from that website to build the preview, and the messages typed into the preview. Sometimes a web reading service reads it for us. A preview is temporary. It is deleted, with the chats in it, 7 days after it was made. To limit how many previews one visitor can start, we keep a visitor ID and a scrambled network address. Those are kept for about a month. When a website gives us too little to build a good preview, we also get an email with the website address that was entered, so we can improve the tool.

Before your preview opens, we ask for your name, email and business name, and your phone number if you give it. Your Instagram handle is optional. We use them to email you the link to your preview and to contact you about your demo. We keep them, along with when you agreed and a scrambled version of your network address, until you ask us to delete them by emailing privacy@dm-desk.com. They are not deleted when the preview is deleted after 7 days.

From people who meet us, book a call or ask for one

If you meet us in person or book a setup call with us, we keep your name, business and contact details to follow up with you about DM DESK. If you asked for a call through the form that used to be at dm-desk.com/demo, we keep the same details from it, along with your other answers, the page you came from, the campaign tag in its link, and the network address the form was sent from. We may also keep our own notes and, if we met in person, a photo of your business card or storefront. You can ask us at any time to stop contacting you or to delete these details, at privacy@dm-desk.com.

If you book a setup call at dm-desk.com/book, we keep your name, email and business website, a scrambled version of your network address, and whether you picked a time. We use them to set up your call and to contact you about DM DESK. When the booking calendar opens, your name, email and website go to our scheduling provider, which runs that calendar, so you don't type them twice. We keep them until you ask us to delete them by emailing privacy@dm-desk.com.

Businesses we contact first

Sometimes we reach out to businesses we think DM DESK could help. To do that, we keep the business's name, category, address, phone, website, public Instagram handle and follower count, and a business contact email the business publishes. We get them from public sources: business listings, Google, the business's own website and its public Instagram profile. We also keep other public details about the business from those sources, where we found the email, our own notes, the messages we send, and when a demo link we sent was first opened. We may build a private demo of DM DESK from the business's public website; it is not listed anywhere and is deleted after 7 days. We send these messages ourselves, by hand, from our own email and Instagram accounts. To ask us to stop contacting your business or to delete what we keep about it, email privacy@dm-desk.com.

From people who send us a message

If you send us a message through the form at dm-desk.com/contact, we keep your name, email, business name and website if you give them, what you need, your message, and a scrambled version of your network address. We use them to reply to you. We keep them until you ask us to delete them by emailing privacy@dm-desk.com.

Information we ask you not to send

The chat is for questions, orders and bookings. Please do not send health records, payment card numbers, Social Security numbers or other government ID numbers in a chat. Payments happen on the business's own checkout page, never in the chat.

Automatically collected

• Standard server logs (IP address, browser type, pages visited) for security and diagnostics.
• Essential cookies used to keep you signed in. We do not use third-party advertising trackers. Cookies and browser storage, below, lists what DM DESK stores in your browser.
• Page view counts on our public website pages, and counts of clicks on a few buttons such as booking a setup call or trying the demo, through our hosting provider's analytics. It sets no cookies. It receives the page address without any query string other than campaign tags (utm_source and similar), the page you came from, and general browser, device and country information, and it does not store your IP address.

We do not track visitors across other websites. We treat browsers the same whether or not they send a Do Not Track or Global Privacy Control signal.

Cookies and browser storage

This part lists what DM DESK stores in your browser. It covers dm-desk.com, the DM DESK dashboard and app, and the chat a business puts on its own website.

On dm-desk.com

DM DESK sets no cookie when you open a page of this website while signed out, unless a row below says so. Each item below is set when you do what the table says. The table also says whether it is a cookie or is kept in your browser's storage.

Scroll the table sideways to see what each one holds and how long it stays.

The sign in, sign up and password pages also write a test value to local storage and remove it at once, to check that storage works.

The chat on dm-desk.com is the same chat businesses use. On the pages that carry it, it keeps what the list under The chat on a business's website shows.

Page view counts

We count page views on our public pages, and a short fixed list of events such as a button click or the chat greeting being shown, with Vercel Web Analytics. When we last checked it, on October 13, 2026, it set no cookie and kept nothing in your browser. Vercel says it tells visitors apart by a hash made from the incoming request, and that a visitor session is discarded after 24 hours.

To keep your visits out of our counts, open a page with ?analytics=off at the end of its address. That sets the one cookie named for it in the table above.

A bot check, address suggestions and a booking calendar

• A bot check. The form that builds a demo and the form that asks for a setup call load a bot check from Cloudflare, called Turnstile. Cloudflare says it uses what it collects to tell people from bots, and not to identify, profile or target anyone.
• Address suggestions. Inside the signed in dashboard, an address field loads suggestions from Google.
• A booking calendar. After you enter your details at dm-desk.com/book, the page shows Calendly's booking calendar inside it. That calendar is Calendly's own page, and this policy does not cover what it keeps in your browser.

Each runs under its own terms. Providers we use, in section 3, lists each by the job it does.

The chat on a business's website

A business that uses DM DESK can put our chat on its own website. The chat sets no cookies. It keeps the items below in the browser's storage for that website.

A link that a business sends you in an Instagram conversation can carry a code. If you open the business's website from that link, the chat can continue that conversation there. For that it keeps the code and a mark, and it uses the visitor ID. All three are in the table.

One row, the order checklist's, is from before: the chat wrote it until October 28, 2026 and no longer writes or reads it. A browser that got it then still holds it.

Scroll the table sideways to see what each one holds and how long it stays.

On a Square Online store, the chat reads one of that store's own cookies and sends it only back to the store, to add your order to the store's cart.

This policy covers the messages you send in the chat (see From people who use a Customer's website chat, above).

Your choices

Clearing the sign in cookie signs you out. After you clear the chat's storage on a website, the chat makes a new visitor ID the next time it loads there.

2. How we use information

• To provide, maintain, and improve the DM DESK service, including AI-generated reply drafts and automation.
• To communicate with Customers about their account, billing, and support requests.
• To send you emails about your account and service, including occasional emails about features or plans that may help your business. Our emails that check in on your setup or recap your results, and every email that says it is promotional, include a link to stop them and a one click unsubscribe header. Stopping them does not stop sign in, billing, alert or Terms emails.
• To detect, prevent, and address fraud, abuse, or security issues.
• To comply with legal obligations.

Message content is processed by our AI and speech providers solely to provide the service, under commercial terms that do not allow them to use it to train their models.

We analyze each business's conversations to suggest improvements to that business's agent. We review conversations to find and fix problems in our software. Fixes are made to DM DESK's code and instructions. No business's conversations or customer information are given to another business that uses DM DESK, used to answer another business's customers, or used to train any AI model.

We may create aggregated or de-identified data that cannot reasonably identify any person or business, and we will not try to re-identify it.

3. Who we share information with

We do not sell personal information. We share information only with the business an End User messaged, and with the service providers below, each bound to use it solely to provide their service to us:

• Meta Platforms, Inc.: to send and receive messages via the Instagram API.
• AI providers: to write and check replies, translate messages, set up a Customer's assistant, describe a Customer's writing style from their own Instagram captions, and suggest improvements to their assistant.
• A speech provider: to transcribe voice messages and read replies aloud.
• Database, sign in and hosting providers.
• A payment processor: subscription billing.
• Email delivery and text messaging providers: to send our emails, and text alerts to Customers and staff who opted in.
• Apple: to deliver push notifications to the DM DESK app.
• An error monitoring provider.
• A website reader: to read a business's public website when our own reader can't.
• Bot protection on our forms, and a maps provider for address suggestions and public business details.
• A scheduling provider: to book setup calls.
• Company email, and code hosting whose tests and notes quote the words of a few customer messages without names or contact details.
• Clover (Fiserv), Square, and Shopify: to read menus and create checkouts and orders for Customers who connect them.

More about each kind of provider is under Providers we use, below. A Customer can ask for their names by writing to privacy@dm-desk.com from the email address on the account.

An End User's conversation, and any order or contact details in it, is available to the business they messaged, so the business can serve them.

We may also disclose information if required by law, or to protect the rights, property, or safety of DM DESK, our Customers, or others.

If DM Desk LLC is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal, subject to this policy.

Providers we use

These are the kinds of providers that help DM DESK run the service, what each does, and what information it handles. Under our Data Processing Addendum, the ones that handle your customers' personal information for us may use it only to provide their service to us.

13 kinds of provider are listed.

Scroll the table sideways to see what each kind of provider handles.

A request first reaches our hosting provider's network at a point near the visitor, which can be outside the United States.

Platforms you connect

These are not our subprocessors. You connect them yourself, and they handle what the connection needs under their own terms with you. DM DESK works within the access you approve.

Our own tools

These run DM DESK itself.

• Company email. Our own mailbox. If you or one of your customers emails us, that email is kept there. While we set up an account before its owner has a login, its alert emails can come to our own inbox.
• Scheduling. Books setup calls. It gets what you enter when you book one, such as your name and email. On dm-desk.com/book, its calendar opens with your name, email and business website filled in, so it gets them when it opens.

4. Data retention

We retain Customer account data for as long as the account is active and for a reasonable period afterward to comply with legal, billing, and support obligations. Conversations and orders are kept while the Customer's account is active, so the Customer can see their history, and deleted about 30 days after the Customer's subscription ends, or within 30 days of a valid deletion request, or immediately when the account is deleted from Settings. Voice recordings are not kept. Records used to stop abuse (an anonymous visitor ID and a scrambled network address) are deleted after 24 hours. A Try It Now preview is deleted 7 days after it was made. The Try It Now tool's own limit records are kept for about a month.

When a Customer disconnects an integration or Instagram, removes DM DESK from their Instagram settings, or uninstalls DM DESK from their point of sale, we stop accessing it immediately, delete the stored access tokens, and delete imported catalog data within 30 days, except order records we must keep for billing, legal, or support purposes.

5. Security

Data is encrypted in transit and at rest. Each Customer's data is isolated at the database level so one business cannot access another's conversations or records. Access to production systems is limited to what is needed to operate the service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we learn of a security incident that affects personal information, we notify the affected businesses without undue delay. Each business notifies its own customers as the law requires.

6. Your rights and choices

Customers can access and correct their account information from the dashboard, and can delete their account from Settings on the website or in the DM DESK app, or by contacting us. Deleting an account immediately deletes every business the person is the only owner of, with all of its data (conversations, contacts, leads, knowledge, menus, integrations and alerts), and cancels its billing. We keep only invoices held by our payment processor or Shopify, a record that the business was deleted (its ID, billing customer ID, when, and by whom), a log of deletion and data requests (a reference code, the type, the dates and the status, and for a Shopify store its store address; never the content or who asked) for 24 months, and phone numbers that replied STOP, so they are never texted again. End Users who have messaged a business using DM DESK can request that we delete their message data by following our Data Deletion Instructions.

A website visitor can ask the business, or us at privacy@dm-desk.com, to delete their conversation. Tell us the website and roughly when you chatted.

California residents have rights under the CCPA: to know what personal information we hold about them, to get a copy of it, to correct it, to have it deleted, to limit the use of sensitive personal information, and to opt out of its sale or sharing. We do not sell personal information and we do not share it for advertising. That includes the information of anyone under 16. So there is nothing to opt out of. We use sensitive information only to provide the service, so there is nothing to limit. We will not treat you differently for using any of these rights.

To use any of these rights, email privacy@dm-desk.com or use the form at dm-desk.com/contact. We confirm we have your request within 10 business days and answer it within 45 days. We may ask a question to verify the request is yours. Someone you authorize in writing can make a request for you, and we may check with you first. If we decline a request, reply to our email to appeal. A person reviews the appeal and answers within 45 days.

If you messaged a business that uses DM DESK, we hold your information for that business. You can ask the business or ask us. If you ask us, we work with the business to answer.

7. Children's privacy

DM DESK is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, contact us and we will delete it.

8. International users

DM DESK is built for businesses in the United States. It is not offered in the European Union or the United Kingdom. DM DESK is operated from the United States. Our database and our application servers are in the United States. Some of our providers may store or process data in other regions. If you use DM DESK from another country, your information is transferred to and processed in the United States.

9. Changes to this policy

We may update this policy as the service changes. We tell the account owner about a material change by email, or ask the owner or a manager to accept it in the dashboard. A material change takes effect 30 days after that email, or for a business when its owner or a manager accepts it, whichever comes first. The date at the top of this page is the date of the newest version.

10. Contact us

Questions about this policy or how your data is handled: email privacy@dm-desk.com.

Legal notices by mail: DM Desk LLC, 121 Bernal Road STE 80, San Jose, CA 95119.

DM DESK is operated by DM Desk LLC, a California limited liability company.