Privacy policy

1.About this document

This document states DeskGrade’s terms and commitments. It is not legal advice.

2.Who is responsible

Pilotify (sole trader / toiminimi), Business ID 1820342-0, Harluntie 5, 02600 Espoo, Finland, is the controller for this website, DeskGrade user accounts and secure service operations. Privacy contact: jan@pilotify.app.

Material that a customer puts into its DeskGrade workspace, such as messages, files, CRM records, notes, meetings, room content and what agents create from them, is processed on the customer’s behalf. For that material the customer is the controller and we are its processor under our data processing agreement. If you are an employee, guest or contact of a DeskGrade customer, ask that customer first how it uses your data; we help it answer.

3.Visitors to this website

• Page requests: our host receives your IP address, browser details and the page you asked for in order to deliver it and protect the site. We run no analytics or advertising on this website.
• Bot check: when you send the contact form, Vercel BotID checks invisibly that a person is using the browser. It runs from this website’s own address and sets no cookie.
• Contact form: your name, work email, company, message and the page language are sent to us by email and used only to reply to you. The website itself stores nothing; your message is kept in our email inbox.
• Abuse protection: repeated requests are limited using short-lived counters or keyed identifiers. The implementation and storage depend on the entry point; hosting security logs may also contain request-origin information.

4.People who use DeskGrade

When a customer gives you access to DeskGrade, we process:

• Account details: name, email address, profile picture if you add one, language and other preferences, the workspaces you belong to and your role in each.
• Sign-in details: whether you sign in with a password, a one-time email link or code, or your company’s single sign-on, and the session information that keeps you signed in. We store passwords only in hashed form through our sign-in provider.
• Workspace content that you and others create, on the customer’s behalf (see Who is responsible), including voice messages and their transcripts.
• Agent data: what your personal agent remembers about your work, its conversations with you, and the actions it proposes or carries out, each recorded with who approved it.
• Connected accounts: if you connect a Google or Microsoft calendar, Slack or GitHub, the access tokens and data needed to use that connection.
• Email delivery records: which service emails (such as invitations and sign-in links) were sent to you and whether they were delivered. We do not track whether you open emails or click their links.
• Security and audit records: who did what and when, technical error logs, and request-origin information where needed for security or attribution. Hosting providers receive IP addresses; abuse controls use short-lived counters or keyed fingerprints. We do not claim that IP-related data is never stored.

5.Guests in shared rooms

A customer can invite you to a shared room as a guest. We then process your email address, the guest session that lets you in, and what you write or upload in the room. If you join without an account, a temporary guest identity is created and deleted after seven days unless you stay active in a room.

A customer can choose to record when guests visit a room and which pages and files they open. It can switch this on only after it has published its own privacy notice, which the room links to. You can turn detailed recording off in the room, and doing so deletes what was recorded. The customer is the controller of this activity data.

6.People in customers’ records

Customers may keep details of their own contacts in DeskGrade, for example names, work email addresses, phone numbers and company roles in the CRM, or participants in meetings. Some company details can be looked up from the public Finnish Trade Register. The customer is the controller of this data and responsible for informing the people concerned.

7.Why we process it and on what legal basis

We do not sell personal data, do not use it for advertising and do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Our own purposes are limited to accounts, billing, service security and abuse prevention. Customer-content analytics require documented customer instructions or a separate lawful basis and notice; we will not reuse content silently.

8.AI processing

DeskGrade connects to OpenAI directly, Vercel AI Gateway, OpenRouter as a backup, and Anthropic using our own key through Vercel AI Gateway. We prefer providers with zero retention and no training on customer inputs; this is a routing preference, not a guarantee for every request. Provider terms and the configured route determine processing. Hosting in Stockholm, Sweden does not mean that AI inference, support or all onward processing stays in the EU. EU-only model routing is not currently guaranteed. See the current directly connected providers and each gateway’s published provider list. Pilotify does not train models on customer content.

9.Who helps us process data

We use service providers for hosting, the database, email, AI models, abuse protection and error monitoring. They process personal data only on our instructions. The current list, with what each one does and where, is on our sub-processor page. Services that you or your company choose to connect, such as Slack or a calendar, receive data under their own terms. We disclose data to authorities only when the law requires it.

10.Where data is stored and transfers outside the EU

DeskGrade’s database and file storage and its application server-function region are in Stockholm, Sweden. Delivery, support, security and AI inference can involve processing outside the EEA. We require an applicable adequacy decision or appropriate safeguards, such as EU standard contractual clauses and supplementary measures where needed. We will assess protection proportionately to the transfer and explain the applicable basis and safeguards on request. The sub-processor list identifies providers and their policies. We do not promise EU-only processing.

11.How long we keep data

• Contact messages: only as long as needed to handle the enquiry and any resulting customer relationship; we will delete messages that are no longer needed unless law requires retention.
• Account details: while the account is active; we will delete them within 30 days after the account or customer relationship ends, except for limited retention required by law.
• Temporary guest identities: deleted after seven days unless the guest stays active in a room. Expired invitations are deleted daily.
• Room visit records: while the room exists, or until the guest switches recording off.
• Workspace content: as the customer decides, and deleted at the end of the customer relationship as the data processing agreement sets out.
• Security and audit records: necessary event metadata will be retained for 24 months. Diagnostic payloads will be deleted sooner when their purpose ends. Any justified legal or investigation hold will be documented and limited in scope.
• Accounting records: as long as the Accounting Act requires (generally six to ten years).

12.Employee data and workplace monitoring

The customer is responsible as employer and controller for its workplace deployment. Under the Finnish Act on the Protection of Privacy in Working Life (759/2004), employee data must be directly necessary for the employment relationship; consent cannot waive necessity. Data is collected primarily from the employee. Collection from other sources requires the applicable consent or statutory exception and information to the employee before use in decisions concerning them.

Connecting mail, calendars or files does not give an employer unrestricted access to employees’ communications or permission to monitor them. The employer must define purposes, sources, access and retention, assess necessity and lawful basis, inform employees and complete applicable co-operation or consultation before introducing technical monitoring or changing its purpose or methods. The Co-operation Act (1333/2021) applies according to the employer’s circumstances. Where co-operation legislation does not apply, the Working Life Privacy Act still requires an opportunity for employees or their representatives to be heard on technical monitoring.

DeskGrade’s intended use is productivity and customer support. Recruitment ranking, employee scoring or evaluation, employment decisions and behaviour- or personality-based work allocation are excluded. The customer must document its deployment before connecting employee sources. We commit to easy, versioned management of that record in DeskGrade; the record does not itself establish a lawful basis or replace employer duties. See the AI notice.

13.Voice, recording and transcription

Voice messages and live AI voice interactions can send audio to a model provider and produce text transcripts. They are distinct from recording a meeting or telephone call. DeskGrade does not currently record meetings or produce meeting transcripts. The AI notice and supplier list describe AI involvement and providers.

Our policy is recording off by default. Before activating recording in employee meetings, incoming calls, outgoing calls or shared rooms, each scenario must have a defined purpose, lawful basis, notice for everyone concerned and separate retention for raw audio and transcripts. Informing someone that AI is involved does not replace a recording or transcription notice, and agreeing to a conversation does not by itself authorise recording or marketing.

14.Backups and recovery

Uploaded files (Storage objects) are not backed up or recoverable as part of DeskGrade. Customers must keep their original files outside the service. Database backups contain file metadata, not the uploaded file contents; restoring a database does not restore a lost file. No future file-backup service is promised.

Our database-backup commitment is daily backups with seven-day retention, without point-in-time recovery. This is not an uninterrupted-availability or recovery-time guarantee. Authorised restoration must include downtime and post-restore checks and preserve or reapply deletions. Return and deletion of active customer data follow the data processing agreement; backup expiry and legally required retention are handled separately.

15.Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive data you gave us in a portable format. These rights apply under the conditions set by the GDPR. Where we rely on legitimate interest, you may object at any time. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Some of this you can do yourself in DeskGrade: review, correct and forget what your personal agent remembers, erase your private knowledge vault, export notes and your vault, and as a room guest switch off detailed recording. For anything else, contact jan@pilotify.app. We answer within one month. If your data is in a customer’s workspace, we pass your request to that customer and help it answer.

We verify identity and the relevant customer scope before providing data or acting on a request. Assistance may be operator-led and cover the relevant stores and suppliers; we record the steps, any lawful retention or other exception and completion. A partial self-service export or deletion is not a complete response for all data.

You can also complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) or to the authority in the EU country where you live or work.

16.Cookies and browser storage

This website sets no cookies and stores nothing in your browser, so it asks for no consent.

The DeskGrade app uses only cookies and browser storage needed for the service you asked for. It uses no analytics or advertising cookies.

The app also keeps layout preferences and unsaved drafts in your browser’s local storage. Rooms can show videos embedded from third-party providers such as YouTube, Vimeo or Loom. Until you press play, the room shows its own preview picture and your browser does not contact the provider. When you play such a video, the provider may set its own cookies under its own privacy policy. Where a provider offers a privacy-enhanced embed mode, we use it.

17.Security

Data is encrypted in transit, access is limited by role, each company’s data is kept apart from other companies’ data in the database, and agent actions are recorded in an audit log. If a personal data breach is likely to put your rights at risk, we tell the authority and, where required, you.

18.Changes to this policy

We publish versioned documents with an effective date and a summary of changes. We notify tenant administrators in-app and by email at least 30 days before a material change to these terms or policies takes effect. Unless the customer objects within that notice period, the notified change is accepted and takes effect on the stated effective date without a new acceptance click. The customer may object through our legal contact; if a materially adverse change cannot be resolved, the customer may terminate the affected service without penalty before the change takes effect. A replacement needed urgently for security or availability may take effect immediately with prompt notice and the same objection and exit rights. This mechanism does not waive mandatory rights or replace consent where consent is required. Re-acceptance for a tenant-initiated change to governed settings, such as retention, is separate.