Privacy Policy
NexDesk provides managed IT services to businesses. This policy explains what information we collect when you visit nexdesk.ai, when your company becomes a client, and when your team reaches us — by phone, email, text message, Slack, or Microsoft Teams — and what we do with it.
1. Who we are
NexDesk is a managed IT service provider serving small and midsize businesses in the New York tri-state area. NexDesk is operated by Work Telemetry LLC, a New York limited liability company, which is the legal entity behind this policy. For the purposes of privacy law, we act in two different roles depending on the data.
For visitors to our website and for prospects who contact us, we are the controller — we decide what we collect and why. For data inside a client's environment (support tickets, device inventory, user directories), we act as a processor on that client's behalf, handling the data under our services agreement with them and on their instructions.
If you are an employee of a NexDesk client and want your data corrected or deleted, contact your own IT or HR administrator first. They direct us on what to do with their organization's data.
2. Information we collect
We collect different information depending on how you interact with us.
3. How we use it
- ·To deliver the managed IT services your company has contracted us for — resolving tickets, managing devices, administering accounts.
- ·To authenticate you and keep your session secure, including rate-limiting and blocking IP addresses that show signs of credential-stuffing or brute-force attempts.
- ·To respond to sales enquiries submitted through our contact form or chatbot.
- ·To generate and collect on invoices.
- ·To understand which parts of our website are useful, and to improve them.
- ·To meet legal, tax, and contractual obligations.
We do not sell personal information. We do not share it with advertising networks or data brokers, and we do not use client ticket content to train AI models.
4. Slack and Microsoft Teams
Support tickets are filed in your own Slack workspace or Microsoft Teams tenant. This is worth being specific about, because it means data crosses between systems.
In Slack, our app receives messages in the channels it has been added to. In Microsoft Teams, our bot receives a message in a channel only when someone @-mentions it, and receives all messages in a one-to-one chat with the bot. In both cases, we store the message content, sender identity, and thread metadata in our own database so the ticket has a durable record after the chat history rolls off.
Our bot does not read channels it has not been added to, and in Teams channels it does not receive messages that do not mention it. Slack and Microsoft each apply their own privacy terms to the data while it sits on their platform; our handling of what we receive is governed by this policy and by our agreement with your company.
When your organization stops using NexDesk, removing our app from Slack or Teams stops all further collection immediately. Data already stored is handled per Section 7.
5. Text messages and phone calls
We use two channels that carry their own rules, so we are explicit about both.
Text messages. We send SMS for exactly one purpose: one-time codes that verify a sign-in or a security-sensitive change to your own account. You are enrolled only by entering your own number into a web form inside your NexDesk account and ticking a consent checkbox; we never add a number on your behalf. We send no marketing or promotional text messages.
Message frequency varies and depends on your own sign-in activity — one message per sign-in or security change, typically two to ten messages a month, and none at all if you do not sign in. We send no recurring or scheduled messages. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. The full program description is at nexdesk.ai/sms.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. The only party that receives your mobile number is Twilio, which transmits the message for us and may use it for nothing else.
Phone calls. Calls to our helpdesk number are recorded and transcribed so the engineer who picks up your ticket has an accurate record of what you reported. We announce the recording at the start of the call; if you would rather not be recorded, hang up and email support@nexdesk.ai instead. Recordings and transcripts are treated as ticket content and kept on the schedule in Section 8. We do not use them for training, quality scoring, or any purpose other than resolving and documenting your issue.
6. Service providers we share data with
We use a small number of vendors to run the service. Each receives only what it needs to do its job.
We may also disclose information if legally required to — a subpoena, court order, or comparable legal process — or where necessary to investigate a security incident. Where we are permitted to notify the affected client before disclosing, we will.
7. Cookies and tracking
Our marketing site does not use advertising or cross-site tracking cookies. We use first-party analytics that records page views and IP addresses on our own infrastructure; nothing is sent to a third-party advertising platform.
The client portal and staff console use strictly necessary session cookies to keep you signed in. These cannot be disabled without breaking authentication.
8. How long we keep data
- ·Support tickets and their message content: for the duration of the engagement plus two years, so historical issues can be referenced.
- ·Call recordings and transcripts: 12 months, then the audio is deleted; the transcript is kept with the ticket on the line above.
- ·Mobile numbers enrolled for verification: until you remove text messaging as a method or your account is closed, then deleted within 30 days. The record that you consented, and when, is kept for four years as carrier rules require.
- ·Asset and device inventory: for the duration of the engagement, then deleted or exported to the client on request.
- ·Billing records and invoices: seven years, to meet tax and accounting requirements.
- ·Portal accounts: deactivated when the engagement ends; deleted within 90 days unless the client asks us to retain them.
- ·Contact form submissions: two years.
- ·Website analytics and server logs: 13 months.
- ·Chatbot conversations: 90 days.
A departing client can request a full export of their ticket history, asset inventory, and documentation at any point during the engagement or within 30 days of it ending.
9. Security
Data is encrypted in transit with TLS and at rest in our AWS-hosted database and storage. Access to client data is limited to NexDesk staff who need it to deliver the service, and portal sessions are scoped so users only ever see their own organization's data.
We log authentication attempts and automatically block IP addresses showing brute-force patterns. Administrative credentials for client environments are stored in an encrypted secrets store, not in tickets or documentation.
No system is perfectly secure. If we become aware of a breach affecting a client's data, we will notify that client without undue delay and support their own notification obligations.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, and to object to certain processing. New York does not currently have a comprehensive consumer privacy statute, but we extend these rights to anyone who asks, regardless of location.
To exercise them, email privacy@nexdesk.ai. We will respond within 30 days. We may need to verify your identity first, and if you are an employee of a client organization we will generally need to route the request through that organization's administrator.
We do not discriminate against anyone for exercising a privacy right.
11. Children
NexDesk sells to businesses. Our services are not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
12. International transfers
Our infrastructure is hosted in the United States. If you are contacting us from outside the US, your information will be transferred to and processed in the US, where privacy law differs from your home jurisdiction.
13. Changes to this policy
We will update this page when our practices change, and revise the date at the top. For changes that materially affect how we handle client data, we will notify affected clients directly rather than relying on this page alone.
14. Contact
Privacy questions, requests, and complaints: privacy@nexdesk.ai. General enquiries: hello@nexdesk.ai. You can also reach us through the contact form on this site.