Privacy Policy

ClientDesk VA ("we", "us", "the Service") is an operational software platform for administrative professionals and virtual assistants. This policy explains what personal data we collect, why we collect it, who we share it with, and how you can control it. It is written to be plainly understandable rather than exhaustively legalistic. It is not a substitute for advice from your own counsel.

1. Who we are

ClientDesk VA is operated by the account owner of your organization. We provide software that stores and processes information you enter about yourself, your team, your clients, and your business operations. Contact us at support@clientdeskva.com.

2. What we collect

• Account data — name, email, hashed password (via Supabase Auth), organization membership, role.
• Client & workflow data — client contact info, intake responses, service requests, contracts, onboarding sections, tasks, notes, appointments, communications, uploaded documents, forms responses.
• Billing data — invoices, line items, payment status. Card numbers and card CVCs are never stored by us; they are collected directly by Stripe on Stripe-hosted pages.
• Calendar OAuth tokens — if you connect Google Calendar or Outlook, we store access/refresh tokens server-side, encrypted at rest by our database provider, to schedule appointments on your calendar and receive change notifications.
• Usage & audit logs — timestamps, endpoint hits, actor user id, action name, entity id/type, IP address for security auditing.

3. Why we collect it

• Providing the core Service you signed up for (contractual necessity).
• Sending you and your clients transactional emails (onboarding invites, appointment notifications, invoices).
• Processing your subscription and one-time payments through Stripe.
• Detecting abuse, enforcing rate limits, and maintaining audit trails for security.
• Debugging and improving the Service. We do not sell your data or run ad-tracking on the app.

4. Third-party processors

We use the following sub-processors. Each has its own privacy policy governing how it handles data we transmit to it:

• Supabase — database, authentication, file storage. (policy)
• Stripe — payment processing, invoicing, subscription billing. (policy)
• Google (Calendar) — only if you explicitly connect a Google account: reads/writes events on the calendar you authorize. Scopes: calendar.events, calendar.readonly. (policy)
• Microsoft (Graph / Outlook Calendar) — only if you explicitly connect a Microsoft account: reads/writes events, subscribes to change notifications. Scopes: Calendars.ReadWrite, offline_access, User.Read. (policy)
• Resend — transactional email delivery (onboarding, appointments, invoices). (policy)

We do not knowingly share data with any other third party except when required by law.

5. Data retention

We keep account and workflow data for as long as your organization has an active account. Financial records (invoices, payment history) are retained for seven years to satisfy tax and regulatory obligations even after account deletion. Audit-log entries are kept: the audit log is deliberately immutable, so entries are not deleted.

6. Your rights

• Access & export — every record you own is downloadable as a PDF from within the app. Email support@clientdeskva.com for a bulk export.
• Correction — every editable record is directly editable from the app.
• Deletion — see /data-deletion or delete your account from Settings → Account.
• Portability — CSV/PDF export on request.
• Objection & restriction — for GDPR/UK-GDPR residents, contact privacy@clientdeskva.com.

7. Client (portal) users

If you receive a portal invitation, the organization that invited you is the data controller for your record. Direct data-subject requests to them first. We are their data processor under our terms with them.

8. Security

All connections are TLS 1.2+. Passwords are hashed by Supabase Auth (bcrypt). Portal tokens are SHA-256 hashed at rest. OAuth tokens are stored server-side and never exposed to the browser. Multi-tenant isolation is enforced at the database level via Postgres Row-Level Security. We audit every mutating action. Report vulnerabilities to security@clientdeskva.com.

9. Children

ClientDesk VA is not directed at children under 16 and we do not knowingly collect their data. If you become aware that a child has provided us data, contact us and we will delete it.

10. Changes

We will note material changes at the top of this policy and, where practical, email active account owners.

This document is provided in good faith. Have a lawyer localize it for your jurisdiction before onboarding regulated data (health, financial, minors).