The bot runs on your machine. The conversations never reach us.

What this covers

This policy covers the DutyDesk application ("the app") and this website. It draws a line between two very different things: data that stays on your computer, and data that reaches our server. Most of what the app touches is the first kind.

The app drives a personal WhatsApp account through an interface that is not the official WhatsApp Business API. That is your decision and your responsibility, and it is described in the guide.

What stays on your computer

All of this is held in the application data folder on that machine. We have no access to it, no copy of it, and no way to recover it for you.

• The content of messages sent and received, and the message log
• Your rules, menu flows and any files attached to them
• Customer records: names, notes, tags, pipeline stages and appointments
• WhatsApp session credentials, the Telegram bot token and any AI provider keys — encrypted in your operating system keychain
• The Google Calendar grant — encrypted in the same keychain; see below

What leaves your computer, and where it goes

This list is complete. Every outbound connection the app opens is here.

Your Google data

If you connect a Google Calendar, the app requests three permissions and no more: permission to create, change and cancel events on calendars you own (calendar.events.owned); permission to see whether a given time is taken (calendar.events.freebusy); and permission to read the list of your calendars and nothing else (calendar.calendarlist.readonly). Alongside those it requests your account email address, so the screen can tell you which account it is connected to.

We deliberately do not request the broad calendar scope, nor the one that allows editing events on every calendar you can see. The first would give full access to any calendar anyone has shared with you; the second would let the app write to calendars that are not yours. Neither is needed in order to book an appointment.

Your Facebook data

If you connect a Facebook Page, the app requests permission to read the messages your customers send that Page and to reply to them, and nothing more. It does not read your posts, your comments, your followers or your insights, and it never touches your personal Facebook profile — only the Page you chose.

Messenger allows a business to reply for 24 hours after a customer writes. The app replies automatically only inside that window. Between 24 hours and 7 days it will send only a message you typed and sent yourself. It does not do bulk sending on Messenger at all.

The access token for the Page is stored encrypted in your operating system keychain, on your computer. The messages are written to the same local database as the rest of your message log. None of it reaches any server of ours.

Disconnecting the Page in Settings deletes the token from your computer and ends the app's access. You can also remove DutyDesk from your Facebook account's Business Integrations settings.

Limited Use

DutyDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta Platform Terms

DutyDesk's use of information received from Meta's APIs adheres to the Meta Platform Terms and the Messenger Platform policies, including the messaging window described above.

What we do hold

The licensing server is the only thing we run. It holds what is needed to sell a licence and check it, and nothing beyond that.

Retention and deletion

Deleting your account in the account area deletes the account, its sessions and the licences attached to it. Billing records are kept for as long as the law requires them to be kept.

The data on your computer is deleted when you delete it: uninstall the app, or remove its data folder. We cannot do it for you, because we cannot reach it.

Your rights

You may ask to see the data we hold about you, to correct it, or to have it deleted. Write to the address below and we will answer. Most of the data the app touches is not ours to produce, and for that data there is nothing for us to hand over.

Changes to this policy

A material change will be published here and the date above will change with it. A change to the Google permissions the app asks for requires you to grant them again, so nothing can widen quietly.

Contact

alphamergers@gmail.com