Privacy Policy

Effective 11 August 2026 · Last updated 24 September 2026

Scope of this policy

Techlyft Pty Ltd (ABN 32 635 864 970), Sydney, NSW, Australia ("DeskNova," "we," "us") operates the managed, multi-tenant support platform at desknova.io — shared inbox, help center, automation, Nova, and Copilot. This policy describes how we handle personal information in connection with the marketing site, account signup, and operation of the platform.

We process personal data in line with the General Data Protection Regulation (GDPR), the UK GDPR where applicable, the Australian Privacy Act 1988, and other laws that apply to our operations and your location.

Read this policy together with our Terms of Service, Cookie Policy, AI Policy, and Data Processing Agreement where applicable.

Who this policy covers

DeskNova sits between two different roles, and this policy treats them differently:

Workspace customers (the business that signs up for DeskNova) and their agents and admins — for account, billing, and product-usage data, Techlyft Pty Ltd acts as the controller (or, in U.S. terms, the business).
End users / contacts — people who message a workspace through chat, email, or another connected channel. For the content of those conversations and help-center data a workspace stores, Techlyft Pty Ltd acts as a processor / service provider on behalf of the workspace. See the Data Processing Agreement.

Information we collect

Depending on how you interact with DeskNova, we may collect:

Account and registration data: name, work email, password (never stored or logged in plaintext), workspace/company name, and role.
Workspace content: conversations, messages, attachments, contact records, help-center articles, macros, tags, and similar content that a workspace and its agents create or receive while using the product.
Product usage and diagnostic data: pages and features used, timestamps, device/browser information, and IP address, including entries in a workspace's internal activity log (see Security) for actions like sign-in, sign-out, and permission changes.
Cookies and similar identifiers: see Cookie Policy.
Payment data: billing details processed by Stripe; we do not store full payment card numbers on our servers.
Communications with us: messages you send to support or sales contacts.

How we use information

We use the information above to:

Provide, maintain, and secure the DeskNova platform and accounts on it.
Authenticate sign-in, enforce workspace roles and permissions, and operate billing.
Respond to support requests and communicate service, security, or billing notices.
Investigate suspected abuse, security incidents, or violations of the Terms of Service.
Operate Nova and Copilot for the workspace that submitted the content (see AI Policy).
Measure product and marketing usage via PostHog (EU cloud), subject to your cookie preferences where required by law.

Cookies & similar technology

We use strictly necessary cookies for sign-in, CSRF protection, and docs preview. We also use PostHog analytics cookies on the marketing site and product application where you have consented or where permitted by law. Full detail is in our Cookie Policy.

Legal bases for processing

Where GDPR or similar frameworks apply, we rely on the following legal bases:

Contract (Art. 6(1)(b)): operating your workspace, authentication, billing, and delivering Nova and Copilot.
Legitimate interests (Art. 6(1)(f)): securing the platform, preventing abuse, and improving the Service through aggregated product analytics.
Legal obligation (Art. 6(1)(c)): tax, accounting, and regulatory requirements.
Consent (Art. 6(1)(a)): non-essential analytics cookies where required.

We do not sell personal information. We share information only as needed to operate the service, including with subprocessors listed on our Subprocessors page — for example Hetzner (hosting), Cloudflare (DNS, tunnel, R2, email relay), Stripe (payments), OpenAI, Anthropic, and AWS Bedrock (DeskNova-funded AI), and PostHog EU (analytics).

We may also share with:

Professional advisors under confidentiality obligations.
Law enforcement or regulators, where we believe in good faith that disclosure is required by law.

AI features (Nova & Copilot)

Nova and Copilot may send relevant workspace text to AI providers to generate responses or drafts. Workspace content is not used to train third-party foundation models, and we process content only to deliver these features to that workspace. See the AI Policy.

International transfers

Techlyft Pty Ltd is incorporated in Australia. Personal information may be processed in Germany (application hosting), the European Union (Cloudflare R2, Backblaze B2 backups, PostHog EU, and AWS Bedrock eu-central-1 when used), and the United States (Stripe, OpenAI, Anthropic), among other locations listed on Subprocessors.

Where personal data is transferred outside your jurisdiction, we use appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or other mechanisms recognized under applicable law.

Data retention

During your subscription. You may export workspace content during the term of your subscription using product capabilities or by contacting us.

After termination.

Post-termination export: you may request export for up to 30 days after termination.
Active-system deletion: Customer Content is deleted from active production systems within 90 days after termination, unless a longer period is required by law or agreed in writing.
Backup retention: encrypted backups may retain Customer Content for up to 365 days after deletion from active systems, then are purged on a rolling basis unless a legal hold applies.
Account and billing records: retained for up to 7 years where required for tax, audit, and legal obligations under Australian law.

Unsent conversation drafts are cleared after approximately seven days as an operational default.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, export, or restrict processing of your personal information, and to object to certain processing or withdraw consent. To exercise a request, contact [email protected]. We will respond within one month, or inform you if an extension is required under applicable law.

You may lodge a complaint with your local data protection authority. In Australia, contact the Office of the Australian Information Commissioner (OAIC).

Security

Technical controls are described on the Security page and Security FAQ.

Children's privacy

DeskNova is a business-to-business product intended for working adults on behalf of a company or organization. It is not directed at children under 16, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this policy as the product, vendors, or legal requirements change. For material changes, we will provide at least 30 days' notice by email or through the Service before the changes take effect.

Contact

Questions about privacy can be sent to [email protected].