Privacy policy
Effective October 19, 2026
Deskwil is a help desk service: teams use it to run a shared ticket queue, receive customer email as tickets, keep a knowledge base and track SLAs. This page explains what personal data Deskwil handles, why, where it lives, who helps us process it, and what you can do about it. It covers the Deskwil website, the web app at app.deskwil.com and the installable app version of it (including the Windows app from the Microsoft Store, which is the same web app in its own window).
Who is responsible
Deskwil is operated by Rafael Fernandes, trading as Comwil, Feldweg 17, 8134 Adliswil, Switzerland. There are two roles to keep apart:
- For your own account (your name, email address, sign-in and security details), we decide why and how the data is used, so we are the controller.
- For a workspace's content (tickets, messages, attachments, customer contacts and knowledge base articles), the organisation that owns the workspace decides what goes in and why. We process that content on its behalf, as its processor. If you are a customer of an organisation that uses Deskwil, that organisation is your first point of contact for questions about your tickets.
What we process
- Account data: name, email address, a hashed password (we cannot read it), optional profile picture and job title, and your role in each workspace.
- Two-factor authentication: if you turn it on, the authenticator secret (stored encrypted) and recovery codes (stored hashed).
- Workspace content: tickets and their messages, internal notes, attachments, customer contact details, knowledge base articles and the settings that control them. This is whatever the workspace's members and customers put in.
- Connected mailboxes: if a workspace connects a support mailbox, the mail server details and the mailbox password (stored encrypted), and the emails Deskwil fetches from it to turn them into tickets and replies.
- Activity and security records: an audit log of important actions in a workspace and security events such as failed sign-ins, with IP addresses and browser details where relevant. These exist to keep accounts safe and to let workspace owners see who did what.
- Billing data: the workspace's plan, seat count and Stripe customer and subscription references. Card numbers are handled only by Stripe.
- Cookies and local storage: a session cookie and a security token (CSRF) that keep you signed in and protect forms, and a few interface preferences stored in your browser (for example whether the sidebar is collapsed). The installable app also keeps a copy of its own interface files so it can show an offline notice; it does not store your tickets offline. We do not use advertising or analytics cookies.
Why we process it, and on what basis
- To provide the service you or your organisation signed up for (contract).
- To secure the service, prevent abuse and fix faults, including the activity and security records above (our legitimate interest in running a safe service).
- To take payments and meet accounting and tax duties (contract and legal obligation).
- To answer you when you write to us (legitimate interest, or contract where it concerns your account).
We do not sell personal data, and we do not use workspace content for advertising or to train AI models.
Where the data is, and who helps us
Production data is stored and processed in Germany. Encrypted backups are kept with Cloudflare in Eastern Europe. These providers process data for us:
| Provider | What it does | Where |
|---|---|---|
| OVH | Hosting: the application server, the database and file storage. | Limburg, Germany |
| Cloudflare | DNS, TLS and the network edge in front of Deskwil, plus encrypted off-site backups (R2). | Global edge network; backups in Eastern Europe |
| Stripe | Payment processing for paid plans. Card details go to Stripe; Deskwil never stores them. | Per Stripe’s own terms |
| Resend | Sending Deskwil’s own system emails (invitations, password resets, notifications). | Per Resend’s own terms |
| Bunny Fonts | Serving the Figtree typeface to your browser (your IP address is visible to this host when it loads). | EU-based provider |
If a workspace connects its own mailbox from another provider (for example Google or Microsoft), that provider handles the mailbox under the workspace's own agreement with it. Where a provider is outside Switzerland or the EU/EEA, the transfer relies on the safeguards the law provides for, such as standard contractual clauses. We will update this list before adding a new provider.
How long we keep it
- Account and workspace content stay while the account or workspace exists. When you delete your account you are asked to transfer or delete any workspace you own; deleting a workspace removes its content.
- Audit log entries are deleted automatically after a window set by the workspace's plan: 30 days on Free and Pro, one year on Enterprise. Platform-level audit entries are kept for one year. Security event records (such as failed sign-ins) are kept for as long as they are needed to investigate incidents.
- Deleted data can remain in encrypted backups until those backups are overwritten in their normal rotation. It is not restored into the live service except to recover from a failure.
- Billing records may be kept as long as accounting and tax law requires.
How we protect it
Traffic is encrypted with TLS. Passwords are hashed; mailbox passwords and authenticator secrets are encrypted at rest. Sign-ins can be protected with two-factor authentication, access is limited by role, and security-relevant actions are logged. The service is built to the OWASP ASVS Level 2 security standard. No system is perfectly secure; if a breach affects your personal data we will tell the affected organisations and, where the law requires it, the authorities, without undue delay.
Your rights
Under the Swiss Federal Act on Data Protection and, where it applies, the GDPR, you can ask for access to your personal data, correction, deletion, a copy in a portable format, restriction of processing, and you can object to processing based on our legitimate interest. You can edit your details and delete your account yourself under Profile in the app. For anything else, write to us (below). If your data is in an organisation's workspace, we may need to pass your request to that organisation. You also have the right to complain to a data protection authority, for example the Swiss FDPIC or the authority where you live.
Children
Deskwil is a business tool and is not meant for children under 16. We do not knowingly create accounts for them.
Changes to this policy
If we change this policy in a meaningful way we will update the date above and, for changes that affect account holders, tell them in the app or by email.
Contact
Rafael Fernandes, Comwil, Feldweg 17, 8134 Adliswil, Switzerland. Email [email protected].