The conversation may be automated. Our responsibility is not.

This Privacy Policy applies to NevoDesk websites, applications, communications, support, and AI front-desk services (the “Services”). “Personal information” means information that identifies, relates to, describes, or can reasonably be linked with an individual or household.

When NevoDesk decides why data is used

NevoDesk acts as a controller or business for information about website visitors, account holders, prospects, and people who contact NevoDesk directly. We use that information for account administration, security, support, billing, and operation of our own business.

When a business customer decides why data is used

A business using NevoDesk generally controls the customer and conversation data processed in its workspace. For that data, NevoDesk acts as a processor or service provider and follows the business’s documented instructions. The business is responsible for its privacy notice, lawful basis, recording and messaging disclosures, and responses to its customers’ requests. NevoDesk assists as required by contract and applicable law.

We collect information directly from businesses and users, from people who communicate with a NevoDesk-powered business, automatically from devices and service activity, and from integrations a business chooses to connect.

We may process sensitive information when a customer intentionally uses the Services for a workflow that requires it—for example health-related scheduling, precise service locations, payment status, or the contents of private communications. Customers should configure collection to the minimum necessary for the approved workflow.

We use personal information to:

• Provide, secure, maintain, troubleshoot, and support the Services.
• Answer and route communications and complete customer-authorized workflows.
• Coordinate calendars, staff, capacity, service areas, and human handoffs.
• Create and manage bookings, jobs, leads, orders, reservations, payments, and support cases.
• Authenticate users, enforce role and location permissions, and maintain audit records.
• Process subscriptions, calculate disclosed fees, reconcile transactions, and prevent fraud.
• Improve reliability, accessibility, safety, and product performance using aggregated, de-identified, or customer-authorized data.
• Communicate about accounts, security, service changes, support, and—with appropriate choice—marketing.
• Comply with law, enforce agreements, and protect people, businesses, and the Services.

Where applicable law requires a legal basis, we process information to perform a contract, follow customer instructions, comply with legal obligations, protect legitimate interests that do not override individual rights, or based on consent.

NevoDesk uses machine-learning and language-model systems to understand requests, transcribe and summarize communications, retrieve approved business information, recommend actions, and prepare structured records. Relevant Service Data may be sent to vetted model and infrastructure providers solely to provide these functions.

• NevoDesk does not use Service Data to train shared foundation models unless the customer expressly opts in.
• Businesses configure approved knowledge, authority limits, escalation rules, and human handoffs.
• AI outputs can be incomplete or incorrect and must be reviewed when the context carries material risk.
• NevoDesk is not designed to make solely automated decisions that produce legal or similarly significant effects.
• Users can correct business information and workspace records, and businesses can correct or override AI-generated drafts.

A NevoDesk-powered interaction may involve an AI voice, automated transcription, recording, messaging, or routing. Whether recording is enabled depends on the business’s configuration and applicable law.

• Businesses must give legally required AI, recording, monitoring, and messaging notices and obtain required consent.
• NevoDesk provides disclosure and configuration controls but does not determine which consent rule applies in every jurisdiction.
• Recordings and transcripts may contain sensitive information. Do not provide information that is unnecessary for the request.
• If you do not want a call recorded or transcribed, tell the business and ask for an available alternative channel.
• Messaging opt-outs are applied according to channel rules and the business’s obligations.

When payment features are enabled, payment-card and bank-account details are collected directly by the payment provider, such as Stripe. NevoDesk receives identifiers, amounts, status, refunds, disputes, and related records needed to connect the payment to the business workflow. We do not intend to store complete card numbers or card security codes.

The connected business is the merchant of record for payments made by its customers and controls fulfillment, taxes, refund decisions, and dispute evidence. Payment-provider privacy terms also apply.

We disclose information only as reasonably necessary to:

• Make workspace data available to the business and its authorized users.
• Use contracted infrastructure, hosting, database, communications, AI, email, support, security, analytics, and payment providers.
• Connect calendars, CRM, messaging, accounting, payment, or other integrations selected by the business.
• Follow a customer instruction, complete a requested transaction, or support an authorized handoff.
• Respond to lawful process or protect rights, safety, security, and service integrity.
• Support a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice obligations.

NevoDesk uses administrative, technical, and organizational safeguards designed for the sensitivity of the data and the nature of the Services. These include workspace separation, role and location access controls, authentication protections, encryption in transit and at rest where supported, audit events, secrets management, restricted administrative access, monitoring, backups, and incident-response procedures.

No system is completely secure. Customers must use strong authentication, limit user access, review permissions and connected systems, maintain accurate administrators, and notify security@nevodesk.com promptly of a suspected compromise. If a security incident affects personal information, NevoDesk will investigate, contain, remediate, and provide notices as required by contract and law.

We retain information only for as long as reasonably necessary for the purposes described in this policy, the customer’s configured or contracted retention period, legal and financial recordkeeping, security, dispute resolution, and enforcement. Different records have different retention needs.

• Workspace content follows plan, workspace, and contract settings where available.
• Businesses may delete or export supported records before account closure.
• We may retain audit, billing, fraud-prevention, and legal records where required or reasonably necessary.
• Deleted information may remain in protected backups for a limited restoration cycle and is not returned to active use except for recovery.
• Aggregated or de-identified data that cannot reasonably identify a person may be retained.

Depending on where you live and our role, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, limit use of sensitive information, or appeal a denied request. You will not be discriminated against for exercising a privacy right.

Email privacy@nevodesk.com. Describe your relationship to NevoDesk, the relevant business or workspace, and the right you want to exercise. We may verify identity and authority, and an authorized agent may be asked for proof of authorization. If NevoDesk processes the data only for a business customer, we may refer the request to that business or assist it in responding.

Because NevoDesk does not sell personal information or share it for cross-context behavioral advertising, there is no sale or advertising sharing to opt out of. We will honor applicable browser-based privacy signals if our practices later fall within a law that requires them.

NevoDesk and its providers may process information in the United States and other countries that may have different data-protection laws. Where required, we use contractual, organizational, and technical safeguards intended to support lawful transfers. Enterprise customers may request applicable data-processing and transfer terms.

The same principle applies to other specially regulated information, including government identifiers, full payment credentials, biometric identifiers used for identification, children’s data, education records, and information subject to financial, legal, or professional secrecy duties. Contact legal@nevodesk.com before enabling such a workflow.

NevoDesk is a business service and is not directed to children under 13. We do not knowingly create accounts for children. A business serving minors is responsible for obtaining required parental or guardian authorization and must use only an approved configuration. Contact us if you believe a child’s information was collected improperly.

We may update this policy as the Services, providers, or law change. We will post the updated version, revise the effective date, and provide additional notice for material changes when required.

Privacy requests: privacy@nevodesk.com
Security reports: security@nevodesk.com
Legal and contractual questions: legal@nevodesk.com
General support: support@nevodesk.com