Privacy policy

Who we are

Crosdesk is made by Buddhyantra LLP (“we”, “us”). This policy explains what personal data we handle through the website at crosdesk.com, the hosted service at app.crosdesk.com, and our sales and support conversations, and what you can ask us to do with it.

For anything in this policy, write to hello@buddhyantra.com.

Self-hosted installations

Most organisations run Crosdesk on their own servers or cloud account. In that case the organisation running the installation decides what is collected and keeps all of it. Your tasks, files, accounts and logs are stored in that installation's own database and storage, and are not sent to us.

The licence is checked inside the installation against a signature, with no call to us, and the software sends us no usage data. If you use a self-hosted installation, the organisation that runs it is responsible for your data. Ask its administrator about its own policy.

The Crosdesk Recorder browser extension sends what it records only to the Crosdesk address it is signed in to, which is your organisation's installation or app.crosdesk.com.

This website

• No cookies, analytics or tracking. The site remembers whether you chose light or dark mode in your browser's local storage. That choice never leaves your device.
• Fonts. Pages load the Inter typeface from Google Fonts, so your browser sends your IP address to Google when it fetches it. Google's handling is described in its privacy policy.
• Server logs. Our hosting and network providers record the IP address, requested page, time and browser of each visit, to deliver the site and protect it from abuse.
• The demo request form sends nothing itself. It opens your own email app with a message addressed to us, and we receive only what you choose to send.

The hosted service

When you sign up at app.crosdesk.com, or are invited to a workspace there, we hold:

• Your account: email address, name, and optionally your phone number and job role. We store your password only as a one-way hash. If you sign in with Google, GitHub or another identity provider, we also store the identifier it gives us for you.
• Workspace content: everything you and your colleagues create, including tasks, projects, comments, documents, meetings, files, screen recordings with their console and network logs, and links to pull requests.
• Security records: sign-in sessions, and an audit trail of actions with the IP address and device they came from. Workspace administrators can read their workspace's trail.
• Email: the address and content of messages we send you, such as sign-in codes, invitations and password resets.

The service uses cookies only to keep you signed in and to protect your session. They are necessary for it to work, and none are used for tracking or advertising.

The organisation that owns a workspace decides who is in it and what is kept there. For content in a workspace, we act on that organisation's behalf.

How we use it, and why

• To provide the service you asked for: signing you in, showing your work to the people your workspace allows, and sending the email the service needs.
• To keep it secure: detecting abuse, investigating incidents, and keeping the audit trail your administrators rely on.
• To answer you: replying to demo, sales and support requests, and keeping a record of what was agreed, including licences we issue.
• To meet legal obligations, such as tax and accounting records.

We do not sell personal data, use it for advertising, or train AI models on your content. AI agents act in a workspace only when someone in it connects one, and only with that person's access.

Who else handles it

We use a small number of providers to run the website and the hosted service. Each handles data only to provide its service to us.

When a workspace connects GitHub, Google, Zoom or an AI client, data passes to that service as the connection requires, under that service's own terms. We may also disclose data where the law requires it, or to a successor if the business is transferred, under this policy.

These providers may process data outside your country, including in the United States and India. Where the law requires it, we rely on the safeguards it allows for such transfers.

How long we keep it

• Accounts and workspace content: while the account or workspace exists. When you ask us to close it, we delete it, except where we must keep records by law.
• Screen recordings: ninety days at most, and thirty days after the work they are linked to is done if that is sooner.
• Unfinished sign-ups, expired invitations and one-time codes are discarded once they lapse.
• Sales and support email: as long as needed to follow up, and for licensing and accounting records as long as the law requires.

Security

Data travels over HTTPS. Passwords are hashed and stored secrets are encrypted. Each workspace is kept separate from the others, and access inside one is limited by department. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

Your rights

Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, receive a copy of it, or object to or restrict how we use it. You can also withdraw any consent you gave. Write to hello@buddhyantra.com and we will answer within a month, or sooner where the law requires.

For content in a workspace, we may refer you to the organisation that owns it, since it decides what is kept there. You may also complain to your data protection authority. In India that is the Data Protection Board of India.

Children

Crosdesk is a tool for organisations and is not meant for children. We do not knowingly collect data from anyone under 18.

Changes to this policy

When this policy changes, we update the date at the top. If a change materially affects how we use data in the hosted service, we will tell account holders by email before it takes effect.