Summary: We respect your privacy. Your data is stored on servers in the Netherlands (EU). For the AI feature, OpenAI (United States) processes messages; that transfer is covered by the EU Standard Contractual Clauses (SCCs). We never sell your data to third parties, and you always have control over your data.
1. Who are we?
LimeDesk is a provider of AI-driven customer service solutions. We are responsible for the processing of personal data as described in this privacy policy. For the data of our customers' own customers (for example visitors who ask a question via chat or email) we act as a processor on behalf of our customer; the data processing agreement applies to that.
- Company name: LimeDesk
- KvK (Chamber of Commerce): 99420929
- VAT: NL005386326B53
- Email: info@limedesk.ai
2. What data do we collect?
We collect the following categories of data:
- Account data: name, email address, company name, billing address.
- Usage data: chat conversations, email content (to create replies and draft replies), knowledge base content, configuration settings. We do not use this data to train AI models.
- Technical data: IP address, browser type, device information.
- Payment data: processed by our payment provider (Mollie) and not stored by us.
3. What do we use your data for?
We process your data for:
- Providing and improving our AI services.
- Personalizing the AI to match your tone of voice.
- Billing and customer support.
- Sending important service updates.
- Analyzing and improving our service.
4. How long do we retain your data?
We retain your data for as long as you are a customer. After termination of your account, your data is deleted within 90 days, unless otherwise legally required: invoice and payment data are kept for 7 years because of tax obligations.
Conversations with your customers (chat, email and the messages in the inbox), email drafts and technical logs are deleted automatically once they are older than the retention period you choose in the dashboard under Settings → Privacy: 30, 90, 180 or 365 days, or no automatic deletion. If you do not choose, 1 year applies. The access log (who logged in or viewed data, and when) is kept for 12 months. Encrypted backups are deleted after 14 days, so deleted data also disappears from the backups by then at the latest.
5. Do we share your data?
We only share your data with the following sub-processors:
- OpenAI (United States) — AI processing of messages. The transfer to the US is covered by the EU Standard Contractual Clauses (SCCs).
- Mollie (Netherlands) — payment processing.
- TransIP (Netherlands) — hosting of the server (VPS) and email.
Integrations you switch on yourself (such as Shopify, Slack, Telegram or Zapier/webhooks) only receive or provide the data needed for that integration. If you pay through Shopify, Shopify processes that payment.
Facebook Messenger, Instagram and WhatsApp (Meta). If you connect your Facebook Page, Instagram account or WhatsApp Business number, we receive through Meta the messages that customers send to your business: the message content (including attachments), the sender's name and profile ID, for WhatsApp the phone number, and the profile picture if it is public. We use this data only to show the messages in your inbox and to reply to them on your behalf (by the AI or by you and your team). We do not use it for advertising or profiling, we do not sell it and we do not train AI models with it. It is stored on our own server in the Netherlands and deleted automatically according to the retention period you choose (see section 4). If you remove LimeDesk in the settings of Facebook, Instagram or WhatsApp (or ask us to disconnect), our access tokens stop working and we no longer receive new messages. If you want us to delete all data of a connection or of a single customer, email info@limedesk.ai; we complete this within 30 days.
We never sell your data to third parties.
6. Your rights
Under the GDPR you have the following rights:
- Access: you can request which data we hold about you.
- Correction: you can have incorrect data corrected.
- Erasure: you can request deletion of your data.
- Portability: you can request your data in a common format.
- Objection: you can object to certain processing.
To exercise your rights, contact us at info@limedesk.ai.
7. Security
We take appropriate technical and organizational measures to protect your data, including:
- SSL/TLS encryption for all data transfer.
- Passwords are stored hashed (bcrypt) and Shopify access keys encrypted (AES-256-GCM).
- The database and attachments are stored encrypted on the server's disk (AES-256).
- Daily, encrypted backups.
- Access control and an access log (logins and access to conversations), plus an incident response plan.
8. Cookies
We use functional cookies that are necessary for the website to work. For analytics and marketing cookies (such as Google Analytics, Google Ads and Meta Pixel) we first ask for your consent via the cookie notice. If you decline, we don't place them.
9. Changes
This privacy policy may be amended. Significant changes will be announced at least 30 days in advance via email.
10. Contact and complaints
For questions about this privacy policy or to file a complaint:
- Email: info@limedesk.ai
You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.