Privacy Policy

1. Company Information

RightDesk is operated by:

RightDesk acts as the data controller for personal data described in this Privacy Policy.

2. Third-Party API Services and User Data

RightDesk integrates with third-party services (such as email, calendar, and contact providers) to deliver CRM functionality. When you connect a third-party account, our use and transfer of information received from that provider's APIs will comply with the applicable provider's user data policies, including any limited use requirements.

With respect to data obtained through third-party API integrations, RightDesk will:

• Only access, use, and process third-party user data to provide user-facing features explicitly requested and enabled by the user.
• Only use third-party user data in ways that are directly related to CRM functionality.
• Not use third-party user data for advertising purposes.
• Not sell, rent, trade, or transfer third-party user data to any party for advertising, marketing, data brokerage, credit scoring, or profiling purposes.
• Not allow humans to read third-party user data except: with the user's explicit consent; when necessary for security or fraud investigation; when required by law; or when data is aggregated and anonymized for internal operational metrics.
• Not retain third-party user data longer than necessary to provide the requested functionality.

3. Information We Collect

3.1 Information You Provide

• Account Information: name, email address, company name, billing details, login credentials.
• CRM Data: contact records, notes, customer communications, attachments, and other data entered into the Service.
• Support Communications: information provided when contacting us.

3.2 Information from Third-Party Integrations

When you connect a third-party account, and depending on the permissions you grant, RightDesk may access:

• Sign-In Services: Name, email address, and profile image.
• Contact Services: Contact names, email addresses, phone numbers, and organization details.
• Calendar Services: Event titles, dates and times, descriptions, and attendee information.
• Email Services (If Enabled by User): Email metadata (sender, recipient, timestamp, subject line), email content, attachments, and thread identifiers.

Email Data Usage. Email data is used solely to: display email communication history within CRM records, associate emails with contact profiles, and enable user-initiated email logging and tracking. RightDesk does not analyze email content for advertising or share email content with third parties except as necessary to provide the Service.

3.3 Automatically Collected Information

• Usage data (feature usage, interactions)
• Device and browser information
• IP address
• Cookies and similar tracking technologies

4. How We Use Information

• 4.1 Provide the Service. Operate and maintain CRM features, sync contacts and calendar events, display user-requested email history, and send emails on behalf of the user (if enabled).
• 4.2 Improve Service Functionality. Improve CRM performance and reliability, fix bugs and enhance system stability, and optimize user interface and workflow functionality.
• 4.3 Security and Compliance. Detect and prevent fraud or abuse, protect system integrity, and comply with legal obligations.
• 4.4 Data Minimization. RightDesk limits access to third-party user data to the minimum scope necessary to provide the requested features. We do not access data unrelated to CRM functionality.

5. Data Sharing

RightDesk does not sell personal information or user data. We may share data only:

• 5.1 With Service Providers. With trusted vendors (e.g., cloud hosting providers) under confidentiality agreements and only as necessary to operate the Service.
• 5.2 Legal Requirements. If required by law or to protect rights and safety.
• 5.3 Business Transfers. In connection with a merger, acquisition, or asset sale, subject to notice and required consent.
• 5.4 With User Consent. When explicitly authorized by the user.

6. Data Retention

We retain personal information only as long as necessary to provide the Service and comply with legal obligations.

When a user disconnects a third-party account or deletes their RightDesk account, we will delete associated third-party user data within 30 days, unless retention is required by law or necessary for a documented security or legal matter.

7. Data Security

We implement industry-standard safeguards, including TLS 1.2+ encryption in transit, AES-256 encryption at rest, and role-based access controls.

Security Incident Response. In the event of a breach involving third-party user data, we will investigate promptly and notify affected users and the relevant third-party provider as required by applicable law and the provider's terms.

8. Your Rights

You may: access your personal information; correct inaccurate information; request deletion of your data; and export your data. To exercise any of these rights, contact us at contact@aluminum.io.

9. International Data Transfers

Data may be processed in countries outside your country of residence. We implement appropriate safeguards to ensure protection consistent with this policy.

10. Children's Privacy

RightDesk is not intended for individuals under 18. We do not knowingly collect data from minors.

11. Third-Party Links

We are not responsible for the privacy practices of third-party websites linked from our Service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice within the Service prior to the changes taking effect.

13. Contact Us