← Back to l1desk

Privacy Policy

Last updated: November 07, 2026

1. Overview

This Privacy Policy describes how l1desk collects, uses, and protects your information when you use this application ("the App").

l1desk is a hosted AI-powered technical support application operated by WebHarbor Technologies LLC, 28 Church St, Ste 14 #6383, Winchester, MA 01890, which is the data controller for all personal data collected through the App. You access the App through a web browser; we operate and secure the infrastructure on which your data is stored.

2. Information We Collect

Account Information

When you create an account, we collect:

  • Email address (required)
  • Name (optional)
  • Password — stored as a cryptographic hash; never stored in plain text
  • If you sign in with Google: the email address Google verifies for your account, your display name, and a stable account identifier

Workspace Information

Creating an account also creates your organization (workspace). We collect:

  • Organization name and the role of each member
  • Widget settings: the chat widget title, colors, and greeting
  • Escalation settings: the escalation email address, the confidence threshold, and the auto-escalation preference

Content You Create

  • Documents: the files you upload, their folder names, and the indexed text we derive from them
  • Chat history: the questions asked in the dashboard chat or through your deployed chat widget, and the AI answers
  • Escalation records: a short excerpt of any question an AI answer was flagged on, with its confidence score

Automatic Information

  • Session cookie: a session cookie for authentication (see Section 9)
  • Server logs: request metadata retained for security and troubleshooting

Information We Do NOT Collect

  • No analytics tracking (no Google Analytics, Plausible, Hotjar, Mixpanel, or any other analytics provider)
  • No telemetry or error reporting to external services
  • No tracking cookies or pixels
  • No third-party CDN resources (all JavaScript and CSS are served locally)
  • No browser fingerprinting or device profiling

3. How We Use Your Information

We use your information solely to:

  • Authenticate you and manage your session
  • Store your documents, settings, and conversation history
  • Generate AI-powered answers from your own documents (Section 5)
  • Record and route escalations to your team
  • Log access for security, troubleshooting, and rate limiting
  • Check service availability in your region when you create an account

Lawful Basis for Processing (GDPR)

Under applicable data protection laws, including the GDPR, our lawful bases for processing your personal data are:

  • Performance of a contract (GDPR Art. 6(1)(b)): Processing is necessary to provide the App to you — storing your account credentials, documents, settings, and conversation history.
  • Legitimate interests (GDPR Art. 6(1)(f)): Logging access for security, troubleshooting, and rate limiting. If we ever integrate the App with other services operated by WebHarbor Technologies LLC, the processing that integration requires will be described in an updated Privacy Policy, and we will notify you by email before the change takes effect.
  • Consent (GDPR Art. 6(1)(a)): Optional — using the AI chat feature, which sends your questions, together with passages from your own documents, to a third-party LLM provider. You may withdraw consent at any time by simply not using the chat feature.

4. Data Storage and Retention

All user data is stored on our servers, located in the United States. Data is retained until you delete your account or request deletion (see Section 8).

We create scheduled backups of our databases. Deleted data is removed from backups as they are overwritten. In the event of a data breach affecting your personal data, we will notify you as required by applicable law.

Data Retention Period

We retain your personal data only as long as your account is active.

International Data Transfers

Your data is stored on servers in the United States. If you access the App from the European Economic Area, the United Kingdom, or other jurisdictions outside the US, your data will be transferred to the US. We implement appropriate safeguards for such transfers, including Standard Contractual Clauses (SCCs) adopted by the European Commission, to ensure your data receives protection equivalent to that guaranteed under EU data protection law.

5. AI-Powered Answers

When you ask a question in the dashboard chat, or when one of your customers asks a question through the chat widget you deploy, we send the following to a third-party LLM API provider:

  • The question text
  • Relevant passages from your own uploaded documents

We do not send the questioner's name, email address, user ID, or any other identifying information to the LLM. The LLM receives only the question text and passages from your own documents. Document parsing, indexing, and retrieval happen on our own infrastructure.

We do not use your documents or conversations to train AI models.

6. The Chat Widget and Your Customers

You can deploy l1desk's chat widget on your website. When your customers use it, their questions and the AI answers are stored in your organization's conversation history, and escalated questions appear in your organization's escalation queue. If you configure an escalation email address in Settings, we notify that address about escalated questions.

What We Process on Your Behalf

When one of your customers uses the widget, the information we process on your behalf is:

  • A pseudonymous visitor id: a random identifier generated in your customer's browser, used only to resume their conversation thread and to rate-limit abuse. It does not identify your customer and is not sent to the LLM provider (Section 5).
  • Their IP address: used only for rate limiting (Section 3)
  • Their name, email address, and an optional note: only if your customer provides them when an answer is escalated to your team, so that you can reply directly

You are the data controller for the information your customers share with your business; we process that information on your behalf. You are responsible for telling your customers that your site uses an AI support widget, describing it in your own privacy notice, and complying with the privacy laws that apply to your customers.

7. Third-Party Service Providers

We may share your personal data with the following categories of service providers and contractors who process data on our behalf:

  • LLM provider — a third-party LLM API, for AI-powered answers. We send only question text and passages from your own documents; no name, email, or identifying metadata is shared. This provider is bound by contractual obligations to process data only as instructed.
  • Email provider — a third-party email service, for transactional email (account activation, password reset, escalation notifications). We share only the recipient's email address and the message content.
  • Google — for OAuth authentication. We exchange your authorization for your provider-verified email address and display name. This information is stored locally and never shared with Google after the initial exchange.
  • Hosting infrastructure — our server hosting providers store your data. They process data solely on our instructions and have no independent right to use it.

8. Your Rights

Under applicable data protection laws (including GDPR for EU residents, CCPA/CPRA for California residents, and other applicable laws), you have the right to:

  • Access: Request a copy of all your personal data stored in the App. Contact us at [email protected].
  • Rectification: Correct inaccurate or incomplete data. Contact us at [email protected].
  • Erasure: Request deletion of your account and all associated data, including your documents and conversation history.
  • Portability: Export your data in a machine-readable format. Contact us at [email protected].
  • Object: Object to processing based on legitimate interests (GDPR Art. 21). Contact us at [email protected].
  • Limitation of Processing: Request restriction of processing of your personal data (GDPR Art. 18).
  • Non-Discrimination: We will not discriminate against you for exercising your data protection rights (CCPA/CPRA).

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

Right to Lodge a Complaint

If you believe your data has been processed in violation of applicable law, you have the right to lodge a complaint with a data protection supervisory authority. For EU residents, this is the supervisory authority in your member state of residence, place of work, or the place of the alleged infringement. For California residents, complaints may be filed with the California Privacy Protection Agency.

9. Cookies

The App uses only one cookie:

  • Session cookie (authjs.session-token): Used for authentication.
    • Attributes: HttpOnly, Secure, SameSite=Lax, path=/
    • Duration: 30 days (sliding on activity)
    • Purpose: Maintain your authenticated session
    • This cookie is essential for the App to function

There are no tracking cookies, advertising cookies, or third-party cookies.

10. Data Sharing

We do not sell, rent, or share your personal information with third parties. The only external data transfers are to the providers described in Section 7.

We do not share your data with other companies at this time. If we ever do, we will update this Privacy Policy and notify you via email before the change takes effect.

11. Children's Privacy

This App is not directed to individuals under the age of 13. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date.

13. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at [email protected].

Data Controller: WebHarbor Technologies LLC [email protected]

AboutTerms