Privacy Policy

1. Who we are

OhMyDesk is coworking management software, available at ohmydesk.app, operated by Obod Soft EOOD (trading as Obod Soft LTD), jk Lazur 39 v.1 f.2 ap.5, Burgas, Bulgaria, company ID 207892162, VAT BG207892162, managing director Oleksandr Bodrov. For data we process about our own account holders and website visitors, Obod Soft is the data controller. You can reach us about privacy at [email protected].

2. Who this policy is for

This policy covers our website and the account you hold with us as a space operator. When a coworking space uses OhMyDesk to manage its own members, the space is the controller of its members’ data and OhMyDesk acts as its processor — handling that data only on the space’s instructions. If you’re a member of a space, contact that space about your data.

3. What we collect

• Account data — your name, email, organization details, and role.
• Operational data you enter — members, bookings, plans, invoices and similar records you create to run your space.
• Usage data — basic, privacy-friendly analytics about how the product and site are used.
• Communications — messages you send us for support.
• Payment data — when your space connects Stripe, card payments for your members are handled in your Stripe account; we do not store full card numbers on our servers.
• AI features — if you use the AI concierge, inbound visitor messages are sent to Google (Gemini) to generate replies. If you use the operator AI assistant (“Ask AI”), your current message is PII-redacted and sent to TypeSafe (Jev) in the United States to pick relevant playbook hints; Jev does not write replies — Google (Gemini) generates the answer. TypeSafe has zero data retention enabled for our organisation (since 2026-10-08): prompt content is processed in memory only and not stored.

4. Why we use it & our legal bases

• To provide and operate the service — performance of our contract with you.
• To secure, maintain, and improve the service — our legitimate interests.
• To send service and account emails — performance of our contract.
• To meet legal and accounting obligations — legal obligation.

5. Cookies & analytics

We use Umami Cloud (EU region), a cookieless analytics service, to understand aggregate usage. Requests are relayed through our own proxy, so Umami does not receive your IP address. It does not build advertising profiles or track you across other websites. We use only the cookies and local storage needed to keep you signed in and to run the service. Our site loads Google Fonts to render type, which may expose your IP address to Google for that purpose. See our Cookie Policy for details.

6. Subprocessors

We rely on a small set of trusted providers to deliver the service (each bound by appropriate data-protection terms). A fuller list for operator/member data is in our Data Processing Addendum, including:

• Supabase (Supabase Pte. Ltd.) — database, authentication, and file storage (EU, Ireland, AWS eu-west-1).
• Cloudflare (Cloudflare, Inc.) — website and application hosting / content delivery.
• Resend (Plus Five Five, Inc.) — transactional and notification email (EU sending region).
• Seam (Seam Labs, Inc.) — smart-lock door codes, where a space connects its locks.
• Google (Gemini API) — AI concierge and operator assistant reply generation, where enabled.
• TypeSafe (Jev) (TypeSafe AI, Inc.) — operator assistant playbook routing (PII-redacted prompts; zero data retention enabled).
• Umami (Umami Software, Inc.) — cookieless usage analytics via Umami Cloud (EU), through our proxy without visitor IP addresses.
• Google Fonts — web-font delivery when you use the site or app.

If you connect your own Stripe account for member payments, or your own WhatsApp Business account for the concierge, those providers contract with you directly for that processing. Optional Telegram and Sign in with Google may involve those providers as independent controllers under their own terms.

7. How long we keep it

We keep personal data for as long as your account is active and as needed to provide the service, then delete or anonymize it within a reasonable period — except where we must retain records longer to meet legal or accounting obligations.

8. Your rights

Subject to applicable law, you can request access to your personal data, correction, erasure, restriction or objection to processing, and portability. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority.

9. International transfers

Some of our providers process data outside your country. Our main database is hosted by Supabase in the European Union (Ireland). Where data leaves the EU/EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable.

Operator messages routed to TypeSafe (Jev) in the United States are transferred under EU Standard Contractual Clauses (TypeSafe’s DPA). TypeSafe has zero data retention enabled for our organisation (since 2026-10-08): prompt content is processed in memory and discarded, not stored or used for training.

10. Security

We use technical and organizational measures — encryption in transit, access controls, and row-level data isolation between organizations — to protect personal data. No method of transmission or storage is completely secure, but we work to protect your information.

11. Children

OhMyDesk is a business tool and is not directed at children. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify you, and we’ll update the “last updated” date above.

13. Contact

Questions about your privacy? Email [email protected].