Legal

Privacy Policy

This policy explains what personal data OhMyDesk collects, why, how we protect it, and the rights you have over it.

Last updated:

1. Who we are

OhMyDesk is coworking management software, available at ohmydesk.app, operated by Obod Soft EOOD (trading as Obod Soft LTD), jk Lazur 39 v.1 f.2 ap.5, Burgas, Bulgaria, company ID 207892162, VAT BG207892162, managing director Oleksandr Bodrov. For data we process about our own account holders and website visitors, Obod Soft is the data controller. You can reach us about privacy at [email protected].

2. Who this policy is for

This policy covers our website and the account you hold with us as a space operator. When a coworking space uses OhMyDesk to manage its own members, the space is the controller of its members’ data and OhMyDesk acts as its processor — handling that data only on the space’s instructions. If you’re a member of a space, contact that space about your data.

3. What we collect

4. Why we use it & our legal bases

5. Cookies & analytics

We use Umami Cloud (EU region), a cookieless analytics service, to understand aggregate usage. Requests are relayed through our own proxy, so Umami does not receive your IP address. It does not build advertising profiles or track you across other websites. We use only the cookies and local storage needed to keep you signed in and to run the service. Our site loads Google Fonts to render type, which may expose your IP address to Google for that purpose. See our Cookie Policy for details.

6. Subprocessors

We rely on a small set of trusted providers to deliver the service (each bound by appropriate data-protection terms). A fuller list for operator/member data is in our Data Processing Addendum, including:

If you connect your own Stripe account for member payments, or your own WhatsApp Business account for the concierge, those providers contract with you directly for that processing. Optional Telegram and Sign in with Google may involve those providers as independent controllers under their own terms.

7. How long we keep it

We keep personal data for as long as your account is active and as needed to provide the service, then delete or anonymize it within a reasonable period — except where we must retain records longer to meet legal or accounting obligations.

8. Your rights

Subject to applicable law, you can request access to your personal data, correction, erasure, restriction or objection to processing, and portability. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority.

9. Deleting your account

You can ask us to delete your OhMyDesk account at any time. This covers the website and the OhMyDesk mobile app, which use the same account.

We delete your sign-in and profile, your linked Google sign-in, the push tokens of your devices and, if you ask us to delete your space, the data you entered to run it (members, bookings, plans, tasks and similar records). We keep only records the law requires us to keep, such as invoices and accounting records, for the legal retention period (up to 10 years), and then delete them. Copies in our database backups expire on their normal rotation.

If you are a member of a coworking space, the space controls your data (see section 2): ask the space to delete it, or email us and we will pass your request on.

10. International transfers

Some of our providers process data outside your country. Our main database is hosted by Supabase in the European Union (Ireland). Where data leaves the EU/EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable.

Operator messages routed to TypeSafe (Jev) in the United States are transferred under EU Standard Contractual Clauses (TypeSafe’s DPA). TypeSafe has zero data retention enabled for our organisation (since 2026-10-08): prompt content is processed in memory and discarded, not stored or used for training.

11. Security

We use technical and organizational measures — encryption in transit, access controls, and row-level data isolation between organizations — to protect personal data. No method of transmission or storage is completely secure, but we work to protect your information.

12. Children

OhMyDesk is a business tool and is not directed at children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify you, and we’ll update the “last updated” date above.

14. Contact

Questions about your privacy? Email [email protected].