SCREENDESK SAS, SIREN 920 766 383, 7 allée du Long, 26500 Bourg-lès-Valence, France, is responsible for the processing described here as controller. Contact support@screendesk.io for privacy questions or requests.
This notice covers our marketing website, business relationships, accounts and service operations. It explains our practices; reading or using the website is not consent to optional processing.
1. Who decides how your data is used?
We are a controller for information used to manage our business relationship with you, administer accounts and billing, answer enquiries, secure our service and operate our website.
For recordings, calls, screenshots, reports, diagnostics, transcripts, knowledge sources and other content handled for a customer workspace, the customer normally decides the purpose and we act as its processor. The customer may itself be a processor. Our DPA governs that processing. The organization's privacy notice and instructions also matter: contact it first about content it collected through Screendesk. We will assist the customer and direct requests appropriately.
Joining a call, viewing a recording or recording an issue does not require you to become a paying customer. Workspace administrators may manage team membership, access, sharing and retention, subject to their permissions and obligations.
2. Information we receive
- Account and business information: name, work email, organization, role, authentication identifiers, account preferences and communications. Authentication providers may supply the information needed for sign-in.
- Billing information: billing contact and address, plan, invoices, subscription and transaction references. Payment providers process payment details; we do not need your full card number to provide support.
- Customer content: screen, camera and microphone recordings, screenshots, call participant information, transcripts, titles, comments, reports, imported documents and AI inputs and outputs. A screen recording may reveal information about people other than the person recording.
- Technical context: depending on the recording method and enabled features, browser and device details, visited URLs, console messages, network-request details and error information. Diagnostics can contain identifiers or content from the page being investigated. Not every capture method collects the same information.
- Usage and security information: IP address, browser and operating system, timestamps, service actions, access logs, error reports and information needed to investigate misuse or service failures.
- Website and communication information: enquiries, meeting requests, support messages, marketing preferences and, with the required consent, website measurements and similar tracking data.
We receive information directly from you, from your organization and its users, from people interacting with its recordings or calls, from authorized integrations and authentication providers, and from technical operation of the service. We may also use public professional contact information for relevant business communications where lawful.
3. Purposes and legal bases
For processing where we are controller, we rely on these bases where applicable:
| Purpose | Legal basis |
|---|---|
| Create and administer your account; provide a service you purchase personally as a professional | Performance of our contract with you |
| Administer an organization's subscription and communicate with its representatives | Legitimate interests in providing and managing business services |
| Prevent fraud, secure accounts, diagnose failures and maintain service quality | Legitimate interests in protecting customers and operating a reliable service; legal obligations where applicable |
| Billing, accounting, tax records and lawful requests | Contract and applicable legal obligations |
| Answer enquiries, provide support and manage business relationships | Contract where applicable; otherwise legitimate interests in responding and supporting users |
| Send relevant professional marketing | Consent where required, or legitimate interests where law allows, with an easy opt-out |
| Optional website analytics and trackers | Consent |
| Establish or defend legal claims | Legitimate interests in protecting legal rights |
We consider the impact on individuals when relying on legitimate interests. You may object as described below. If required account or billing information is not provided, we may be unable to provide the requested service. Optional information and optional tracker consent are not conditions for browsing our website.
For customer-controlled content, the customer determines the lawful basis. We do not reuse that content for unrelated marketing or general-purpose model training.
4. Recordings, live calls and AI
The organization inviting you to record or join a call controls what it requests and how it uses the result. Review the information shown in the recording or call flow. Close unrelated tabs and conceal sensitive information before sharing your screen. A recording or diagnostic report may include voices, faces, messages or data visible in the captured application.
Screendesk can process content to transcribe speech, summarize issues, structure reports, search knowledge, suggest answers and perform configured automations. Depending on the feature, AI providers may receive text, audio, video, screenshots or relevant document excerpts. We do not describe this processing as text-only. Our AI Terms explain the purposes and customer controls. AI outputs can be inaccurate and need review. We do not use the service to make solely automated decisions about individuals with legal or similarly significant effects on our own behalf.
5. Google Workspace API data
Our use and transfer of information received from Google Workspace APIs complies with the Google Workspace API User Data and Developer Policy, including its Limited Use requirements. This applies to raw, aggregated, anonymized and derived data. We do not use or transfer it to create, train or improve foundational or generalized AI/ML models.
These restrictions prevail over any general permission in this notice. Connected calendar and other Workspace information is used for the user-facing functions you authorize, with access limited to what those functions require. Disconnecting an integration stops future authorized access; contact us or your workspace administrator about deletion of data already imported.
6. Who receives information?
We share information only as needed with:
- Providers for infrastructure, storage, media delivery, live calls, AI, security, error monitoring, communications, billing, analytics and support, under appropriate contractual protections. See our provider register.
- Your workspace's authorized users, administrators and recipients you or your organization choose through links, embeds, exports and integrations.
- Professional advisers and authorities where necessary for legal duties, protecting rights or responding to valid legal process. We seek to limit disclosures and notify the customer when legally permitted.
- A prospective or actual successor in a business transaction, subject to appropriate confidentiality and continued protection of personal data.
We do not sell personal information or share it for cross-context behavioral advertising. We do not use customer recordings to build advertising profiles. A customer's sharing choices and independently connected applications are governed by that customer's instructions and those services' practices.
7. International processing
We are based in France and use providers that may process information in the EEA and other countries, including the United States. An EU storage selection for media does not automatically restrict all processing, support or provider operations to the EU.
Where a transfer requires safeguards, we use an applicable adequacy decision or appropriate contractual safeguards, including the European Commission's standard contractual clauses and applicable UK or Swiss adaptations, with supplementary measures where necessary. A vendor's security certification alone is not a transfer mechanism. Contact us for information about the safeguards relevant to your data or a copy, subject to protection of confidential information.
8. Retention and deletion
We retain personal information only for its purpose, required legal retention and justified security or claims needs. Retention depends on the type of data and your relationship with us:
- Customer content follows the workspace's instructions and applicable DPA. The standard DPA provides a 30-day export window, deletion from active systems within 30 days after that window or an earlier valid deletion instruction, and expiry of residual backups within 60 days of active deletion, unless law requires retention.
- Account and relationship information is kept while needed to administer the relationship, then removed or limited to records justified for legal, accounting or security needs.
- Accounting records are retained for the legally applicable period, including ten years for French accounting documents where required.
- Support and security records are retained for the investigation, support or protection purpose and any applicable limitation period, with access restricted when no longer needed for normal operations.
- Marketing contact information is retained while there is a current relationship or a lawful reason to contact you. We retain a minimal suppression record after an opt-out so we can respect it.
- Cookie and device-storage lifetimes are explained in the Cookie Policy.
Deleting a user account is not necessarily deletion of a customer's workspace or its content. Backup copies are isolated from ordinary use and expire through controlled rotation; deletion is not instant across all systems. If a backup is restored, applicable deletion instructions must be reapplied. Legal holds are limited to the data and period needed.
9. Your rights and choices
Depending on applicable law, you may request access, correction, deletion, restriction or portability of personal data, and object to processing based on legitimate interests. You may object to direct marketing at any time and unsubscribe using the message's link. Where processing depends on consent, you may withdraw it without affecting earlier lawful processing.
Send requests to support@screendesk.io. We will verify identity proportionately and request only necessary information. For GDPR requests, we normally respond within one month; if a permitted extension is needed, we will explain it within that month. Rights are subject to lawful exceptions. For workspace content, we may refer you to the relevant organization and assist it under the DPA.
You may complain to the CNIL, France's supervisory authority, or your competent local authority. You need not contact us before doing so.
10. Additional US privacy rights
Where applicable state privacy law gives you rights, you may request information about the categories and specific information collected, correction, deletion or portability, and exercise applicable opt-out and appeal rights without discrimination. An authorized agent may act on your behalf subject to proportionate verification. We do not rely on a blanket business-contact or employee exemption.
The categories, sources, purposes and recipient categories are described above. We do not sell or share personal information for cross-context behavioral advertising, or use sensitive personal information to infer characteristics about you. Where we are a service provider or contractor for a business customer, that business handles requests and we assist it. If we decline your direct request, contact support@screendesk.io to appeal where your law provides that right.
11. Security, children and changes
We use organizational and technical safeguards described in our Security Measures. No system can guarantee absolute security.
Screendesk is a professional service and is not directed to children under 16. Customers must ensure lawful participation and any necessary guardian authorization; do not intentionally use the service to collect children's data without an agreed lawful arrangement. Contact us if you believe we have received children's data improperly.
We will update this notice when practices change, identify the revision date, and provide advance notice of material changes where appropriate. If a new purpose requires consent, we will obtain it rather than treating continued use as consent. Questions: support@screendesk.io.