Legal
Privacy Policy
This notice explains how NatterDesk handles personal information on its website, in its private demo and when its product features are used. It was last updated on 2 October 2026.
Who is responsible for your information?
NatterDesk is operated by Maksym Pater, an individual based in the United Kingdom. NatterDesk is a product name; there is currently no incorporated or separately registered business behind it. For privacy questions or requests, email hello@natterdesk.com.
Maksym Pater is responsible for personal information used to run this website, manage the operator account, answer direct emails, protect the service and test the private demo. For a future business workspace, the business using NatterDesk will usually decide why its customers’ messages are handled; that business will generally be the controller and NatterDesk will process those messages on its documented instructions. The actual roles depend on the processing activity and the agreement in place.
The current NatterDesk demo
The product is at a private demo stage. There are no real customer workspaces. Some website examples are prerecorded; the live browser voice demo, when enabled, asks for microphone permission and is restricted to the operator account.
If you start a live voice demo, your microphone audio is sent to ElevenLabs for the session. The page displays a live transcript in your browser; the browser-demo flow does not add that session to NatterDesk business call history or leads. ElevenLabs may retain its own conversation data under the settings for the specific agent.
Information we handle
The information depends on which feature is used. It may include:
- Account details such as name, email address, authentication identifiers and business profile or service settings.
- Enquiry and conversation content, AI replies, summaries, call transcripts, audio recordings, caller or sender details and channel identifiers.
- Booking information such as a requested service, date and time, contact details, availability and related Calendar event identifiers.
- Files or attachments that a person chooses to send through an enabled channel.
- Google sign-in details: email address, verification status, name, profile image, locale if supplied and a stable Google Account identifier. Google sign-in does not grant access to Google email, Drive or Contacts. Calendar access is requested separately when Calendar is connected.
- Google Calendar details if a business separately connects Calendar, including the Calendar identity, availability and events needed for the authorised booking workflow.
- Billing and subscription status if payment features are used. Stripe handles card details.
- Technical and security information such as IP address, browser or device details, request time, page URL, referrer and diagnostic logs where the relevant platform provides them.
- Messages and attachments sent directly to our support address.
Information can come directly from you, from the person who configured a business assistant, from a connected channel such as Telegram, or from a connected service such as Google Calendar. Information needed for a feature must be provided for that feature to work; optional integrations can be left disconnected.
Why we use information
- Provide the requested account, demo or product feature. We use the information needed to authenticate a user, answer an enquiry, maintain a workspace or deliver a connected feature. The legal basis is usually steps requested before a contract or performance of a contract.
- Generate assistant replies and carry out configured actions. We use current messages and relevant context to produce an answer, prepare a lead or handle a booking request. A business using the service decides the lawful basis for its customer conversations.
- Protect and maintain the service. We use limited technical and account information to prevent abuse, troubleshoot failures and secure the website. Where applicable, the basis is our legitimate interest in operating a safe and reliable service.
- Handle billing and legal duties. We process billing records to provide paid features and keep records required by law.
- Respond to privacy or support requests. We use the details in the request to verify and answer it.
We do not sell personal information or use conversation content for advertising. We do not train a NatterDesk foundation model on customer conversations. AI service providers may handle prompts under their own terms and settings; see “AI, voice and automated actions” and “Where information is processed” below.
AI, voice and automated actions
To answer a message, NatterDesk sends the current message, relevant recent conversation text and the business information needed to respond to OpenRouter. OpenRouter routes the request to the model provider selected for that workspace. The selected model and its provider may change. We have not verified zero-retention and training settings for every possible deployed model route, so we do not promise that every provider immediately deletes prompts or never uses them under its own terms.
Voice features send audio to ElevenLabs. For the designated NatterDesk voice agent, audio, transcripts and derived fields are configured for deletion after 30 days. Retention is agent-specific and provider-side deletion timing has not been verified for every session. Please do not share sensitive information in the demo.
AI responses can be incomplete or wrong. When a business enables Calendar booking, the assistant can create, update or cancel an event after the person’s request or confirmation and within that business’s configured workflow. NatterDesk is not intended to make decisions about a person that produce legal or similarly significant effects.
Messages sent to a business
If a business later uses NatterDesk to respond to its customers, that business is usually responsible for deciding what it asks for, why it uses the information and how long it keeps it. It must provide its own privacy information and choose a lawful basis. NatterDesk will process that conversation information to provide the service and follow the business’s instructions.
Customer workspaces are not currently open. Before accepting real customer conversations, the applicable processor terms, customer instructions, provider list and retention schedule must be agreed for that service. If you sent a message to a business using NatterDesk, contact that business first; we can help it handle your request.
Who receives information
We share information with the provider needed for the feature being used, with the relevant business account, or when disclosure is required by law. Providers may use their own subprocessors.
Supabase
Why: Account authentication and the application database.
Information: Account identifiers, business settings, conversations, messages, leads, booking details and Calendar connection credentials, when those features are used.
Vercel
Why: Website and application hosting.
Information: Requests sent to the site and technical information used to deliver, troubleshoot and protect the service, such as request time, route and network information.
Cloudflare R2
Why: Private object storage for files and voice transcript exports where configured.
Information: Uploaded attachments or transcript files and the identifiers needed to associate them with a conversation. The current NatterDesk bucket is configured for EU jurisdiction.
OpenRouter and the selected AI model provider
Why: Generating an assistant response from the current message and relevant conversation and business context.
Information: The prompt, recent conversation text and business information needed to answer. The downstream model provider is selected by workspace configuration and may vary.
ElevenLabs
Why: Live voice sessions and voice-agent processing.
Information: Microphone audio, spoken conversation, transcript and technical session information. The provider may keep its own copy under the retention settings for the specific agent.
Why: Optional Google sign-in and, separately, an optional Google Calendar connection.
Information: Sign-in profile details when Google login is used; Calendar identity, availability and event information when Calendar is connected. Calendar access is not part of Google sign-in.
Telegram
Why: Receiving and replying to messages when a business enables a Telegram channel.
Information: Message content and Telegram account or chat identifiers, such as a sender ID or username where Telegram supplies one.
Stripe
Why: Checkout and subscription billing when payment features are enabled.
Information: Billing and subscription status and transaction identifiers. Card details are submitted to Stripe; NatterDesk does not receive the full card number.
Zoho Mail
Why: Hosting NatterDesk's domain email addresses and aliases for general contact, support, sales, partnerships and administration.
Information: The sender address, message content, attachments and correspondence metadata.
Phone carriers and other channel providers may also be involved when a business enables those integrations. The provider used depends on the particular setup. We disclose feature-specific providers to the business before its customer workspace is enabled.
Where information is processed
The current Supabase database is configured in the EU west region, and the NatterDesk Cloudflare R2 bucket is restricted to EU jurisdiction. This does not mean that every part of the service stays in the UK or EEA. Hosting, voice, AI, email and channel providers may process information in other countries or use subprocessors in different locations.
The exact location and transfer safeguards have not been confirmed for every downstream AI model and provider route. We will verify the active provider chain and applicable transfer arrangements before opening customer workspaces. Email hello@natterdesk.com to ask for the current provider and transfer information.
How long information is kept
NatterDesk’s current 30-day deletion setup covers only the configured private demo workspace and selected voice and file storage settings. It is not a promise that every record or copy held by every provider is erased exactly 30 days after it is created.
- Conversation messages in the configured demo workspace are scheduled for deletion after 30 days. The clean-up runs once a day, so deletion may happen shortly after that point. An old conversation summary is cleared when there are no newer messages in that conversation.
- The designated NatterDesk voice agent is configured to delete call audio, transcripts and derived fields after 30 days. Settings vary by agent; older conversations were not retroactively covered by that setting.
- Objects in the private conversation storage bucket have a 30-day expiry rule configured. Expiry is handled by the storage provider and may be asynchronous; natural expiry has not been verified for every object.
- There is not yet one verified deletion period for account records, leads and contact details, Calendar events, billing records, usage/security logs, backups or copies retained by other providers. Those records may be kept for as long as needed for the relevant service, legal duties or security, and provider backup cycles may continue after deletion from the main application.
You can ask us to access, correct or delete information by emailing hello@natterdesk.com. There is no self-service account deletion control in the current demo. We will assess the request, check for lawful reasons to keep some information and explain any limits. We cannot promise immediate erasure from systems controlled by third-party providers or backups.
Security
We use HTTPS, account and access controls, multi-factor authentication on the platform accounts reviewed for the private demo, and security features provided by our hosting and storage providers. These measures reduce risk but cannot guarantee that information will never be accessed, lost or disclosed. NatterDesk has not been independently audited or certified.
Your rights and how to contact us
Depending on the law and the reason we use the information, you may:
- Ask whether we use your personal information and request a copy of it.
- Ask us to correct inaccurate information or erase information where the law allows.
- Ask us to restrict or stop a use of your information in circumstances provided by law.
- Object to processing based on legitimate interests. We will stop unless we have compelling grounds to continue or need the information for legal claims.
- Request portable information where the legal conditions for data portability are met.
- Withdraw consent for processing that is based on consent. This does not affect processing that took place before withdrawal.
To exercise a right, email hello@natterdesk.com with “Privacy request” in the subject and tell us what you need. We may ask for proportionate information to confirm your identity. We normally respond within one month; if the law allows more time, we will explain that to you. If a business is responsible for the conversation, we may refer your request to that business and help it respond.
EU/EEA representative
NatterDesk is operated from the United Kingdom and has no external customer workspaces at this time. No EU/EEA representative has been appointed. The operator intends to serve customers in the United Kingdom, Ireland and the Netherlands, but has not yet completed the assessment of when the EU GDPR applies to that activity. Before opening EU/EEA customer workspaces, we will resolve whether Article 27 requires a representative. If it does and no exception applies, we will appoint one in writing and add their contact details here.
Complaints
Please contact us first so we can try to resolve your concern. You can also complain to a data protection authority, including:
- UK Information Commissioner’s Office (ICO)
- Irish Data Protection Commission (DPC)
- Dutch Autoriteit Persoonsgegevens (AP)
This notice may change as NatterDesk features and providers change. We will update the date at the top when we revise it.