Privacy Policy

The short version

The data in your KaosDesk workspace belongs to you, not to us. We hold it so we can run the service for you, and that is the only reason we hold it.

• We never sell your data. From our point of view it is not ours to sell. Period.
• We never use your data to train public AI models. If we add AI features, each organization decides whether to turn them on.
• Your data stays in the United States, including backups.
• We only access your workspace with your approval, and every access is recorded in your own audit history.
• You can take all of your data with you, with no export fees.
• If something goes wrong, we tell you within 72 hours of confirming a breach.

Who we are and what this policy covers

KaosDesk L.L.C. ("KaosDesk," "we," "us") is an Indiana limited liability company. We provide KaosDesk, a cloud service for IT teams to manage tickets, assets, knowledge, automation, reporting, and device management.

This policy covers two kinds of information, and we treat them differently.

1. Customer Data. Everything your organization and its users put into a KaosDesk workspace: tickets, assets, users, attachments, knowledge articles, device information, and logs. Your organization (the "Customer") controls this data and decides how it is used. We process it only on the Customer's behalf and only to provide the service. Legally, the Customer is the controller and KaosDesk is the processor.

2. Information KaosDesk collects directly. A small amount of information we collect ourselves to run our business: what people submit through our website forms, billing and contract details, and contact details for account administrators.

If you use KaosDesk through your employer or school, questions about how your organization uses your data should go to that organization first. We will help them answer.

Information we collect

We collect only what we need to provide and support the service.

How we use information, and what we never do

We use information only to give the Customer a better experience with KaosDesk:

• Run the service, including sending the notifications the Customer has turned on
• Keep it secure, detect abuse, and investigate problems
• Provide support when the Customer asks for it
• Fix bugs and improve how the service works
• Bill for the service and manage the account
• Respond to people who contact us through our website

What we never do:

• Sell data. We do not sell, rent, or trade Customer Data or personal information to anyone, for any reason.
• Advertise with it. We do not use Customer Data for advertising or build marketing profiles from it.
• Train public AI models. We do not use Customer Data to train public or third-party AI models.
• Send marketing without permission. Website contacts and account admins only receive marketing email if they opt in, and can unsubscribe at any time.

AI features. KaosDesk is exploring optional AI features. If we add them, they will be off unless the Customer chooses to turn them on, and this policy will be updated to name any AI provider involved before the feature is offered.

Student data

KaosDesk's founder spent nearly a decade working in IT for a school district, and we built it knowing what schools are trusted with. When a school or district uses KaosDesk, we follow FERPA, COPPA, and applicable state student-privacy laws.

• The school stays in control. Under FERPA, we act as a "school official" under the school's direct control. We use student information only to provide the service to that school.
• Students signing in is the school's choice. Each school or district decides whether students use KaosDesk. Where students under 13 use it, we rely on the school to provide consent on behalf of parents, as COPPA allows for school use.
• Access is restricted and monitored. KaosDesk staff are prohibited from accessing student data except as the school authorizes, and student data is never released to any unauthorized person.
• Student data is never sold or used for advertising, and never used to build profiles of students.
• Agreements. We will sign a data privacy agreement with any school or district that requires one, including state-standard agreements where available.

Who we share information with

We share information only with the service providers we need to run KaosDesk, and only what each needs to do its job. Each is bound by contract to protect the data and use it only for us.

Email the Customer sets up. A Customer can connect its own email system to KaosDesk instead of ours. In that case, email is handled by the Customer's own provider under the Customer's agreement with them.

We will update this list before adding a new provider that handles Customer Data.

Where data is stored and how we protect it

All Customer Data, including backups, is stored in the United States: primary servers in Vultr's Chicago data center, and backups with Backblaze in the US.

• Encryption in transit. All connections to KaosDesk use HTTPS, in every environment including development.
• Encryption at rest. Not yet in place. Encrypting stored data and backups is planned, and we will update this policy when it is complete.
• Tenant isolation. Each Customer's data is kept separate from every other Customer's.
• Role-based access. Users see only what their role allows.
• Audit history. Changes in a workspace, including any access by KaosDesk staff, are recorded and visible to the Customer.
• Backups. Taken every 24 hours. They include system data and logs, and may not include software installers or updates.

Support access

Sometimes the fastest way to fix a problem is for us to see what a user sees. KaosDesk staff can sign in as a user in a Customer's workspace ("impersonation") only when all of these are true:

1. The Customer has approved it.
2. The request is documented in a support ticket.
3. The access is recorded in the Customer's own audit history, where the Customer can review it.

We use this access only for the approved purpose and only for as long as it takes.

Requests from government and law enforcement

We only hand over Customer Data when the law requires it, such as a valid subpoena or court order. When we receive one, we:

• Check that it is legally valid, and push back on requests that are overly broad
• Disclose only the minimum the law requires
• Notify the Customer first, unless the law forbids us from doing so

Where possible, we direct the requester to the Customer, since it is the Customer's data.

If there is a security breach

If we confirm that Customer Data has been accessed without authorization, we will notify the affected Customer within 72 hours. We will tell you what happened, what data was involved, what we are doing about it, and what you may need to do. We will keep you updated as we learn more, and we will cooperate with any notices you are required to send.

How long we keep data

While you are a Customer, your data is kept for as long as you keep it in KaosDesk. You can export it at any time, with no fees.

If you cancel:

1. Your administrators have 14 days to export anything they need.
2. After 14 days, access ends and your data is removed from our live systems.
3. Copies remaining in backups are fully deleted within 30 days after that, as backups age out.

Backups are kept for 30 days by default. We extend this only for one of these reasons:

Website contacts and billing records are kept as long as needed to respond and for our business and tax records.

Your rights, changes, and contact

Your rights. You can ask to see, correct, export, or delete your personal information. If your information is in a Customer's workspace, we will pass your request to that Customer, since they control it, and help them respond. Website contacts can ask us directly.

Changes to this policy. If we make a material change, we will notify Customers by email at least 30 days before it takes effect. The date at the top of this page shows when it was last updated.

Contact. Questions or requests: [email protected]. KaosDesk L.L.C. is an Indiana limited liability company. A mailing address is available on request.