Privacy Policy

ServeDeck, operated by an individual based in Indonesia ("ServeDeck", "we", "us") provides the client portal at https://servedeck.co and on the domains our customers connect to it.

There are two kinds of personal data here, and we play a different part for each:

• Agencies and their teams, who sign up and use ServeDeck. For this data we decide how it is used, and this policy applies in full.
• Agencies' clients, who sign in to an agency's portal. The agency decides what is collected and why; we process it on the agency's behalf. If you are a client, the agency you deal with is your first point of contact, and their own privacy notice applies.

We follow Indonesia's Personal Data Protection Law (Law No. 27 of 2022). Where another country's data protection law gives you more rights, we respect those too. You can reach us about anything here at support@servedeck.co.

• Accounts: name, email address, role and workspace, and a password stored only as a one-way hash we cannot read.
• Workspace settings: company name, logo, tab icon, reply address, invoice prefix, order statuses and custom domains.
• What the agency and its clients add: client records, services, checkout answers, orders, messages and internal notes, tickets, attachments, invoices, coupons and subscriptions.
• Connected payment accounts: if a workspace connects PayPal or Stripe, the keys it enters. They are encrypted in the database and never sent back to the browser.
• Activity: an audit trail of changes to orders and other records, notifications, and the email events our email provider reports, such as delivered or bounced.
• Technical data: the IP address, browser and time of each request, kept in server logs to run and protect the service.

• To provide the portal: sign-in, showing each person what their role allows, and keeping every workspace apart.
• To send the emails the service depends on, such as notifications, mentions, ticket replies and password resets, and to route replies back to the right thread.
• To bill agencies for their plans, and to answer support requests.
• To keep the service secure, find and fix faults, and prevent abuse.

• We do not sell personal data or share it for advertising.
• We do not run analytics, advertising or tracking scripts on the portal.
• We do not read a workspace's orders, messages or files, except when the agency asks us to help with something specific, or to investigate abuse or a security problem.

We set only what the service needs to work:

• Sign-in cookies, which keep you signed in and expire when the session does.
• A workspace cookie, which remembers which workspace you last signed in to.
• Browser storage for small preferences such as light or dark mode.

None of them is used to track you across other sites, so there is nothing to opt out of.

We use a small number of providers, each only for its part of the service:

• Hosting: ServeDeck and its database run on servers we operate, rented from a hosting provider.
• Resend sends our emails and receives replies to them, so it handles the addresses, subject and content of those messages.
• PayPal and Stripe, only when a workspace connects an account: we send the keys to the provider to check they work.

We may also disclose data when the law requires it, or to protect our users, the service or the public from harm. If ServeDeck is ever sold or merged, the data would pass to the new operator under this policy, and we would tell you first.

Data may be stored and processed outside your country, including outside Indonesia, by us and by the providers above. We only use providers that protect data to a standard comparable to Indonesian law.

• Workspace data: for as long as the workspace exists. When it closes, we delete it within 30 days.
• Billing records for agencies: for as long as tax and accounting law requires, even after a workspace closes.
• Server logs: for a short time, normally no more than 90 days.
• Agencies decide how long their clients' records are kept within their workspace, and can delete them.

Every connection is encrypted. Row-level security in the database keeps each workspace's data, and each client's, apart at the source, so a request for someone else's records returns nothing. Passwords are hashed and payment keys encrypted. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

You can ask to see, correct, export or delete your personal data, or object to how it is used. Team members can change most of their details in their profile.

Write to support@servedeck.cofrom the address on your account. If you are an agency's client, write to the agency first: they control your data in their portal, and we will help them answer you.

ServeDeck is a business service for people aged 18 and over. We do not knowingly collect data from children.

When we change this policy, we update the effective date at the top. If we start collecting a new kind of data or use a new provider, we will tell workspace owners by email or in the app before it takes effect. The Terms of Service say more about how changes work.