Privacy Policy

Last updated: 14 November 2026

This policy explains what personal data dskeroo collects, why, who we share it with and the choices and rights you have.

In short: we collect only what we need to run desk booking — your name, email (and photo, if you sign in with Google), and your bookings. No ads, no tracking cookies, no selling of data. Your employer controls its company workspace; we look after the data for them.

1. Who is responsible for your data

dskeroo is used by companies ("Customers") to let their people ("Users") book desks. Responsibility depends on the data:

Workspace data — booking records, membership, roles, floor plans — is processed on behalf of the Customer. For this data the Customer is the controller and Oxana Ktoridou is a processor under our Data Processing Agreement. If you're a User with questions about how your employer uses dskeroo, please contact them first; we'll help them respond.
Account, website and business data — your sign-in account, communications with us, billing contacts, security logs and our own customer records — is controlled by Oxana Ktoridou, Keryneias 20, 2008 Nicosia, Cyprus ("dskeroo", "we"). Contact: privacy@dskeroo.com.

2. What we collect

Data	Source	Why
Name, email address, and an account identifier from Google or Microsoft; profile photo URL from Google	Google or Microsoft, when you sign in with them; or you, when you sign in with an emailed link	To create and secure your account, show who has booked which desk, and send invites
Company name, office and floor names, desk labels and types	Company admins	To provide the floor plan and booking service
Bookings (desk, date, time booked)	You	To reserve desks, show colleagues who's in, and produce usage reports for your company
Role and membership, invites (invited email address, inviter)	Company admins	To manage access to the company workspace
Sign-in sessions, last sign-in time	Generated by the Service	To keep you signed in, protect accounts and understand active use
IP address, browser and request logs	Your device, via our hosting provider	Security, abuse prevention and troubleshooting
Messages you send us through the contact form or the in-app feedback and problem-report forms: your name, email, message, the page you were on and your browser type	You	Replying to you, fixing problems and improving the Service
Billing contact and plan details	The Customer	Account administration
Billing details: company name, billing email and address, VAT number, subscription and invoice history (card details are handled only by Stripe)	The Customer, via Stripe Checkout	Taking payment, issuing invoices and meeting tax obligations

The live demo runs entirely in your browser with sample data: nothing you do in it is sent to us or stored, except feedback you choose to send from it.

We do not ask for special-category data, and we ask admins not to enter it into names or labels. From Google and Microsoft we request only the basic sign-in scopes (openid, email, profile); we cannot access your mailbox, files or calendar. If you sign in by email, we send a single-use link that expires after 15 minutes, and we keep a record of when it was requested and used (including the IP address) to prevent abuse.

3. Legal bases (where we are the controller)

Contract — to provide the Service under our Terms and manage customer accounts.
Legitimate interests — to secure the Service, prevent abuse, understand aggregated usage to improve the product, and communicate with business contacts about the Service. We balance these interests against your rights and you can object at any time.
Legal obligation — for example, keeping invoices and tax records.
Consent — only if we ever ask for something optional, such as product newsletters. You can withdraw consent at any time.

4. Who can see your data

Your colleagues in the same company can see your name, photo and which desk you've booked on which day. Company admins can also see your email, role and usage reports.
dskeroo staff access data only where needed to operate, support and secure the Service.
Sub-processors who host and run parts of the Service for us, listed in our DPA: Cloudflare (hosting, database, content delivery and security), Google and Microsoft (sign-in), Stripe (payments and invoicing for paid plans) and Resend (sign-in and invite emails). When you pay for a plan, Stripe also acts as an independent controller for payment and fraud-prevention data under its own privacy policy.
Authorities or others where required by law, or to protect rights, safety or the Service; and a successor if dskeroo is involved in a merger or acquisition, under equivalent protections.

We do not sell personal data or use it for advertising.

5. International transfers

Our providers may process data outside the European Economic Area, including in the United States. Where they do, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where appropriate.

6. How long we keep data

Sign-in sessions expire after 30 days and are deleted.
Workspace data is kept while the company account is active. Removing a member cancels their upcoming bookings; past bookings remain in the company's history until the company deletes them or its account.
Deleted accounts and companies are removed from our live database immediately; residual copies in backups are overwritten within 30 days.
Pending invites are deleted when revoked or when the company is deleted.
Feedback and contact messages are kept for as long as needed to handle them and improve the Service, and for no more than 3 years.
Security logs are kept for a short period by our hosting provider, and billing records for as long as tax law requires.

7. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Session tokens are stored only as hashes, sign-in uses Google or Microsoft OAuth with PKCE, or single-use email links that expire after 15 minutes, access is limited by role, and every company's data is separated by account. No system is perfectly secure, so please tell us at privacy@dskeroo.com if you find a vulnerability.

8. Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent. You can:

Download your data and delete your account yourself under Account & privacy in the app;
ask your company admin about workspace data they control; or
email privacy@dskeroo.com. We'll reply within one month.

You also have the right to complain to a data protection authority, in particular in your country of residence or work. Our lead supervisory authority is the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

9. Cookies

We use only strictly necessary cookies to keep you signed in and secure sign-in. See our Cookie Policy.

10. Children

dskeroo is a workplace tool and is not directed at children under 16. We do not knowingly collect their data.

11. Changes

We'll post updates on this page and change the "Last updated" date. If changes are significant, we'll notify company owners by email or in the app.

12. Contact

Oxana Ktoridou, Keryneias 20, 2008 Nicosia, Cyprus. Email privacy@dskeroo.com.