Privacy Policy

Last updated: 2 November 2026

1. Overview

This document is an electronic record in terms of the Information Technology Act, 2000 and the rules made under it, as amended from time to time. It is generated by a computer system and does not require any physical or digital signature.

This Privacy Policy is published in accordance with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it.

GDesk is a document collection and practice management platform for accounting, tax and other professional firms, available at gdesks.com and app.gdesks.com and through any related applications (the “Platform”). The Platform is owned and operated by LUCENWARD, a sole proprietorship owned by Muhamed Shamsad, with its principal place of business at Cabin No. 103, 1st Floor, The Sook, Near Mathrubhumi, Swagathamadu, Kottakkal, Malappuram, Kerala 676510, India (“GDesk”, “we”, “us” or “our”).

In this Privacy Policy:

“Firm” or “Customer” means a business that registers for and uses the Platform.
“Firm User” means an owner, employee or other person whom a Firm authorises to use the Platform.
“Client” means a person from whom a Firm requests information or documents through the Platform, and includes a Firm’s contacts and leads.
“you” and “User” mean any person who visits or uses the Platform, including a Firm User or a Client.
“Personal Information” means any information about an individual who can be identified by or in relation to that information.

GDesk recognises the importance of the privacy of its Users and of the documents that Firms and their Clients entrust to the Platform. This Privacy Policy explains what Personal Information we collect, how we use and protect it, and the choices and rights available to you. By using the Platform, you agree to the practices described in this Privacy Policy. This Privacy Policy should be read together with our Terms & Conditions.

2. Users outside the geographical limits of India

Please note that the data shared with GDesk is primarily processed and stored in India, on servers located in the Mumbai region of our cloud hosting provider. Some of our service providers may process data in other countries, including the United States.

If you are located in the United Arab Emirates, the Kingdom of Saudi Arabia, Qatar, Oman, Kuwait, Bahrain or any other country, you understand that your Personal Information will be transferred to and processed in India and in such other countries, which may have data protection laws different from those of your country. We take reasonable steps to ensure that your Personal Information receives an adequate level of protection wherever it is processed, and we comply with the cross-border transfer requirements of the laws that apply to us.

If you do not agree to such transfer, please do not use the Platform. You may withdraw your consent at any time as described in Section 15.

3. Firms and their clients

The Platform is used by Firms to collect information and documents from their Clients. Our role differs depending on whose Personal Information is involved:

Client Data. When a Firm uses the Platform to collect, store or review the Personal Information of its Clients, the Firm decides the purpose and means of that processing and is the data fiduciary (or controller). GDesk processes that information only on behalf of and under the instructions of the Firm, as its data processor. If you are a Client, the Firm’s own privacy notice applies to you, and you should direct any questions or requests about your documents to the Firm first.
Account and website data. For the Personal Information of Firm Users, and of visitors who use our website or contact us, GDesk is the data fiduciary and this Privacy Policy applies in full.

4. Information we collect

4.1 Information you provide to us

Registration and account information: name, work email address, mobile number, designation, the Firm’s name, address, tax registration details and billing information, and the password and security settings of your account.
Enquiries: information you provide when you contact us, request a demonstration or register a Firm on our website.
Payment information: payments are processed by our payment gateway partner. We do not store your card, UPI or bank account credentials.

4.2 Information we process on behalf of Firms

Firms and their Clients may upload or enter information into the Platform (“Client Data”), which may include:

names, contact details and addresses of Clients;
tax and identity numbers recorded by the Firm, such as PAN, GSTIN, TAN, TRN, Emirates ID, national ID or Iqama, passport or bank account and IBAN details. The Platform accepts only the last four digits of an Aadhaar number;
documents, files and voice notes uploaded by Clients, answers to the Firm’s questions, and messages exchanged between the Firm and its Clients by email, the Platform or WhatsApp;
details of leads, enquiries, invoices and other records that the Firm maintains on the Platform.

Some of this information, such as financial information and identity documents, may be sensitive personal data. The Firm is responsible for having a lawful basis to collect it.

4.3 Information collected automatically

Sign-in and security information: IP address, browser and device type, and an approximate location derived from the IP address on our own servers, recorded when you sign in so that you can review your active sessions and so that we can detect misuse.
Activity records: a record of significant actions taken within a Firm’s account, such as who sent, approved or deleted a request, and when.
Delivery information: whether an email or WhatsApp message sent through the Platform was delivered, bounced or reported.

We do not use third-party analytics or advertising tools, and we do not track the pages you visit for marketing purposes.

5. Our use of your information

We use Personal Information for the following purposes:

to create and manage accounts and to provide the Platform and its features;
to send document requests, reminders and notifications on behalf of Firms, by email, WhatsApp or push notification;
to store documents securely and make them available to the Firm and the Client concerned;
to scan uploaded files for viruses and other harmful content;
to process subscription payments, issue invoices and maintain accounts as required by law;
to verify identity, keep accounts secure and prevent fraud, abuse and unauthorised access;
to respond to enquiries and provide customer support;
to send Firm Users service, security and billing communications;
to diagnose faults and improve the reliability and performance of the Platform, using aggregated information that does not identify any individual;
to comply with applicable laws, regulations and lawful requests of authorities.

We will not sell, license, rent or trade your Personal Information, and we do not use Client Data for advertising.

6. Artificial intelligence features

The Platform offers optional features that use artificial intelligence, such as checking whether an uploaded document matches the item requested, drafting messages and requests, and suggesting the request to which a file belongs. These features remain switched off until a Firm chooses to enable them.

When a Firm uses these features, the information needed for the task is sent to our artificial intelligence service provider. For a document check, this means the pages of the document (up to the first five pages) and a description of the item requested, including the Client’s name and the relevant period. Our provider is contractually restricted from using this information to train its models and may retain it only for up to thirty (30) days for abuse monitoring. GDesk stores only the result, in which Aadhaar, Emirates ID and account numbers are reduced to their last four digits.

Artificial intelligence features only assist Firm Users. They do not approve documents or make decisions, and a person at the Firm remains responsible for every decision. Internal notes between Firm Users are never sent to the artificial intelligence service provider.

7. Cookies and similar technologies

The Platform uses only strictly necessary cookies, which keep you signed in securely and protect your session. It also stores a small number of preferences on your device, such as display theme and language. Our website does not set cookies.

Forms on our website and on Firms’ enquiry pages use a security check provided by a third party to distinguish people from automated programs. This check processes your IP address and browser information. Product videos on our website are played in privacy-enhanced mode and load only when you choose to play them.

Do Not Track. As we do not track Users across websites, we do not respond differently to Do Not Track signals.

8. How long do we keep your Personal Information?

We retain Personal Information only for as long as necessary for the purposes described in this Privacy Policy, or as required by law. In particular:

Client documents and answers are retained for the period agreed with the Firm, which may be between thirty (30) days and ten (10) years after the relevant request is closed, after which they are deleted. Where no period has been agreed, they are retained until the Firm deletes them or closes its account.
The text of WhatsApp messages is deleted after ninety (90) days.
When a Firm closes its account, it may export its data for a period of not less than thirty (30) days, after which the data is deleted.
Deleted information is removed from our backups within thirty-five (35) days.
Invoices and billing records are retained for the period required by tax laws, which is generally eight (8) years.
A limited record of significant account actions may be retained after deletion where necessary for security, the prevention of fraud or compliance with law.

We share Personal Information only in the following circumstances:

Service providers. We engage trusted third parties to help us operate the Platform, including providers of cloud hosting and storage (Amazon Web Services, in India), email and WhatsApp messaging, payment processing, artificial intelligence, security checks and error monitoring. They may access Personal Information only to perform services for us and are bound by contractual obligations of confidentiality and data protection. A current list of these providers is available to Firms on request.
Services connected by a Firm. Where a Firm connects the Platform to another service, such as its cloud storage, calendar or its own systems through our API, we share the information needed for that connection on the Firm’s instructions.
Within a Firm. Client Data is visible to the Firm and to the Firm Users it authorises, according to the roles and access it assigns.
Business transfers. If GDesk is involved in a merger, acquisition or sale of assets, Personal Information may be transferred to the successor, which will remain bound by this Privacy Policy.

10. Disclosure of information

We may disclose Personal Information where we believe in good faith that disclosure is necessary:

to comply with applicable law, regulation, legal process or an enforceable request of a government authority;
to enforce our Terms & Conditions or investigate potential violations;
to detect, prevent or address fraud, security or technical issues;
to protect the rights, property or safety of GDesk, our Users or the public.

Where Client Data is concerned, we will notify the Firm of any such request unless we are prohibited by law from doing so.

11. Links to third-party websites and services

The Platform may contain links to, or allow connections with, websites and services operated by third parties. We are not responsible for the privacy practices or content of those third parties, and we encourage you to read their privacy policies. Information you share with them is governed by their policies and not by this Privacy Policy.

12. How we protect your Personal Information

We treat the information entrusted to us as an asset that must be protected against loss and unauthorised access. We maintain reasonable security practices and procedures, including:

encryption of data in transit using TLS, and encryption of stored data, with additional encryption of sign-in secrets, phone numbers and connection keys;
scanning of every uploaded file for viruses before it can be opened by a Firm;
private, time-limited links for access to files;
role-based access, so that Firm Users see only the Clients assigned to them;
two-step verification for Firm Users, which a Firm may make mandatory, and which is mandatory for GDesk’s administrators;
protection against repeated sign-in attempts, daily backups, and records of significant actions.

Access to Personal Information within GDesk is limited to personnel who need it to operate and support the Platform, and who are bound by confidentiality obligations. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will notify the affected Firms, Users and the Data Protection Board of India as required by applicable law.

13. Your rights

Subject to applicable law, including the DPDP Act and the data protection laws of the Gulf Cooperation Council countries, you have the right to:

obtain a summary of the Personal Information we hold about you and how it is processed;
request the correction, completion, updating or erasure of your Personal Information;
withdraw any consent you have given;
nominate another person to exercise your rights in the event of your death or incapacity;
have your grievances redressed, and approach the Data Protection Board of India or the regulator in your country.

If you are a Client, please send your request to the Firm, which controls your information; if you contact us, we will forward your request to the Firm and assist it in responding. Other requests may be sent to the Grievance Officer named in Section 17. We may need to verify your identity before acting on a request, and we will respond within thirty (30) days.

14. Our policy toward children

The Platform is intended for businesses and is not directed at persons under the age of eighteen (18) years. We do not knowingly collect Personal Information directly from children. Where a Firm processes information relating to a child through the Platform, the Firm is responsible for obtaining the verifiable consent of the child’s parent or lawful guardian. If you believe that a child has provided us with Personal Information, please contact us and we will delete it.

Where we process your Personal Information on the basis of your consent, you may withdraw your consent at any time by writing to us at contact@gdesks.com. Withdrawal of consent will not affect processing carried out before the withdrawal, and may mean that we are unable to provide some or all of the Platform to you. Clients may withdraw consent to WhatsApp messages by replying STOP or by informing the Firm.

16. How can you opt out of receiving our promotional emails?

We send promotional communications only with your consent. You may opt out at any time by using the unsubscribe link in the email or by writing to us. Even if you opt out, we will continue to send you communications that are necessary for your account, such as security alerts, billing notices and changes to our terms.

17. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, the details of our Grievance Officer are as follows:

Name: Muhamed Shamsad
Address: LUCENWARD, Cabin No. 103, 1st Floor, The Sook, Near Mathrubhumi, Swagathamadu, Kottakkal, Malappuram, Kerala 676510, India
Email: contact@gdesks.com

The Grievance Officer shall acknowledge your grievance and resolve it within thirty (30) days of receipt.

18. Changes to the Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The updated version will be posted on this page with a revised “Last updated” date. Where the changes are material, we will notify Firms by email before they take effect. Your continued use of the Platform after the changes take effect constitutes acceptance of the revised Privacy Policy.