Privacy Policy

CliqDesk is operated by Zestly Labs (ABN 16 687 153 224), of Ground Floor, 470 St Kilda Road, Melbourne VIC 3004, Australia. This policy explains what personal information we handle when you use CliqDesk, and how we handle it. We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth).

The two kinds of people in this policy

CliqDesk is business-to-business software, so it helps to be clear about who is who:

• Customers — businesses that subscribe to CliqDesk and run a support portal on it. For information their customers submit, the customer is the entity that decides how it is used, and we act on their instructions.
• Requestors — the end users who raise support requests on a customer's portal. If you are one, the business running that portal is responsible for the information you send them; this policy describes what we do with it on their behalf.

What we collect

From customers

• Account details: name, work email address, and a password we only ever store hashed.
• Organisation details: company name, billing email, chosen portal address.
• Billing details — see “Payments” below. We never see or store your card number.
• Configuration you provide, including your ClickUp API key, which is stored encrypted.

From requestors

• Name and email address, so tickets can be attributed and replies delivered.
• The content of requests, replies and any files attached to them.
• Answers to the request-form fields the customer has configured.

Automatically

• A session cookie, so you stay signed in. It is required for the service to function.
• Server logs containing IP address, timestamp, request path and error diagnostics, used to operate and secure the service.

We do not use advertising or analytics trackers on the CliqDesk application, and we do not sell personal information to anyone, ever. Nothing you or your customers do inside a support portal is measured by a third party.

This marketing website is the one exception, and it is a narrow one. These public pages use Cloudflare Web Analytics, which counts page views without cookies, without any identifier for you, and without following you to other sites. It is not present on the application, on any customer portal, or on any page behind a login.

Where your ticket content actually lives

This is the most important thing to understand about CliqDesk, because it is unusual. CliqDesk is a customer-facing layer over your own ClickUp workspace. When a request is submitted, the ticket is created as a task in your ClickUp account, under your agreement with ClickUp.

Files uploaded through a portal are sent directly to the ClickUp task. We do not keep our own copy. The practical consequence: deleting content from CliqDesk does not delete it from ClickUp, and ClickUp's own privacy policy governs what happens to it there.

Why we handle it

• To provide the service — creating tickets, delivering replies, signing you in.
• To send service email — ticket confirmations, status changes, password resets, trial and billing notices. These are not marketing and cannot be unsubscribed from while your account is active.
• To take payment — via Stripe.
• To keep the service running and secure — diagnostics, abuse prevention, error monitoring.
• To meet legal obligations — including tax and record-keeping requirements.

Who we share it with

We use a small number of sub-processors. Each receives only what it needs to do its job. The current list is on our security page, which we keep up to date.

We also disclose information where we are required to by law, and to a buyer if the business is ever sold — in which case this policy continues to apply until you are told otherwise.

Where it is stored

CliqDesk's own infrastructure runs on Amazon Web Services in the ap-southeast-2 (Sydney) region, and our database is stored there.

Some of our sub-processors are based overseas or operate globally, so information may be disclosed to recipients outside Australia — principally in the United States. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as APP 8 requires. Traffic to our service passes through Cloudflare's global network.

How we protect it

• All traffic is encrypted in transit with TLS.
• Passwords are hashed, never stored in a readable form.
• Authentication tokens — invitations and password resets — are stored hashed, are single use, and expire.
• Your ClickUp API key is encrypted at rest.
• Every portal is isolated from every other portal, and that isolation is covered by automated tests on every change.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

How long we keep it

We keep account and portal data for as long as the account is active. After an account closes we delete or de-identify personal information within 90 days, except where we must keep it longer — billing records, for instance, which Australian tax law requires us to retain. Content in your ClickUp workspace is unaffected by closing a CliqDesk account and remains yours.

Your rights

You may ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email hello@cliqdesk.app and we will respond within 30 days.

If you are a requestor on someone's portal, ask the business running that portal first — they control that data, and we will refer your request to them.

Complaints

If you think we have mishandled your personal information, email hello@cliqdesk.app and we will investigate and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

We will update this page when our practices change and revise the date at the top. If a change materially affects how we handle your information, we will email account holders before it takes effect.