Privacy Policy

Vikn Codes LLP ("we", "us", or "our") operates Vikn Desk, a customer support and ticket management platform available on the web, desktop, iOS and Android. This Privacy Policy explains how we collect, use, share and protect your information when you use Vikn Desk (the "Service").

This policy covers Vikn Desk only. Other Vikn products — including Vikn Remote Desk — are separate services with their own privacy policies, because they handle different data in different ways. Signing in to Vikn Desk uses the shared Vikn identity service described in section 3.

By creating an account or using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

We collect information that you provide directly, information generated as you use the Service, and information from your device.

Account information

• Your name, email address, phone number, and profile photo.
• Authentication details such as your password (stored only in hashed form) and access tokens.
• Your role and permissions within an organization.

Organization information

• Organization name, branches, and configuration such as ticket statuses, SLA policies, and custom fields.
• Team members, agents, and their assigned roles.
• Billing and subscription details associated with your organization.

Ticket and communication data

• Tickets you create or are assigned, including subjects, descriptions, statuses, and priorities.
• Messages, replies, internal notes, voice messages, and file attachments exchanged on a ticket.
• Contacts and requesters associated with tickets, and related activity history.

Microphone

The mobile and desktop apps request microphone access only to record a voice message on a ticket, and only at the moment you start a recording. We do not record audio in the background, and denying the permission leaves every other part of the Service working.

Device and usage information

• Device type, operating system, app version, and language preference.
• Push notification tokens (APNs for iOS, FCM for Android) when you enable notifications.
• Log data such as access times, feature usage, and diagnostic information used to keep the Service reliable.

What we do not collect

• We do not collect your location.
• We do not read your device contacts, photo library, call logs, or SMS.
• We do not use advertising identifiers, and we run no advertising or cross-site tracking in the Service.

We use the information we collect to:

• Provide, operate, and maintain the Service and its features.
• Authenticate you and keep your account and organization secure. Sign-in is handled by the shared Vikn identity service, which holds your account, the organizations you belong to and your roles across Vikn products.
• Deliver real-time updates and notifications about tickets and messages.
• Enable collaboration between agents, participants, and requesters.
• Provide reports, insights, and SLA tracking to your organization.
• Respond to support requests and communicate important service changes.
• Detect, prevent, and address fraud, abuse, and security issues.
• Comply with legal obligations and enforce our terms.

We do not use your tickets, messages or attachments to train machine learning models, and we do not use them for advertising.

We do not sell your personal information. We share information only in the following circumstances:

• Within your organization: ticket and profile data is visible to authorized members of your organization according to their roles and permissions.
• Service providers: with vendors who process data on our behalf (for example, cloud hosting, file storage, and push notification delivery) under agreements that require them to protect your data.
• Legal requirements: when required to comply with applicable law, regulation, legal process, or enforceable governmental request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.
• With your consent: when you direct us to share information with a third party.

We use technical and organizational measures designed to protect your information, including encryption in transit (HTTPS/TLS), access controls, and secure credential storage — passwords are stored only as salted hashes, and file attachments are held in access-controlled object storage reached through short-lived, signed URLs.

Your organization is assigned a data centre when it is created, based on its country, and its Vikn Desk data is stored there. See section 13 for what that means when you are outside that region.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

We retain your information for as long as your account or organization is active, or as needed to provide the Service.

We may retain certain information after account closure where necessary to comply with legal obligations, resolve disputes, enforce our agreements, or for legitimate business purposes such as security and fraud prevention. When information is no longer required, we delete or anonymize it.

Deletion timelines, and what survives a deletion request, are set out in full on our Account and Data Deletion page.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information.
• Object to or restrict certain processing of your information.
• Request a copy of your information in a portable format.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, write to us using the details at the end of this policy, or follow the steps on our Account and Data Deletion page. We respond within 30 days.

Much of the data in Vikn Desk is controlled by the organization you belong to, not by you personally — tickets you handled remain that organization’s record of its own customer support. Where that is the case we act on the organization’s instructions and will direct your request to its administrator.

You can ask us to delete your Vikn account and the personal data attached to it at any time, whether or not you still have the app installed. The request routes, what is erased, what your organization keeps, and how long each step takes are documented on our Account and Data Deletion page, linked in the footer of this page and from the app.

On the web and desktop apps we use cookies and local storage to keep you signed in, remember your preferences (such as language and theme), and maintain your session.

These are essential to the operation of the Service. We do not use third-party advertising or cross-site tracking cookies. You can clear local storage through your browser or device settings, though doing so may sign you out and reset preferences.

With your permission, we send push notifications about new tickets, messages, assignments, and SLA alerts. To deliver these, we register a device token with Apple Push Notification service (APNs) on iOS and Firebase Cloud Messaging (FCM) on Android.

You can disable push notifications at any time from your device settings or within the app. Disabling notifications does not affect your ability to use the rest of the Service.

We rely on trusted third-party providers to operate the Service, including:

• Cloud hosting and database providers that store your data.
• File and object storage for ticket attachments.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) for push notifications.
• Payment providers, who process your payment details directly — we receive a record of the transaction, not your card number.

These providers process information on our behalf and are bound by their own privacy and security obligations. This Privacy Policy does not cover the practices of third parties we do not control.

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children under the age of 16 (or the minimum age required in your jurisdiction). If you believe a child has provided us personal information, please contact us and we will take appropriate steps to delete it.

Your information may be stored and processed in countries other than the one in which you reside, where data protection laws may differ. Where we transfer information internationally, we take steps to ensure it remains protected in accordance with this Privacy Policy and applicable law.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.