Privacy Policy

Last updated: 10 September 2026

1. Who this applies to

KopiDesk is used by businesses ("tenants") and their staff to manage customer conversations, website enquiries, appointments, tasks and internal operations. This policy covers both tenant staff accounts and, where relevant, the customers who message a tenant business through WhatsApp or a website enquiry form connected to KopiDesk. Each tenant business is the one responsible for its own relationship with its customers; KopiDesk provides the platform they use to manage it.

2. Information we collect

• Account information — a staff member's name, email and login credentials (stored only as a secure hash), and which business(es) and role(s) they belong to.
• WhatsApp conversation data — see Section 3.
• Website enquiries / leads — name, contact details and message content a visitor submits through a tenant's own website form or automation, forwarded to KopiDesk by that tenant.
• Calendar data — only if a staff member explicitly connects their own Google account data (see Section 4).
• Operational data — appointments, tasks, timesheets and payroll information a business enters to run its own operations, and audit logs of who did what, kept for security and accountability.

3. WhatsApp Business Platform data

When a tenant business connects a WhatsApp number to KopiDesk, KopiDesk acts as that business's technology provider for the WhatsApp Business Platform (Meta) — it is not a party to the conversation itself.

• What we process — the customer's phone number and profile name, message content, message timestamps, and delivery status, received via Meta's WhatsApp Business Platform webhook.
• Why — solely to display the conversation in the connected business's own shared inbox, so its staff can see and reply to it. KopiDesk does not use WhatsApp message content for advertising, and does not sell it.
• Who can see it — only staff at the specific business the conversation belongs to, gated by that business's own permissions. Conversations are isolated per business; no tenant can see another tenant's messages.
• Storage — conversation threads are stored in KopiDesk's database for as long as the business account is active, so staff have a record of past enquiries. A business can request deletion of its data at any time (Section 7).

4. Google account data

Connecting a Google account is always optional. KopiDesk requests only the scopes below, and only the ones needed for the features a business chooses to use. Every scope here is read-only except calendar events, which KopiDesk writes only when someone schedules through KopiDesk.

Google Calendar — per staff member

• calendar.events — to create or update events on that person's calendar when they schedule an appointment or task through KopiDesk.

Google Analytics — per business

• analytics.readonly — to read visit counts and contact-link taps for the business's own website property, so they appear on the business's dashboard. KopiDesk reads aggregate figures only. It does not read, store or have access to individual visitor identities.

Google Search Console — per business

• webmasters.readonly — to read the business's own search clicks, impressions, average position and search terms, so they appear on the dashboard and so KopiDesk can suggest article topics for terms the site already ranks near.

Google Ads — per business

• adwords — to read advertising spend for the business's own Ads account so it can be shown next to the results it produced. KopiDesk only ever reads. It does not create, edit, pause or delete campaigns, budgets or accounts. Google does not currently offer a read-only version of this scope, which is why the consent screen describes broader access than KopiDesk uses.

Identifying the connected account

• userinfo.email — to display which Google account is connected, so a business can tell at a glance whether it authorised the right one.

How we store it

An encrypted OAuth refresh token is stored, scoped to the account that granted it — to a staff member for Calendar, or to a single business for Analytics, Search Console and Ads. Analytics and Search Console figures are stored as monthly and daily totals for that business so its dashboard can show a twelve-month history without re-querying Google on every page load. No Google data is ever combined across businesses, and no business can see another's.

Revoking access

A business can disconnect at any time from Setup inside KopiDesk, or revoke KopiDesk directly at myaccount.google.com/permissions. On disconnection the stored refresh token is deleted. Figures already displayed are removed on request — see Section 7.

5. How we share information

We do not sell data. We share it only with service providers who help run KopiDesk, under confidentiality obligations, and only to the extent needed:

• Meta (WhatsApp Business Platform) — to send and receive WhatsApp messages on a connected business's behalf.
• Google — for Calendar sync, and for reading a connected business's own Analytics, Search Console and Ads figures. KopiDesk sends no customer data to Google.
• Firebase (Google Cloud) — database and authentication hosting.
• Netlify — application hosting.

We may disclose information if required by law.

6. Security

Each business's data is isolated from every other business's. Sensitive credentials (such as WhatsApp access tokens) are restricted to business owners only, separately from general staff access. No method of transmission or storage is completely secure, but we work to protect information with these safeguards.

7. Data retention and deletion

A business's data is retained for as long as its account is active. To request deletion of a business account and its associated data, or of an individual staff account, contact dpo@nexkoins.com. Our data deletion instructions set out what is removed, what is kept and how long it takes — including for customers who messaged a business rather than using KopiDesk themselves.

8. Your rights

Consistent with Singapore's Personal Data Protection Act (PDPA), you may request access to, correction of, or deletion of personal data. Contact our data protection officer at dpo@nexkoins.com.

9. Children

KopiDesk is a business tool. It is not directed to children, and accounts may only be created by people aged 18 or over who are authorised to act for the business they are registering. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

NexKoins Pte Ltd (Singapore), operating KopiDesk.
General: admin@nexkoins.com
Data protection: dpo@nexkoins.com

your everyday desk

Powered by NexKoins