Privacy Policy

1. Who we are and our roles

DeskNexo is operated by YecoAI di Marco Nasi. We act in two distinct roles under GDPR, UK GDPR, Swiss nFADP and US state privacy laws. Mixing them is incorrect.

• Controller for personal data of website visitors, demo leads, and control-panel accounts (identity, billing metadata, logs, cookies, and — only if you join Beta — redacted ticket text used to improve DeskNexo). That processing is described in this Policy.
• Processor / service provider for personal data of your hosting clients in WHMCS tickets on your instructions. You are the controller / business. That processing is governed by the DPA (including UK, Swiss and US addenda).

2. Data we collect as controller

2.1 You provide

• Account: name, email, company name.
• Billing details (card data is handled by Stripe, not stored by us).
• Messages you send to support@ or PEC.
• Knowledge-base files you upload for your tenant.

2.2 Collected automatically

• Usage of the control panel (features, ticket counts, agent outcomes).
• Security logs: IP, user-agent, timestamps.
• Cookies and similar storage on https://desknexo.com — see the Cookie Policy.

2.3 Processed as processor (not this Policy’s legal bases)

End-user ticket content is processed to classify, diagnose, act on VMs, and reply, under the DPA and your policies (Copilot / Autopilot).

3. Legal bases (GDPR Art. 6) — controller processing

• Art. 6(1)(b) contract: account, billing, delivering DeskNexo.
• Art. 6(1)(c) legal obligation: Italian tax and accounting records.
• Art. 6(1)(a) consent: non-essential cookies (GA4) and optional marketing.
• Art. 6(1)(f) legitimate interests: security, fraud prevention, aggregated product metrics. For Beta only: improving DeskNexo using ticket text after Yeco-PII redaction (you opt in to Beta). We do not rely on “continued browsing” as consent.

4. Yeco-PII (accurate description)

Yeco-PII is the PII-detection model built into DeskNexo. It is itself an automated system: it must process ticket text (which may contain personal data) in order to detect and redact it. Encrypted storage of original tickets is also processing under GDPR Art. 4(2).

After Yeco-PII, downstream systems (language models, daily/periodic operational summaries of failed requests and quality metrics, Beta improvement jobs) receive redacted text. Those downstream systems are not sent the redacted personal data. YecoAI staff do not read ticket conversations.

5. Recipients and international transfers

We do not sell personal data. Recipients are listed on the sub-processor page and below. Extra-EEA/UK/Swiss transfers use: EU SCCs; the UK International Data Transfer Addendum to the EU SCCs (and/or the UK IDTA); Swiss-recognised SCCs with the Swiss addendum; and the EU-US, UK-US and Swiss-US Data Privacy Frameworks where the importer is certified. Privacy Shield is not used.

6. Retention

• Account and invoices: subscription duration + 10 years (Italian tax rules).
• Ticket data as processor: per DPA / your settings; default 90 days after closure.
• Audit log: up to 5 years, with identifiers minimised where feasible to honour erasure.
• GA4: according to Google’s settings after consent; we do not run GA4 without consent.

7. Your rights (Arts. 15–22)

Access, rectification, erasure, restriction, portability, objection to Art. 6(1)(f), withdraw consent, complaint to the Garante. For automated decisions with legal or similarly significant effects on you as an account holder, you may request human review. VM actions on your clients are your responsibility as controller (see Terms, AI Act and Art. 22).

Contact [email protected] or PEC [email protected]. We respond within 30 days. No DPO is appointed (Art. 37 thresholds are not met for this ditta). That contact is the privacy point of contact, not a DPO.

8. EU AI Act (transparency)

DeskNexo is an AI system under Regulation (EU) 2024/1689. YecoAI is the provider; you are the deployer when you use it on your helpdesk. It is not placed on the market as an Annex III high-risk system. Art. 5 prohibited uses are forbidden. Natural persons who receive agent replies must be informed they are interacting with AI (Art. 50), unless it is obvious. You must configure that disclosure. Copilot and Approvals support human oversight; GDPR Art. 22 remains your responsibility for decisions that significantly affect your clients. Details are in the Terms of Service and Docs.

9. Security

• TLS in transit; encryption at rest for credentials and ticket bodies.
• Yeco-PII before downstream models and summaries.
• Staff do not read ticket threads. Breach: we notify the Garante within 72 hours when we are controller (Art. 33); as processor we notify you without undue delay (target 48 hours).
• YecoAI keeps an internal Art. 30 record and an internal DPIA for processor operations. They are available to the Garante and to Customers under the DPA audit clause. They are not a public certificate. You must keep your own controller DPIA and notices.

10. Children

B2B service, not directed at under-18s. Accidental collection is deleted.

11. United Kingdom

If UK GDPR and the Data Protection Act 2018 apply (UK account holders, or End User data you instruct us to process that relates to the UK), the same controller/processor split applies, reading GDPR as UK GDPR. Transfers from the UK use the ICO’s International Data Transfer Addendum to the EU SCCs (and/or the UK IDTA) and, where certified, the UK-US Data Privacy Framework. Cookies on this site follow the Privacy and Electronic Communications Regulations (PECR) via the consent banner. We have no UK establishment. If Art. 27 UK GDPR requires a representative, we will appoint one and name it here; until then the contact is [email protected]. Complaints: ICO.

12. Switzerland

If the revised Federal Act on Data Protection (nFADP / nLPD) applies, you are the controller (responsable du traitement) of End User ticket data and YecoAI is the processor (sous-traitant) under the DPA. Transfers use SCCs recognised by the FDPIC, with Switzerland treated as equivalent to an EEA state for those clauses, and/or the Swiss-US Data Privacy Framework where certified. We have no Swiss establishment. If Art. 14 nFADP requires a representative, we will appoint one and name it here; until then the contact is [email protected]. Complaints: FDPIC (IFPDT).

13. United States (CCPA/CPRA and similar state laws)

We do not sell or share personal information as defined in the California CPRA (including no targeted advertising ‘share’). We do not use or disclose sensitive personal information to infer characteristics beyond providing the Service. For End User ticket data we are a service provider / processor to you (the business/controller): we process only on your documented instructions, do not combine it with other data except as permitted to provide the Service, and will notify you if we can no longer meet those duties. You must pass through consumer requests that concern End User data; we will assist as described in the DPA. Website and account data of California residents: if a CPRA ‘business’ threshold applies to us, you may request know/access, delete, correct, and opt-out of sale/share (already our default) at [email protected]. We will not discriminate for exercising rights. We do not currently honour browser DNT signals; use Cookie settings. Similar rights under Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas DPRS and other US state laws are honoured on the same service-provider model. This is not a consumer contract; COPPA does not apply (18+ B2B). Marketing email, if you opted in, can be stopped via the same address (CAN-SPAM).

14. Changes

Material changes are notified by email or a notice in the control panel. We do not treat continued use as GDPR consent. If a change requires consent, we will ask for it. If you object to a legitimate-interest change, you may object under Art. 21 or stop using the service.

15. Contact