Privacy policy

Businesses (our customers) use Scout Desk to talk to their own customers. For the tickets, messages, contacts, attachments and call recordings a business stores in its workspace, that business decides what is collected and why. It is the controller (under GDPR) or the entity responsible for the information (under the Privacy Act), and we process it only on its instructions, to run the service. If you contacted a business that uses Scout Desk, please ask that business about your information first.

For people who sign up to and use Scout Desk — account owners, agents and administrators — we are responsible for the account information described below.

• Account details: name, email address, password (stored only as a secure hash), profile photo, time zone and language.
• Workspace details: company name, plan, seats and billing contact. Card details are handled by Stripe; we never see or store full card numbers.
• Security and usage records: sign-in times, IP addresses, devices, audit log entries and two-factor settings, used to keep accounts secure and to support you.
• Messages you send us, for example support requests.

When a workspace connects a mailbox, the person connecting it signs in with Microsoft or Google and grants Scout Deskpermission to read and send mail for that mailbox. We use that access only to bring the mailbox's support email into the workspace as tickets and to send the workspace's replies from it.

• Access tokens and mail-server passwords are encrypted at rest and never shown in the app.
• We don't use mailbox data for advertising, sell it, or use it to train AI models.
• Access can be removed at any time by disconnecting the mailbox in Scout Desk, or by revoking the app in the Microsoft or Google account settings.

AI features (summaries, reply drafts, triage and the AI agent) are optional and controlled by each workspace. Only when they are turned on, the relevant ticket and help-centre content is sent to our AI provider, Anthropic, to produce a result. Anthropic does not use this data to train its models, and neither do we.

• To provide, secure and support the service, and to bill for it.
• To send service emails such as sign-in links, invitations, receipts and important changes.
• To understand overall usage so we can improve the product, using aggregated information where possible.
• To meet legal obligations and enforce our terms.

We don't sell personal information and we don't use customers' workspace content for marketing.

Workspace data is stored in Australia (Sydney). Some service providers process information overseas, for example in the United States, to deliver email, payments, hosting or optional features. We choose providers with appropriate safeguards and list them on our sub-processors page.

• Every workspace is isolated from every other at the database level, and access within a workspace follows roles and permissions.
• Data is encrypted in transit (TLS) and at rest; stored secrets are additionally encrypted.
• Optional two-factor authentication, single sign-on, IP allow-lists and session timeouts, and an audit log of administrative actions.

If we become aware of a breach likely to cause serious harm, we will notify affected customers and, where required, the Office of the Australian Information Commissioner.

Workspace content is kept while the workspace exists and according to any retention rules the workspace sets. Workspace owners can erase an individual contact's personal information, and can delete the whole workspace; after a short grace period, its data and files are permanently deleted. Backups roll off within our provider's backup window. We keep billing records for as long as tax law requires.

You can ask to access or correct your personal information, or to have it deleted, and (under GDPR) to restrict or object to processing or to receive a copy. Account users can update most details in their profile. For information held in a business's workspace, contact that business; we will help them respond. To make a request or a complaint, email privacy@scout7.app. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority.

We will update this page when our practices change and tell account owners about significant changes by email or in the app.