TILEDESK PRIVACY POLICY 2026

Last updated: 15 September 2026

1. About this Privacy Policy

This Privacy Policy explains how Tiledesk S.r.l. (“Tiledesk”, “we”, “us” or “our”) collects and processes personal data in connection with our websites, cloud platform, applications, APIs and related services.

Tiledesk is established in Italy and processes personal data in accordance with:

Regulation (EU) 2016/679 (the General Data Protection Regulation – GDPR);
Italian Legislative Decree No. 196/2003, as subsequently amended, including by Legislative Decree No. 101/2018 (the Italian Privacy Code);
applicable Italian and European data protection and electronic communications legislation; and
applicable decisions, guidelines and requirements of the Garante per la protezione dei dati personali and other competent European supervisory authorities.

This Privacy Policy applies to personal data for which Tiledesk acts as Data Controller.

It also explains, for transparency purposes, how Tiledesk handles personal data contained in customer workspaces, conversations and other customer content when Tiledesk acts as Data Processor on behalf of its customers. Those processing activities are additionally governed by our Data Processing Agreement (“DPA”).

Where Tiledesk processes personal data on behalf of a customer, the customer’s privacy notice and instructions determine the purposes and legal basis of that processing.

2. Who is responsible for your personal data?

Tiledesk is:

Tiledesk S.r.l.
Via Fratelli Bandiera 17
73010 Soleto (LE)
Italy
C.F./P.IVA: IT05103590757
REA LE – 342169

Privacy enquiries and requests may be sent to:

safety@tiledesk.com

Where required by applicable law, information concerning Tiledesk’s Data Protection Officer, if appointed, will be made available through our website and contractual documentation.

3. When Tiledesk is Controller and when Tiledesk is Processor

The privacy role of Tiledesk depends on the context in which personal data is processed.

3.1 Tiledesk as Data Controller

Tiledesk generally acts as Data Controller when processing personal data relating to:

visitors to Tiledesk websites;
individuals who create or administer a Tiledesk account;
customer representatives and authorised users;
prospective customers and business contacts;
billing, invoicing and contractual contacts;
people who contact Tiledesk directly for support, sales or other enquiries;
marketing communications sent by Tiledesk;
security, fraud prevention, audit and service administration activities performed for Tiledesk’s own purposes.

In these cases, Tiledesk determines the purposes and essential means of the processing.

3.2 Tiledesk as Data Processor

Where a customer uses Tiledesk to communicate with its own customers, users, employees, prospects or other individuals, the customer normally acts as Data Controller and Tiledesk acts as Data Processor under Article 28 GDPR.

This includes, depending on the customer’s configuration:

live chat conversations;
AI Agent and chatbot conversations;
customer support interactions;
WhatsApp, Facebook Messenger, Telegram and SMS communications;
email ticketing;
voice interactions;
contacts and lead information;
Knowledge Base content;
uploaded documents;
AI prompts and responses;
data collected through forms and conversational workflows;
customer-created attributes and metadata;
information retrieved from or sent to third-party integrations;
API and webhook payloads; and
other data that the customer chooses to process through the Services.

The customer is responsible for determining the purpose and legal basis for such processing, providing the required privacy information to its data subjects, configuring the Services consistently with applicable law and responding to data-subject requests.

Tiledesk processes this data only on documented instructions from the customer, as further described in the DPA, unless processing is otherwise required by applicable law.

3.3 Customer-selected third-party integrations

Customers may connect Tiledesk to third-party platforms, APIs, AI providers or other services.

Where the customer independently selects a third-party service, enters its own credentials or API key, or instructs Tiledesk to transmit data to that third party, the processing performed by that provider may be governed directly by the agreement and privacy terms between the customer and the provider.

A third-party provider is considered a Tiledesk subprocessor only where Tiledesk appoints that provider to process Customer Personal Data on Tiledesk’s behalf in connection with the provision of the Services.

4. GDPR principles

We process personal data according to the principles established by Article 5 GDPR.

In particular, personal data must be:

processed lawfully, fairly and transparently;
collected for specified, explicit and legitimate purposes;
adequate, relevant and limited to what is necessary;
accurate and, where necessary, kept up to date;
retained no longer than necessary for the applicable purpose;
processed using appropriate security and confidentiality measures; and
handled in a manner that enables Tiledesk to demonstrate compliance with applicable data protection requirements.

We apply the principles of privacy by design and privacy by default when designing and operating our Services.

PART I – PERSONAL DATA PROCESSED BY TILEDESK AS CONTROLLER

5. Personal data we collect

Depending on your relationship with Tiledesk, we may process the following categories of personal data.

5.1 Account and identification information

This may include:

first and last name;
username;
business email address;
telephone number;
company and job title;
account identifier;
workspace or organisation membership;
authentication and account-management information.

5.2 Commercial and contractual information

This may include:

company information;
subscription and plan information;
orders;
contractual communications;
customer relationship history;
quotations and commercial requests.

5.3 Billing and payment information

This may include:

billing address;
company and VAT information;
invoice information;
payment status;
transaction identifiers.

Where payment-card details are collected through a payment provider such as Stripe, full payment-card credentials are processed by that provider and are not intended to be stored by Tiledesk.

5.4 Communications with Tiledesk

When you contact us, we may process:

your contact details;
the content of emails and support requests;
attachments you provide;
meeting or demo information;
information necessary to investigate and respond to your request.

5.5 Technical and usage information

When you use our Websites or Services, we may receive technical data such as:

IP address;
date and time of access;
browser type and version;
operating system;
device information;
user agent;
pages or functions accessed;
session and authentication information;
application events;
security and audit logs;
approximate location inferred from IP address where applicable.

5.6 Marketing information

Where applicable, we may process:

contact information;
marketing preferences;
newsletter subscriptions;
interactions with Tiledesk marketing communications;
information relating to commercial interests in our products and services.

6. Why we process personal data and our legal bases

We process personal data only where a valid legal basis applies.

Purpose	Typical legal basis
Creating and administering a Tiledesk account	Performance of a contract or steps requested before entering a contract – Art. 6(1)(b) GDPR
Providing the subscribed Services	Art. 6(1)(b) GDPR
Responding to sales, support and other enquiries	Art. 6(1)(b) and/or legitimate interests – Art. 6(1)(f)
Managing customer and commercial relationships	Art. 6(1)(b) and Art. 6(1)(f)
Billing, accounting and taxation	Contractual necessity and compliance with legal obligations – Art. 6(1)(b) and (c)
Protecting the Services, accounts and infrastructure from abuse, fraud and security threats	Legitimate interests – Art. 6(1)(f), and legal obligations where applicable
Maintaining technical, operational and security logs	Legitimate interests – Art. 6(1)(f)
Establishing, exercising or defending legal claims	Legitimate interests – Art. 6(1)(f)
Complying with legal or regulatory obligations	Art. 6(1)(c)
Sending marketing communications	Consent under Art. 6(1)(a), where required, or legitimate interests where permitted by applicable electronic-marketing rules
Non-essential analytics or advertising technologies	Consent, where required by applicable cookie and ePrivacy rules

Where processing is based on legitimate interests, we assess those interests against the rights and freedoms of affected individuals.

Where we rely on consent, consent may be withdrawn at any time, without affecting the lawfulness of processing performed before withdrawal.

7. Cookies and similar technologies

Tiledesk websites may use cookies and similar technologies for purposes including:

providing essential website functionality;
maintaining sessions and security;
remembering user preferences;
measuring website performance;
analytics; and
marketing or advertising, where enabled.

Cookies or tracking technologies that are not strictly necessary are activated only where permitted by applicable law and, where required, after obtaining the user’s consent.

Users must be able to reject non-essential cookies as easily as they can accept them and may withdraw their consent through the cookie preference controls.

More detailed and current information about individual cookies, providers, purposes and retention periods should be provided through Tiledesk’s Cookie Policy and Consent Management Platform.

PART II – DATA PROCESSED THROUGH TILEDESK SERVICES ON BEHALF OF CUSTOMERS

8. Customer Service Data

When a Tiledesk customer uses the Services, the customer may submit, transmit, store, retrieve or otherwise process information through Tiledesk (“Customer Service Data”).

Depending on the features enabled by the customer, Customer Service Data may include the following categories.

8.1 End-user identification and contact data

For example:

name and surname;
email address;
telephone number;
usernames;
account identifiers;
authenticated user identifiers;
anonymous visitor identifiers or UUIDs;
social or messaging-channel identifiers;
customer-defined profile fields.

8.2 Conversation and support data

For example:

live-chat messages;
chatbot and AI Agent conversations;
human-agent responses;
full conversation transcripts;
email and ticket content;
internal conversation attributes;
timestamps;
conversation status;
department or agent assignment;
tags and routing information;
customer support information.

8.3 Attachments and multimedia content

Depending on the channel and customer configuration, this may include:

documents;
images;
audio;
video;
email attachments;
other files transmitted by users.

8.4 Technical and contextual metadata

For example:

IP address where processed;
browser and operating-system information;
user agent;
source page;
language;
session identifiers;
channel used;
country or city information where derived or provided;
message and event timestamps;
request and conversation identifiers.

8.5 Customer-configured fields and integration data

Customers may define additional fields or connect Tiledesk to external systems. Data may therefore include:

CRM data;
lead information;
order information;
shipment or tracking information;
support-case identifiers;
employee information;
custom metadata;
API data;
webhook payloads;
information retrieved from external systems.

The particular categories processed are determined by the customer.

8.6 Knowledge Base and AI data

Where AI and Knowledge Base functionality is used, Customer Service Data may also include:

prompts;
questions submitted by users;
AI-generated responses;
documents uploaded to the Knowledge Base;
text extracted from documents;
website or URL content added by the customer;
Q&A content;
PDF, DOCX, CSV or other supported documents;
text segments or chunks;
embeddings or vector representations;
information retrieved from the Knowledge Base to generate a response.

8.7 Voice data

Where voice functionality is enabled, processing may include:

telephone numbers;
call metadata;
spoken input;
call or conversation content;
transcripts;
information generated by speech-to-text or text-to-speech functionality.

8.8 Special categories of personal data

Tiledesk does not require customers to submit special-category data under Article 9 GDPR or data relating to criminal convictions and offences under Article 10 GDPR in order to use the standard Services.

Customers are responsible for determining whether such data may lawfully be processed through their configured use case and for implementing any additional safeguards, legal bases or contractual measures required by applicable law.

Where Tiledesk processes such information on behalf of a customer, it does so solely according to the customer’s documented instructions and the DPA.

9. AI and automated processing

Tiledesk provides functions that allow customers to build AI Agents and automated workflows.

Depending on customer configuration, information submitted through a conversation may be used to:

generate responses;
retrieve information from a Knowledge Base;
classify a message or request;
extract structured information;
route a conversation;
determine the next step in a workflow;
invoke an external tool or integration; or
assist a human operator.

When these activities are carried out using Customer Service Data, the customer determines the purpose and configuration of the processing and Tiledesk normally acts as Data Processor.

Customers are responsible for determining whether their particular implementation constitutes profiling or automated decision-making within the meaning of the GDPR, including Article 22, and for implementing human oversight and other safeguards where required.

In its own role as Data Controller, Tiledesk does not intend to make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals unless expressly disclosed and permitted by applicable law.

10. Data minimisation and customer responsibility

Tiledesk provides configurable features that allow customers to decide what data is collected through their workflows.

Customers should configure those features according to the principle of data minimisation and should not collect or transmit personal data that is unnecessary for the intended purpose.

In particular, customers are responsible for:

establishing an appropriate legal basis;
providing privacy information to their users;
collecting any required consent;
limiting data fields to what is necessary;
determining appropriate retention periods;
configuring integrations and AI providers appropriately;
determining whether sensitive data can be processed;
responding to data-subject requests; and
complying with sector-specific requirements applicable to their use case.

PART III – DISCLOSURE, SUBPROCESSORS AND INTERNATIONAL TRANSFERS

11. Who receives personal data?

Depending on the context, personal data may be disclosed to:

Tiledesk employees and authorised personnel who require access for their duties;
cloud infrastructure and database providers;
AI and Knowledge Base service providers;
communication providers;
email-delivery providers;
payment providers;
CRM and customer-support providers;
analytics and marketing providers, subject to applicable consent requirements;
professional advisers such as lawyers, accountants and auditors;
public authorities, courts or regulators where required by law;
parties involved in a merger, acquisition, restructuring or transfer of business, subject to appropriate confidentiality and data-protection measures.

We do not sell Customer Service Data.

12. Subprocessors

Where Tiledesk acts as Data Processor, it may appoint subprocessors to assist in providing the Services.

Tiledesk requires subprocessors to enter into written contractual arrangements imposing appropriate confidentiality, security and data-protection obligations in accordance with Article 28 GDPR.

The applicable subprocessor may depend on:

the features selected by the customer;
the communication channel used;
integrations enabled by the customer;
the AI provider selected;
the customer’s deployment configuration.

12.1 Core infrastructure and service subprocessors

At the date of this Policy, Tiledesk publicly identifies the following core providers:

Provider	Activity	Categories of data potentially processed	Principal processing location
Amazon Web Services EMEA SARL	Cloud infrastructure/database hosting	Service data, including conversations, interactions and stored customer information	European Union
Google Ireland Limited / Google Cloud	Cloud infrastructure/database services	Service data	European Union
MongoDB GmbH	Managed cloud database services	Service data	European Union
Pinecone Systems, Inc.	Vector database / Knowledge Base retrieval	Content and documents used for Knowledge Base/vector retrieval	European Union
OpenAI Ireland Ltd	LLM processing and AI/RAG functionality where OpenAI-backed functionality is used	Prompts, messages, retrieved Knowledge Base content and related AI input/output as applicable	European Union and/or United States depending on service configuration and processing arrangement

The precise data transmitted depends on the feature used.

12.2 Optional feature-specific providers

Where the relevant feature or integration is enabled, personal data may also be processed through providers including:

Provider	Function	Data concerned
Celonis, Inc. / Make	Workflow automation	Data selected by the customer for transmission through the integration
HubSpot, Inc.	CRM, marketing, sales and customer-service integration	Data selected by the customer for transmission to HubSpot
Mailgun Technologies, Inc.	Email/SMTP delivery	Email address, message and related SMTP/email information
Meta Platforms	Facebook Messenger integration	Account/channel information and message content
Meta Platforms	WhatsApp Business integration	Account information, telephone number, message content and relevant media
Peaberry Software, Inc. / Customer.io	Customer communications and marketing automation	Name, email address, telephone number and campaign-related information as configured
Qapla’ S.p.A.	Shipping and e-commerce integration	Name, email, order and tracking information where used
Telegram	Telegram messaging integration	Account identifiers, telephone number where available and message content
Twilio Inc.	SMS and/or communication functionality	Telephone number, name where supplied, message or communication content

Some providers offer different regional hosting or processing environments. The region applicable to a particular integration may therefore depend on Tiledesk’s or the customer’s configured account and selected service region.

Tiledesk maintains a separate Subprocessor List, which should be consulted for the current legal entity, processing activity, categories of data, processing/hosting regions and applicable international-transfer mechanism for each Tiledesk-appointed subprocessor.

Providers connected directly by customers using customer-owned credentials or API keys are not necessarily Tiledesk subprocessors.

13. International transfers of personal data

Tiledesk is an Italian company and seeks to use European processing locations where appropriate and available. However, use of certain service providers, AI services, communication channels or customer-selected integrations may result in personal data being transferred to or accessed from countries outside the European Economic Area (“EEA”).

Tiledesk does not rely on the former EU-US Privacy Shield framework.

Where personal data is transferred outside the EEA, Tiledesk uses an appropriate transfer mechanism under Chapter V GDPR, as applicable. These may include:

13.1 Adequacy decisions

Personal data may be transferred to a country, territory or organisation recognised by the European Commission as providing an adequate level of protection under Article 45 GDPR.

For transfers to the United States, this may include transfers to an eligible organisation participating in the EU-US Data Privacy Framework, where applicable.

13.2 Standard Contractual Clauses

Where no applicable adequacy decision exists, Tiledesk may rely on the European Commission’s Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, together with appropriate contractual, organisational and technical safeguards.

Where required, Tiledesk assesses the circumstances of the transfer and whether supplementary measures are appropriate.

13.3 Other GDPR transfer mechanisms

Where applicable, transfers may also rely on another mechanism recognised under Articles 46 or 47 GDPR, such as approved Binding Corporate Rules.

Derogations under Article 49 GDPR are used only where their legal requirements are met and they are appropriate to the specific transfer.

Information on the safeguards applicable to a particular Tiledesk-appointed subprocessor may be requested by contacting safety@tiledesk.com, subject to any necessary protection of confidential or commercially sensitive information.

PART IV – RETENTION AND SECURITY

14. How long we retain personal data

Tiledesk applies the GDPR principle of storage limitation.

Retention depends on the type of personal data, why it is processed, contractual requirements, customer instructions and applicable legal obligations.

14.1 Account and contractual data

Account and customer-administration data is generally retained for the duration of the account or commercial relationship and subsequently for the period necessary to comply with legal obligations or establish, exercise or defend legal claims.

14.2 Accounting and invoicing data

Accounting, invoicing and tax records are retained for the periods required by Italian law, generally 10 years, subject to any longer period required in connection with proceedings, audits or other legal obligations.

14.3 Sales and support communications

Sales enquiries and support communications are retained for as long as necessary to manage the relevant request and subsequently where reasonably necessary for customer relationship management, security, contractual evidence or legal claims.

14.4 Marketing data

Where marketing is based on consent, data is processed until consent is withdrawn or the data is no longer necessary for the relevant marketing purpose.

Where a person opts out of marketing, Tiledesk may retain limited information in a suppression list in order to ensure that the opt-out continues to be respected.

14.5 Technical and security data

Technical, access and security logs are retained for periods proportionate to their purpose, taking into account security requirements, investigation needs and legal obligations.

Data relevant to an identified security incident may be retained for longer where necessary to investigate, remediate or establish legal claims.

14.6 Customer Service Data

Where Tiledesk acts as Data Processor, retention is determined by:

the applicable Service and subscription configuration;
documented customer instructions;
the DPA;
the applicable Order Form or agreement; and
legal obligations applicable to Tiledesk.

At the end of the processing relationship, Customer Personal Data is deleted or returned in accordance with the DPA, subject to applicable legal-retention requirements.

Residual copies may remain for a limited period in backup systems until they are overwritten or deleted as part of the normal backup lifecycle, provided that such data remains protected and is not used for other purposes.

15. Security measures

Tiledesk applies technical and organisational measures designed to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.

Depending on the relevant Service and deployment, these measures include:

Access and identity security

role-based and workspace-level access controls;
access limited according to operational need;
controlled access profiles for authorised personnel;
one-way password hashing;
enterprise Single Sign-On support where applicable;
logging of authentication and relevant configuration events.

Encryption and network security

encryption of traffic in transit using TLS 1.2 or higher;
encrypted internal cloud communications using mTLS where applicable;
network-protection mechanisms;
Web Application Firewall protections;
DDoS mitigation controls.

Availability and resilience

managed multi-availability-zone database infrastructure where applicable;
encrypted off-site backups;
point-in-time database recovery mechanisms;
project history and rollback capabilities where available.

Monitoring and traceability

cloud-resource audit logging;
application audit logs;
security-event monitoring and alerting;
monitoring of relevant configuration changes.

Application security

automated and manual code review;
regular application and security updates;
vulnerability-management activities;
external penetration testing and vulnerability assessments performed periodically.

Organisational measures

confidentiality obligations;
access authorisation procedures;
personnel instructions and security policies;
employee background or reference checks where permitted by applicable law;
procedures for managing security incidents and personal-data breaches.

Where Tiledesk acts as Data Processor and becomes aware of a Personal Data Breach concerning Customer Personal Data, Tiledesk notifies the relevant customer without undue delay and in accordance with the timeframe specified in the DPA.

No online service can guarantee absolute security. Tiledesk therefore periodically reviews its safeguards considering the state of the art, implementation costs, nature and scope of the processing and risks to individuals.

PART V – YOUR RIGHTS

16. GDPR rights

Where Tiledesk acts as Data Controller, and subject to the conditions established by applicable law, you may have the right to:

access your personal data;
obtain rectification of inaccurate or incomplete personal data;
obtain erasure of personal data;
request restriction of processing;
object to processing based on legitimate interests;
object at any time to processing for direct marketing;
receive certain personal data in a structured, commonly used and machine-readable format and exercise your right to data portability;
withdraw consent at any time where processing is based on consent;
obtain safeguards in relation to certain forms of automated decision-making, where applicable; and
lodge a complaint with a competent supervisory authority.

To exercise rights concerning personal data for which Tiledesk is Controller, contact:

safety@tiledesk.com

We may request information reasonably necessary to verify your identity before responding to a request.

Requests will be handled within the time limits established by the GDPR.

17. Requests concerning a Tiledesk customer’s chatbot, AI Agent or communication channel

If you interacted with an organisation that uses Tiledesk — for example through its website chatbot, live chat, WhatsApp service or AI Agent — that organisation is normally the Data Controller for your conversation.

You should therefore direct your privacy request to that organisation.

If Tiledesk receives a request concerning Customer Personal Data for which it acts solely as Data Processor, Tiledesk will, where appropriate, refer or transmit the request to the relevant customer and will provide the assistance required under the DPA and applicable law.

Tiledesk will not independently decide whether Customer Personal Data should be deleted, corrected, disclosed or otherwise modified except where authorised by the customer or required by law.

18. Right to complain

You have the right to lodge a complaint with the data-protection supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

As Tiledesk is established in Italy, the relevant Italian supervisory authority is:

Garante per la protezione dei dati personali

Information about how to submit a complaint is available through the Garante’s official website.

We encourage you to contact us first at safety@tiledesk.com if you have concerns about the way we process your personal data.

PART VI – OTHER INFORMATION

19. Children and minors

Tiledesk’s account-based commercial Services are designed primarily for businesses and professional users and are not intended to be directly marketed to children.

Customers that use Tiledesk Services to interact with children or minors are responsible for determining whether such use is lawful, providing appropriate privacy information and obtaining parental or other authorisation where required.

If we learn that personal data has been collected by Tiledesk in its role as Data Controller contrary to applicable child-data protection requirements, we will take appropriate steps to delete or otherwise lawfully handle that information.

20. Self-hosted and on-premise deployments

Tiledesk can also be deployed by customers on infrastructure controlled by the customer or another provider selected by the customer.

For a fully self-hosted implementation, Tiledesk may not receive or have access to conversation or Customer Service Data stored within that environment.

In such cases, this Privacy Policy continues to apply to personal data independently provided to Tiledesk, such as account, contractual, billing, support or commercial information, but the customer is responsible for the personal data processed within its own deployment.

21. Third-party services and websites

Our Websites and Services may contain links to, or enable integrations with, third-party services.

Unless a third-party provider acts as a processor or subprocessor on Tiledesk’s behalf, its processing of personal data is governed by its own privacy notice and contractual terms.

Customers should evaluate the privacy and security practices of third-party services before enabling integrations that cause Customer Personal Data to be transmitted to those services.

22. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

changes to our Services;
new functionality;
changes to our processing activities or providers;
regulatory or legal developments;
improvements to our privacy and security practices.

When we update the Policy, we will change the “Last updated” date.

Where a change materially affects how personal data is processed, we will provide additional notice where required, for example through the Services, website or email.

Previous versions may be retained for accountability and reference purposes.

23. Contact us

For questions concerning this Privacy Policy, our privacy practices or the exercise of your rights, contact:

Tiledesk S.r.l.
Via Fratelli Bandiera 17
73010 Soleto (LE), Italy

Privacy contact: safety@tiledesk.com

Contact Us

If you have questions or need to contact us about this Privacy Policy, please email us at safety@tiledesk.com.