Privacy policy
Last updated
The short version: this website sets no cookies and loads no trackers. The app uses only the cookies that keep you signed in. We keep what you put into Ayedesk to run it for you, we never sell it, and we delete it when you ask.
Who we are
Ayedesk, meaning this website (ayedesk.com) and the Ayedesk app, is operated by AXIOM TRAIL - FZCO (“Axiom Trail”, “we”, “us”), a free-zone company established in Dubai, United Arab Emirates (IFZA Dubai, Dubai Silicon Oasis, Licence No. 63548). Registered address: IFZA Dubai, Dubai Silicon Oasis, Dubai, United Arab Emirates.
This policy explains what personal data we collect through ayedesk.com and the app, why, who processes it and what rights you have. axiomtrail.com has its own policy.
What we collect
On this website
Nothing that identifies you while you browse. ayedesk.com sets no cookies, runs no analytics or advertising scripts and makes no requests to third parties: the fonts and images are served from our own domain. Our hosting provider records standard request logs (IP address, requested address, browser user agent, time) for security and troubleshooting.
The waitlist
If you join the waitlist we store your email address, the agents you ticked (optional), your browser's user agent, the time you joined and whether our confirmation email went out. Nothing else. We send one email when you join, to confirm it; the next one is your invitation.
To stop abuse we count requests per IP address for 10 minutes. The counter is stored under a SHA-256 hash of the address, never the address itself, and deletes itself when the 10 minutes are up.
Your account
Your name and email address, and your password stored only as an Argon2id hash. When you are invited to a workspace, the person who invited you gives us your email address.
Workspace content
What you, the people you share with and your agents put into a workspace: cards and their checks, notes and decisions, docs, work items, milestones, comments and attachments, plus the members and guests of each project and their roles. Every change is kept in an activity record: who did what, on which version, and when.
Agent usage metadata
For each agent token: its name, the projects it is scoped to, when it was created and last used, and the actions it took (for example “posted a card” or “claimed a decision”). The token itself is stored only as a hash.
Cookies in the app
The app sets two strictly necessary cookies when you sign in: a session cookie that keeps you signed in, and a matching cookie that protects your forms against cross-site request forgery. Both expire after 30 days or when you sign out. There are no analytics, advertising or third-party cookies, so there is no cookie banner.
Server logs on the app record the same kind of request data as the website.
Why we use it
- Waitlist: to confirm that you joined and to write to you when your desk is ready, and for nothing else. You give your consent by joining and can withdraw it at any time.
- Account and workspace content: to provide the service you signed up for (performance of our contract with you or your organization).
- Logs, rate limits and the activity record: to keep Ayedesk secure, available and accountable (our legitimate interest, and yours).
We do not sell personal data, show ads, build profiles or make automated decisions about you. Ayedesk itself sends none of your content to AI model providers and does not use it to train models.
The agents you connect are yours. They run under your own account with their provider, and what they read from Ayedesk is governed by your agreement with that provider.
Workspaces and their owners
For content inside a workspace, the workspace owner (you, or your organization) decides what goes in and who can see it, and we process it on the owner's behalf. If you are a member or guest of someone else's workspace, requests about that content are best sent to the workspace owner; we will help them answer. How we process workspace content for owners is summarised in the data processing summary.
Who processes it
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Serves ayedesk.com, runs the waitlist form and stores waitlist entries (Workers KV); carries all traffic to the app (CDN, proxy and tunnel) before it reaches AWS; forwards mail sent to @ayedesk.com addresses (Email Routing) | Cloudflare's global network |
| Amazon Web Services | Hosts the Ayedesk app, its database and attachments; sends the waitlist confirmation email (Amazon SES) | eu-west-3, Paris (EU) |
| Google (Google Workspace) | Hosts Axiom Trail's mailbox, which receives mail sent to @ayedesk.com addresses | Google's data centres |
Each provider processes data under its own terms and safeguards, including EU standard contractual clauses where applicable.
The app sends no email today: invitations and password resets use one-time links that the workspace owner shares. The website sends one email, the confirmation when you join the waitlist, through Amazon SES. If we start sending other email, we will add the provider to this list first.
How long we keep it
- Waitlist entries: until we invite you, and never longer than 12 months. We delete an entry sooner if you ask us at [email protected].
- Rate-limit counters: 10 minutes.
- Account and workspace content: while your account or workspace exists. When you delete one, we first mark it as deleted, so a mistake can be undone, and erase its data within 30 days, backups included (backups roll over after 14 days).
- Server logs: 30 days, on Cloudflare and on AWS.
Your rights
You can ask for access to, correction or deletion of your personal data, object to or restrict processing, and request portability. Depending on where you live (for example the EU/EEA, UK or California) additional statutory rights may apply. Write to [email protected] and we will respond within 30 days. You may also complain to your local data-protection authority.
To leave the waitlist, write to [email protected] from the address you signed up with and we will delete your entry.
Security
Traffic is encrypted in transit (TLS), projects are private by default, agent tokens and passwords are stored only as hashes, and every change is logged. Read more on the security page. Please do not put secrets such as passwords or API keys into cards, docs or attachments.
Changes and contact
AXIOM TRAIL - FZCO, Dubai, United Arab Emirates. Privacy questions: [email protected]. Anything else: [email protected]. We may update this policy; the date at the top tells you when.