Privacy Policy

1. Who we are (data controller)

Loveley Desk is a product of 3S Computer System and Software, a business licensed in the United Arab Emirates. 3S Computer System and Software is the data controller for the personal data processed through Loveley Desk, within the meaning of the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). The service is operated directly by the owner of the establishment — there is no separate team with standing access to your data. For privacy questions, contact us at info@loveleydesk.com.

2. What we collect

This list reflects what the product actually stores:

• Account data: email address, display name, avatar color, interface language, desk theme, presence status, and break/day-ahead email preferences.
• Workspace content: tasks, reminders, sticky notes (corkboard pins), journal entries, calendar events, sheets, projects, saved links, and files you upload to the file cabinet (including the stored file contents).
• Contact data you enter: the card holder and desk add-ons can store names, email addresses, and phone numbers of your own contacts or clients. You are responsible for having the right to store those details.
• Team data: departments, seat counts, invite links, team-up requests, comments and attachments, and teammate relationships within your workspace.
• Support data: support ticket subjects, messages, categories, and our responses.
• Billing data: your plan, seat count, subscription status, and Paddle customer/subscription identifiers. Card numbers and full payment details are collected and stored by Paddle, never by us.
• Usage data: basic logs needed to operate the service, such as authentication events, error reports, and referral code usage.

3. How we use your data

We use your data to provide and improve Loveley Desk, authenticate you, process payments, send the emails you opt into (such as the Day Ahead summary), respond to support requests, and keep your workspace secure. We do not sell personal data and do not use your content for advertising.

4. Legal basis for processing

We process personal data based on the need to perform our contract with you (providing the service), our legitimate interest in keeping the service secure, and any consent you give for optional communications.

5. Who can access your data

• You — everything on your desk.
• Teammates you invite — workspace data is shared exactly as the features describe: team members can see the team directory, corkboard, and team-up requests. Journal entries, tasks, reminders, and files remain private to you unless a feature explicitly shares them. Teammates never see your email address.
• The operator (data controller) — the owner of 3S Computer System and Software may access data only to operate the service, respond to support requests you raise, fix problems, and prevent abuse. There is no wider staff with routine access.
• Service providers — the processors listed in section 6, strictly to run their part of the service.

6. Subprocessors and integrations

We rely on trusted service providers to run Loveley Desk:

• Lovable Cloud: hosts the application, database, authentication, and file storage.
• Paddle: our Merchant of Record — handles payment processing, billing, tax, and subscription management.

These providers process data on our behalf under appropriate agreements. We do not otherwise share personal data with third parties except as required by law.

7. Cookies and analytics

We use essential cookies and local storage to keep you signed in and maintain session security. We do not currently use third-party analytics or advertising cookies. If we add them later, we will update this policy and request consent where required.

8. Retention and how account deletion works

We keep your data for as long as your account is active. You can delete your account yourself at any time from Settings → Profile → Delete your account, or by emailing us from your account address. Here is exactly what happens end-to-end:

1. If you have an active paid subscription, deletion is blocked until you cancel it from the Billing tab — this prevents orphaned billing. Cancel first, then delete.
2. Your stored files are removed from file storage immediately.
3. Everything you created is permanently deleted: tasks, reminders, pins, journal entries, calendar events, sheets, projects, links, card-holder entries, files, folders, departments and invites you created, team-up requests and comments you authored, support tickets, and referral codes.
4. Your profile, preferences, subscription record, and sign-in credentials are deleted, and you are signed out.
5. Billing transaction records already processed by Paddle (invoices, tax records) are retained by Paddle as required by accounting and tax law — these never contained your workspace content.
6. Residual copies in encrypted system backups expire on the normal backup cycle, within 30 days.

Deletion is immediate and cannot be undone. Where a longer retention period is required by law (for example billing records), only that narrow category is kept.

9. Your rights

Under the UAE PDPL and depending on your location, you may have the right to access, correct, delete, restrict, object to, or export your personal data. You can exercise correction and deletion directly in the product (Settings), and for anything else email us at info@loveleydesk.com from the email address associated with your account.

10. Security

We use encrypted connections (HTTPS), authenticated access, row-level database permissions that isolate every account's data, and short-lived signed links for file downloads. Passwords are hashed by our authentication provider — we never see them. No online service can guarantee absolute security, and we encourage you to use a strong, unique password.

11. Children's privacy

Loveley Desk is not intended for users under 16. We do not knowingly collect data from children under 16. If you believe we have collected such data, please contact us so we can delete it.

12. International transfers

Your data may be stored and processed in countries outside the United Arab Emirates, including where our hosting providers operate. We rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms where required.

13. Changes to this policy

We may update this Privacy Policy from time to time so it keeps matching what the product actually does. We will post the revised version with a new "Last updated" date and, for material changes, notify you through the app or by email.

14. Contact us

Questions about this policy or your data? Email info@loveleydesk.com.